@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +90 more potentially affected by CVE-2026-56697 via nuxt (>=3.0.0, <=3.20.1)

nuxt NPM version =3.0.0, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-56697 Source advisory: SNYK:JS-NUXT-17430976...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +20 more potentially affected by CVE-2026-56697 via nuxt (>=4.0.0-rc.0, <=4.4.6)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-56697 Source advisory: SNYK:JS-NUXT-17430976...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +90 more potentially affected by CVE-2026-56698 via nuxt (>=3.0.0, <=3.20.1)

nuxt NPM version =3.0.0, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-56698 Source advisory: SNYK:JS-NUXT-17430978...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +20 more potentially affected by CVE-2026-56698 via nuxt (>=4.0.0-rc.0, <=4.4.6)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-56698 Source advisory: SNYK:JS-NUXT-17430978...

budibase (>=0.0.3, <=0.0.31) potentially affected by CVE-2026-50136 via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-50136 Source advisory: SNYK:JS-BUDIBASESERVER-17660568...

budibase (>=0.0.3, <=0.0.31) potentially affected by CVE-2026-50132 via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-50132 Source advisory: SNYK:JS-BUDIBASESERVER-17660567...

@budibase/backend-core (>=0.0.999-alpha.30, <=3.2.26), @budibase/bbui (>=0.0.999-alpha.30, <=3.2.26) +9 more potentially affected by CVE-2026-48170 via scim-patch (>=0.7.1, <=0.8.3)

scim-patch NPM version =0.7.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =1.0.11, =1.2.1 Source cves: CVE-2026-48170 Source advisory: OSV:GHSA-9M6G-WC8R-Q59C...

@budibase/backend-core (>=0.0.999-alpha.30, <=3.2.26), @budibase/bbui (>=0.0.999-alpha.30, <=3.2.26) +9 more potentially affected by CVE-2026-48170 via scim-patch (>=0.7.1, <=0.8.3)

scim-patch NPM version =0.7.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =1.0.11, =1.2.1 Source cves: CVE-2026-48170 Source advisory: SNYK:JS-SCIMPATCH-17818138...

ayy (>=0.1.6, <=0.1.8), crawl4agent (>=0.2.0, <=0.3.5) +19 more potentially affected by CVE-2026-56260 +6 more via crawl4ai (>=0.3.731, <=0.8.5)

crawl4ai PYPI version =0.3.731, =0.1.6, =0.2.0, =0.1.0, =0.5.0, =0.1.0, =0.4.0, =0.1.0, =0.1.0, =0.1.7.5b6 and more Source cves: CVE-2026-56260, CVE-2026-56261, CVE-2026-56262, CVE-2026-56263, CVE-2026-56264, CVE-2026-56265, CVE-2026-56266 Source advisory: OSV:PYSEC-2026-596...

Malicious code in node-fetch-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78aef0d64a7d761d2987d27aea462083425e5692475cd81332b7a3152c754308 On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host node22.lunes.host:3258, authenticates with a 5-minute rolling HMAC-SHA256 token,...

pyspark-ai (>=0.1.0, <=0.1.12), spark-llm (>=0.1.4, <=0.1.9) potentially affected by CVE-2026-55443 via langchain (0.0.201)

langchain PYPI version 0.0.201 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - pyspark-ai =0.1.0, =0.1.4, =0.1.9 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

vocode (>=0.1.51, <=0.1.98), xtracture (>=0.1.0, <=0.4.0) potentially affected by CVE-2026-55443 via langchain (0.0.117)

langchain PYPI version 0.0.117 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - vocode =0.1.51, =0.1.0, =0.4.0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

git-genie (0.1.0) potentially affected by CVE-2026-55443 via langchain (0.0.71)

langchain PYPI version 0.0.71 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - git-genie 0.1.0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

agentic-kit-eda (0.0.2), agentic-kit-flow (0.0.1) +9 more potentially affected by CVE-2026-55443 via langchain (0.3.21)

langchain PYPI version 0.3.21 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - agentic-kit-eda 0.0.2 - agentic-kit-flow 0.0.1 - allms =1.0.12, =0.1.50, =0.2.0, =1.0.2, =0.1.0, =3.0.0, =0.1.0, =0.2.1 Source cves:...

agentuniverse (>=0.0.6.dev1, <=0.0.7), athina (>=0.1.5, <=0.1.6) +12 more potentially affected by CVE-2026-55443 via langchain (0.0.352)

langchain PYPI version 0.0.352 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - agentuniverse =0.0.6.dev1, =0.1.5, =0.0.8, =0.0.4, =0.0.8, =0.1.44, =0.0.1, =0.3.0, =0.1.3, =0.1.26, =0.1.28 Source cves: CVE-2026-55443...

langserve (0.0.1), llama-cpp-http (0.2.9) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.304)

langchain PYPI version 0.0.304 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - langserve 0.0.1 - llama-cpp-http 0.2.9 - openbrain =0.13.0, =0.1.0, =0.2.13 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

simplerag (0.0.1) potentially affected by CVE-2026-55443 via langchain (0.0.165)

langchain PYPI version 0.0.165 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - simplerag 0.0.1 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

docfusion (0.1.0), kgraphplanner (>=0.0.1, <=0.0.2) +7 more potentially affected by CVE-2026-55443 via langchain (0.2.12)

langchain PYPI version 0.2.12 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - docfusion 0.1.0 - kgraphplanner =0.0.1, =1.2.15, =0.2.2, =0.0.2, =0.0.10, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-55443 Source advisory:...

edubotics-core (>=0.1.3, <=0.1.7) potentially affected by CVE-2026-56104 via chainlit (1.2.0)

chainlit PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - edubotics-core =0.1.3, =0.1.7 Source cves: CVE-2026-56104 Source advisory: OSV:GHSA-C39V-8HRW-H448...

swarm-plus (>=0.0.0.1, <=0.1.0) potentially affected by CVE-2026-56104 via chainlit (1.3.1)

chainlit PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - swarm-plus =0.0.0.1, =0.1.0 Source cves: CVE-2026-56104 Source advisory: OSV:GHSA-C39V-8HRW-H448...