com.agorapulse:micornaut-worker-queues-sqs-v1 (1.0.1), com.agorapulse:micronaut-aws-sdk-ag-ws (>=1.3.7.6, <=2.1.12-micronaut-1.0) +123 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (>=1.2.8, <=3.10.5)

io.micronaut:micronaut-http-client MAVEN version =1.2.8, =1.3.7.6, =1.3.7.6, =2.0.8-micronaut-1.0, =1.3.7.6, =1.3.7.6, =1.6.2-micronaut-1.0, =2.1.0-micronaut-1.0, =1.3.7.6, =1.5.0, =2.0.3-micronaut-1.0, =1.3.7.6, =1.3.7.6, =1.3.7.6, =1.3.7.6, =2.1.12-micronaut-1.0 and more Source cves: unknown...

io.micronaut:micronaut-discovery-client (1.2.5), io.micronaut:micronaut-function-client (1.2.5) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.2.5)

io.micronaut:micronaut-http-client MAVEN version 1.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.2.5 - io.micronaut:micronaut-function-client 1.2....

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +175 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.0-beta.1, <=2.2.2)

body-parser NPM version =2.0.0-beta.1, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =1.114.0, =3.20.1 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18885 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: SNYK:JS-BODYPARSER-17906397...

MAL-2026-10009 Malicious code in chain-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc73eb727778c3a543bdef1f6993d4c8be38da047fc97b7a0614bd195590249 chain-api-sdk presents itself as the upstream multichain-crypto-wallet library: README, badges, package.json repository.url, and homepage all point t...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +160 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.2, <=2.2.2)

body-parser NPM version =2.0.2, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =1.114.0, =3.20.1 and more Source cves: CVE-2026-12590 Source advisory: MEND:CVE-2026-12590...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18885 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: MEND:CVE-2026-12590...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +176 more potentially affected by CVE-2026-55575 via liquidjs (>=10.2.0, <=10.27.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.4.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =0.31.16 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-55575 Source advisory:...

0xpwn (0.1.1), a2a-acl (0.0.14) +745 more potentially affected by CVE-2026-59820 via litellm (>=1.0.0, <=1.83.4)

litellm PYPI version =1.0.0, =0.3.5, =0.7.3, =1.0.1, =1.0.2, =0.1.0, =0.4.0, =0.1.0, =0.1.39, =0.2.1, =0.2.1.10062025 - agent-memory-server 0.15.0 - agent-opt 0.0.1 and more Source cves: CVE-2026-59820 Source advisory: SNYK:PYTHON-LITELLM-17900529...

ace-step15-fork (20260210.0.0), ai-voice-interconnector (>=0.10.6, <=0.10.7) +92 more potentially affected by CVE-2026-59806 via gradio (>=6.0.0.dev5, <=6.19.0)

gradio PYPI version =6.0.0.dev5, =0.10.6, =1.0.0, =0.0.6, =0.0.1, =0.13.1, =0.0.1, =0.1.2, =0.1.0, =0.1.6, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-59806 Source advisory: SNYK:PYTHON-GRADIO-17901455...

@aoagents/ao (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc), @aoagents/ao-cli (>=0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, <=0.10.1-nightly-249c67046d14809943d228b01eefedb10821e5dc) +82 more potentially affected by CVE-2026-59807 via @composio/core (>=0.1.0-rc.3, <=0.13.1)

@composio/core NPM version =0.1.0-rc.3, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.9.0-nightly-37d3a86d6de2bbeacfa7ad9050773dc7a8702180, =0.0.2, =1.0.0, =0.1.0-rc.3, =4.4.0, =3.8.11, =3.8.11, =3.7.18, =3.7.18, =3.7.18,...

@228-fund/elysia-effect (0.0.1), @228-fund/elysia-msgpack (>=0.0.1, <=0.0.3) +74 more potentially affected by CVE-2026-56669 via elysia (>=1.0.9, <=1.4.28)

elysia NPM version =1.0.9, =0.0.1, =0.1.0, =0.0.1, =0.0.1, =0.1.0, =0.1.4, =0.1.0, =0.1.0-next.4, =1.0.0-next.4, =1.0.0, =0.0.1, =1.0.0, =1.0.2 and more Source cves: CVE-2026-56669 Source advisory: SNYK:JS-ELYSIA-17908759...

shadcn-ui-lib (>=0.0.9, <=0.3.0) potentially affected by CVE-2026-55596 via @platejs/media (53.0.0)

@platejs/media NPM version 53.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/media and may be impacted: - shadcn-ui-lib =0.0.9, =0.3.0 Source cves: CVE-2026-55596 Source advisory: SNYK:JS-PLATEJSMEDIA-17901642...

@libp2p/daemon (>=6.0.0-049bfa0fa, <=6.0.26-3574648c3), @libp2p/daemon-server (>=9.0.0-049bfa0fa, <=9.0.26-3574648c3) potentially affected by CVE-2026-49866 via @libp2p/gossipsub (>=15.0.0-049bfa0fa, <=15.0.23-d59c165ac)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =9.0.26-3574648c3 Source cves: CVE-2026-49866 Source advisory: SNYK:JS-LIBP2PGOSSIPSUB-17901717...

nl.nl-portal:zaken-api (0.3.0.release) potentially affected by CVE-2026-49463 via nl.nl-portal:documenten-api (0.3.0.release)

nl.nl-portal:documenten-api MAVEN version 0.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on nl.nl-portal:documenten-api and may be impacted: - nl.nl-portal:zaken-api 0.3.0.release Source cves: CVE-2026-49463 Source advisory:...

@injectivelabs/wallet-base (1.20.21), @injectivelabs/wallet-core (1.20.21) +7 more potentially affected by unknown CVE via @injectivelabs/sdk-ts (1.20.21)

@injectivelabs/sdk-ts NPM version 1.20.21 is affected by a known vulnerability. The following packages have a transitive dependency on @injectivelabs/sdk-ts and may be impacted: - @injectivelabs/wallet-base 1.20.21 - @injectivelabs/wallet-core 1.20.21 - @injectivelabs/wallet-cosmos 1.20.21 -...

@fumapress/ai (>=0.2.3, <=0.2.5), @fumapress/feedback (>=0.2.4, <=0.2.5) +2 more potentially affected by CVE-2026-49456 via waku (>=1.0.0-alpha.5, <=1.0.0-beta.0)

waku NPM version =1.0.0-alpha.5, =0.2.3, =0.2.4, =0.1.0, =0.2.5 - sladocs 0.1.0 Source cves: CVE-2026-49456 Source advisory: GHSA-43FC-V873-QW85...

org.dspace:dspace-jspui-api (1.6.0-rc2), org.dspace:dspace-jspui-webapp (1.6.0-rc2) +9 more potentially affected by CVE-2026-49830 via org.dspace:dspace-api (1.6.0-rc2)

org.dspace:dspace-api MAVEN version 1.6.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace:dspace-jspui-api 1.6.0-rc2 - org.dspace:dspace-jspui-webapp 1.6.0-rc2 - org.dspace:dspace-lni-core...

org.dspace.modules:additions (5.2), org.dspace.modules:jspui (5.2) +17 more potentially affected by CVE-2026-49831 via org.dspace:dspace-api (5.2)

org.dspace:dspace-api MAVEN version 5.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.dspace:dspace-api and may be impacted: - org.dspace.modules:additions 5.2 - org.dspace.modules:jspui 5.2 - org.dspace.modules:lni 5.2 - org.dspace.modules:oai 5...

academic-chatgpt (>=0.3.0, <=0.4.1), ace-step15-fork (20260210.0.0) +594 more potentially affected by CVE-2026-59806 via gradio (>=1.7.7, <=6.19.0)

gradio PYPI version =1.7.7, =0.3.0, =0.2.1, =1.2.9.1, =0.1.5, =0.0.6, =0.0.2, =0.10.6, =0.3.2, =0.1.0, =0.8.11, =0.1.1, =0.1.1, =0.1.13, =0.1.14 and more Source cves: CVE-2026-59806 Source advisory: MEND:CVE-2026-59806...