NPM: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass

NPM: undici vulnerable to cross-user information disclosure via shared cache whitespace bypass vulnerability discovered by ? in WordPress Npm undici versions = 7.0.0, 7.28.0...

@0xwork/connect (>=0.1.0, <=0.1.9), @a5c-ai/agent-platform (>=5.0.1-staging.19033314d476, <=5.0.1-staging.e195a4980892) +507 more potentially affected by CVE-2026-9678 via undici (>=8.0.0, <=8.4.1)

undici NPM version =8.0.0, =0.1.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =2026.6.2, =1.0.0, =0.6.10, =0.3.1, =2026.4.23-zh, =0.2.0, =0.13.11 and more Source cves...

@3ngram/server (0.7.0), @compeso/node-red-contrib-imap-email (1.0.0) +8 more potentially affected by CVE-2026-82659 via nodemailer (9.0.0)

nodemailer NPM version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nodemailer and may be impacted: - @3ngram/server 0.7.0 - @compeso/node-red-contrib-imap-email 1.0.0 - @hybridaione/hybridclaw =0.25.3, =2.71.0, =2.72.0 - imapflow 1.4.1 -...

tamilai (0.0.2) potentially affected by CVE-2026-57133 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57133 Source advisory: OSV:GHSA-5JV7-2MJM-H6QJ...

tamilai (0.0.2) potentially affected by CVE-2026-57140 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57140 Source advisory: OSV:GHSA-9752-MHQH-H34F...

tamilai (0.0.2) potentially affected by CVE-2026-57141 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57141 Source advisory: SNYK:JS-PRAISONAI-17660574...

tamilai (0.0.2) potentially affected by CVE-2026-57136 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57136 Source advisory: SNYK:JS-PRAISONAI-17660571...

tamilai (0.0.2) potentially affected by CVE-2026-57138 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57138 Source advisory: OSV:GHSA-VMMJ-PFW7-FJWP...

tamilai (0.0.2) potentially affected by CVE-2026-57138 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57138 Source advisory: SNYK:JS-PRAISONAI-17660575...

@tinacms/app (>=0.0.0-0b7103c-20251216023146, <=2.3.24), @tinacms/cli (>=0.0.0-0b7103c-20251216023146, <=2.1.5) +5 more potentially affected by CVE-2026-55661 via @tinacms/mdx (>=2.0.0, <=2.1.6)

@tinacms/mdx NPM version =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-00aadfd-20260223215804, =0.0.0-0b7103c-20251216023146, =0.0.0-0b7103c-20251216023146, =3.4.1 Source cves: CVE-2026-55661 Source...

@adyen/adyen-salesforce-pwa (>=2.0.0, <=3.0.4), @amazeelabs/publisher (>=2.4.28, <=3.2.6) +208 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=3.0.0, <=3.0.5)

http-proxy-middleware NPM version =3.0.0, =2.0.0, =2.4.28, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.3, =1.0.0, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =3.0.0-alpha-1, =21.2.2-depup.0, =21.2.7-depup.0 and more Source cves: CVE-2026-55602 Source advisory:...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +31070 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=0.16.0, <=2.0.9)

http-proxy-middleware NPM version =0.16.0, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +31070 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=0.16.0, <=2.0.9)

http-proxy-middleware NPM version =0.16.0, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...

@5minds/processcube_engine (>=19.0.0-beta.11, <=20.0.0-renovate-fd1892-me5sbqz0), @angular-devkit/build-angular (>=20.0.0-rc.0, <=22.1.0-next.0) +57 more potentially affected by CVE-2026-55388 via piscina (>=5.0.0, <=5.1.4)

piscina NPM version =5.0.0, =19.0.0-beta.11, =20.0.0-rc.0, =20.0.0-rc.0, =1.0.0, =21.2.2-depup.0, =21.2.2-depup.0, =1.0.0, =5.0.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =0.1.0, =0.1.26, =4.0.0-beta.1, =4.2.1 and more Source cves:...

@angular-architects/build-angular (16.2.0-next.2), @angular-builders/custom-esbuild (>=17.1.0-beta.0, <=19.1.0) +168 more potentially affected by CVE-2026-55388 via piscina (>=4.0.0, <=4.9.2)

piscina NPM version =4.0.0, =17.1.0-beta.0, =16.0.0-beta.0, =18.2.6-RC-1, =16.0.0, =16.2.0-next.0, =18.0.0-next.3, =2.2.7-bb.6, =2.1.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.17-dev.35 and more Source cves: CVE-2026-55388 Source advisory: OSV:GHSA-X9G3-XRWR-CWFG...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +23 more potentially affected by CVE-2026-53863 via openclaw (>=2026.3.22, <=2026.4.24)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 and more Source cves: CVE-2026-53863 Source advisory: OSV:GHSA-985F-72MJ-8GF7...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53842 via openclaw (>=2026.3.22, <=2026.4.29)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53842 Source advisory: OSV:GHSA-FQ9J-VW4W-FR6V...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53842 via openclaw (>=2026.3.22, <=2026.4.29)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53842 Source advisory: SNYK:JS-OPENCLAW-17394006...

NPM: OpenClaw: Shell inline-command parsing could miss an allowlist check

NPM: OpenClaw: Shell inline-command parsing could miss an allowlist check vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.10-beta.1...

@0xwork/connect (>=0.1.0, <=0.1.8), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53843 via openclaw (>=2026.3.22, <=2026.5.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53843 Source advisory: OSV:GHSA-Q99W-VH6V-Q3V7...