@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53835 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53835 Source advisory: SNYK:JS-OPENCLAW-17394051...

org.webjars.npm:github-com-daichirata-vue-sanitize (0.2.2), org.webjars.npm:github-com-daichirata-vue-sanitize- (0.2.2) potentially affected by CVE-2026-53606 via org.webjars.npm:sanitize-html (2.7.0)

org.webjars.npm:sanitize-html MAVEN version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:sanitize-html and may be impacted: - org.webjars.npm:github-com-daichirata-vue-sanitize 0.2.2 -...

magique-ai (>=0.1.0, <=0.4.3), pantheon-agents (>=0.3.0, <=0.3.3) +2 more potentially affected by unknown CVE via magique (0.6.7)

magique PYPI version 0.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on magique and may be impacted: - magique-ai =0.1.0, =0.3.0, =0.1.1, =0.5.0, =0.5.4 Source cves: unknown CVE Source advisory: SNYK:PYTHON-MAGIQUE-17220140...

assistant_daemon (0.1.0), async-ssh2-tokio (>=0.2.0, <=0.8.11) +7 more potentially affected by CVE-2026-46702 via russh (>=0.34.0, <=0.43.0)

russh CARGO version =0.34.0, =0.2.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.1 - sshrpc 0.1.0 - tunnels 0.1.0 Source cves: CVE-2026-46702 Source advisory: OSV:GHSA-WWX6-X28X-8259...

@clerk/chrome-extension (>=1.3.5-canary.v097a1ce, <=2.0.9), @clerk/clerk-expo (>=2.2.11-canary.v097a1ce, <=2.4.5) +12 more potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=5.22.0, <=5.120.0)

@clerk/clerk-js NPM version =5.22.0, =1.3.5-canary.v097a1ce, =2.2.11-canary.v097a1ce, =0.1.0, =0.24.2-dev-clerk, =0.24.2-dev-clerk, =0.24.3-dev-ensure-cloud-token-6, =0.0.5, =0.4.2, =0.19.1-dev-clerk, =0.19.0-dev-clerk, =0.19.0-dev-clerk, =0.8.0, =0.24.2-dev-clerk, =0.19.1-dev-clerk, =0.19.8-dev...

gpt-researcher-mcp (>=0.1.0, <=0.1.5), iflow-mcp-joshualelon-deep-research-mcp (0.1.0) +1 more potentially affected by CVE-2026-5630 via gpt-researcher (>=0.14.4, <=0.16.0)

gpt-researcher PYPI version =0.14.4, =0.1.0, =2.1.6, =2.1.8 Source cves: CVE-2026-5630 Source advisory: SNYK:PYTHON-GPTRESEARCHER-15917486...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41385 via openclaw (>=2026.3.22, <=2026.3.28)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41385 Source advisory: OSV:GHSA-JJW7-3VJF-FG5J...

@hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.16-exui-4425-rel1) potentially affected by CVE-2026-27738 +1 more via @angular/ssr (20.3.18)

@angular/ssr NPM version 20.3.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - @hmcts/media-viewer =4.2.16-exui-4425, =4.2.16-exui-4425-rel1 Source cves: CVE-2026-27738, CVE-2026-33397 Source advisory:...

@n8n/backend-test-utils (>=1.0.0-rc.0, <=1.4.3), @n8n/db (>=1.0.0-rc.0, <=1.4.3) +4 more potentially affected by CVE-2026-25052 via n8n-core (>=2.0.0, <=2.4.3)

n8n-core NPM version =2.0.0, =1.0.0-rc.0, =1.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =0.1.0, =0.11.0 Source cves: CVE-2026-25052 Source advisory: SNYK:JS-N8NCORE-15223381...

@daffaadev/baileys (1.0.1), @daffaadev/baileyss (1.0.0) potentially affected by unknown CVE via @daffadeveloper/signal-node (0.0.1-security)

@daffadeveloper/signal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @daffadeveloper/signal-node and may be impacted: - @daffaadev/baileys 1.0.1 - @daffaadev/baileyss 1.0.0 Source cves: unknown CVE Source advisory:...

alemat (>=0.3.0, <=0.8.0), box-bin (0.3.1) +19 more potentially affected by unknown CVE via unic-ucd-block (>=0.8.0, <=0.9.0)

unic-ucd-block CARGO version =0.8.0, =0.3.0, =0.3.0, =0.0.0, =0.0.102, =0.0.7, =0.0.1, =1.0.0, =1.11.3, =0.0.0, =0.1.0, =1.1.1, =2.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0099...

failing-line (0.0.1), mp3s (0.0.0) +3 more potentially affected by unknown CVE via findall (0.0.4)

findall NPM version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on findall and may be impacted: - failing-line 0.0.1 - mp3s 0.0.0 - ourtunes =0.0.0, =0.0.2, =0.0.3, =2.1.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-20572...

03_node_1 (1.0.0), 111nodejs03 (1.0.0) +98 more potentially affected by unknown CVE via math (>=0.0.3, <=1.0.0-canary-37519dcd-20260903)

math NPM version =0.0.3, =0.0.1-rc.21, =0.0.1-rc.41-v2, =1.0.1, =1.0.0, =2.0.11, =0.8.0, =0.2.1, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.1.0 - aloysqrtminmax 1.1.0 and more Source cves: unknown CVE Source advisory: OSV:MAL-2025-26006...

@gambalabs/sentry-nuxt (>=8.31.1, <=8.32.0), @globalbrain/sefirot (3.40.0) +31 more potentially affected by unknown CVE via @sentry/browser (>=8.0.0, <=8.32.0)

@sentry/browser NPM version =8.0.0, =8.31.1, =7.0.0, =8.9.0, =1.0.386-leo-ron-885-experimental.13, =0.0.1, =0.1.0, =8.0.0-alpha.2, =8.0.0-alpha.2, =8.0.0-alpha.2, =1.0.0-beta.1, =5.0.0-beta.0, =8.0.0-alpha.2, =8.0.0-alpha.2, =8.32.0 and more Source cves: unknown CVE Source advisory:...

@boltboris/react-nodegui (0.14.0), @educandu/rooms-auth-lambda (>=1.0.0, <=1.0.1) +10 more potentially affected by unknown CVE via phin (>=3.2.4, <=3.7.0)

phin NPM version =3.2.4, =1.0.0, =2.0.0-alpha.1, =1.0.0, =0.13.0, =0.0.0, =0.0.1 - pusher-status 1.1.3 - weather-private 1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-X565-32QP-M3VF...

can2040 (>=0.1.2, <=0.1.5), card10-alloc (>=0.1.0, <=0.1.1) +13 more potentially affected by unknown CVE via alloc-cortex-m (>=0.2.2, <=0.4.4)

alloc-cortex-m CARGO version =0.2.2, =0.1.2, =0.1.0, =0.1.0, =0.0.4, =0.3.2, =0.1.0, =0.1.0, =0.5.6, =0.1.0, =0.1.1, =0.0.2, =0.0.11 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0073...

@wmfs/tymly-fastify-plugin (>=1.50.0, <=1.51.0), egg-bag (>=1.44.43, <=1.45.11) potentially affected by CVE-2021-22964 via fastify-static (>=4.2.4, <=4.4.0)

fastify-static NPM version =4.2.4, =1.50.0, =1.44.43, =1.45.11 Source cves: CVE-2021-22964 Source advisory: OSV:GHSA-PGH6-M65R-2RHQ...

system_uri (>=0.2.0, <=0.4.0) potentially affected by unknown CVE via ffi_utils (>=0.2.0, <=0.4.0)

ffiutils CARGO version =0.2.0, =0.2.0, =0.4.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0064...

3nit-components (>=0.0.2, <=0.0.4), 3nit-utils (>=0.3.0, <=0.23.0) +1572 more potentially affected by unknown CVE via subtext (>=1.1.1, <=6.0.12)

subtext NPM version =1.1.1, =0.0.2, =0.3.0, =1.0.0, =1.16.0, =1.16.0, =1.16.0, =1.0.0, =0.0.1, =0.1.0, =0.9.0, =1.0.7, =0.0.1, =1.0.8-rc.1, =11.1.27-alpha.4606607431 and more Source cves: unknown CVE Source advisory: OSV:GHSA-2MVQ-XP48-4C77...

@adpt/cli (>=0.4.0-next.27, <=0.4.0-next.28), @alasdair/check-engines (1.0.0) +142 more potentially affected by unknown CVE via npm-registry-fetch (>=5.0.0, <=8.1.0)

npm-registry-fetch NPM version =5.0.0, =0.4.0-next.27, =0.1.0, =0.21.0, =1.0.0, =1.0.0, =0.1.0, =0.2.0, =0.14.0, =4.0.13, =3.1.10, =2.3.0, =3.1.10, =3.1.10, =3.1.11 and more Source cves: unknown CVE Source advisory: OSV:GHSA-JMQM-F2GX-4FJV...

anjiayi-elf (>=1.0.0, <=1.0.9), anjiayi-exp (>=1.0.0, <=1.2.6) +5 more potentially affected by unknown CVE via lutils-merge (>=0.1.4, <=0.2.6)

lutils-merge NPM version =0.1.4, =1.0.0, =1.0.0, =1.0.0, =0.0.1-alpha, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-F7QW-5PVG-MMWP...

taky-cache-loop (0.0.1), taky-redis-throttle (0.0.1) potentially affected by unknown CVE via every-time (0.0.0)

every-time NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on every-time and may be impacted: - taky-cache-loop 0.0.1 - taky-redis-throttle 0.0.1 Source cves: unknown CVE Source advisory: GHSA-W785-48P4-H5JJ...

express-helmet (1.0.1), gloglet (2.3.4) +1 more potentially affected by unknown CVE via gloggo (1.1.4)

gloggo NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on gloggo and may be impacted: - express-helmet 1.0.1 - gloglet 2.3.4 - helmify 1.2.1 Source cves: unknown CVE Source advisory: SNYK:JS-GLOGGO-19653625...

@27works/posto (>=1.0.0, <=2.0.2), @3ngram/server (>=0.7.0, <=1.6.1) +357 more potentially affected by unknown CVE via nodemailer (>=9.0.0, <=9.0.6)

nodemailer NPM version =9.0.0, =1.0.0, =0.7.0, =2.0.2, =2026.7.1, =5.52.1-fa.2, =5.52.1-fa.2, =0.0.1, =0.0.10, =1.0.0, =2.0.1 - @aopslabs/xf-mail 0.2.0 - @app4you/n8n-nodes-portal-invoices 0.3.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WMMP-3585-3RMP...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0x1 (>=0.0.0, <=0.0.379) +22866 more potentially affected by unknown CVE via sharp (>=0.4.2, <=0.35.3)

sharp NPM version =0.4.2, =0.1.0, =0.0.0, =0.0.1, =0.0.2, =4.2.0-next.2, =0.0.1, =1.0.0-alpha.1, =1.0.0, =1.0.9, =1.0.0, =0.0.1, =1.225.0, =0.4.0, =0.38.37 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RGJ7-G3M4-5G8C...

02.aula (1.0.0), 0xrtest (1.0.0) +11423 more potentially affected by CVE-2026-84375 via js-yaml (>=4.0.0, <=4.3.1)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =1.3.0, =6.1.5, =0.0.0-develop-20260120180031, =0.5.6 - @0xr404/0xrtest 1.0.0 and more Source cves: CVE-2026-84375 Source advisory: OSV:GHSA-2883-XCG3-V3HH...

@3ngram/server (>=1.2.6, <=1.6.1), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +889 more potentially affected by CVE-2026-84365 via hono (>=4.0.0, <=4.13.4)

hono NPM version =4.0.0, =1.2.6, =0.1.8-fix.3, =0.0.2, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-84365 Source advisory: OSV:GHSA-GQVV-2MRQ-WPJV...

@3ngram/server (>=1.2.6, <=1.6.1), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +889 more potentially affected by CVE-2026-84364 via hono (>=4.0.0, <=4.13.4)

hono NPM version =4.0.0, =1.2.6, =0.1.8-fix.3, =0.0.2, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-84364 Source advisory: OSV:GHSA-G6GW-C38X-MQFC...

@3ngram/server (>=1.2.6, <=1.6.1), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +889 more potentially affected by CVE-2026-84363 via hono (>=4.0.0, <=4.13.4)

hono NPM version =4.0.0, =1.2.6, =0.1.8-fix.3, =0.0.2, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-84363 Source advisory: OSV:GHSA-CRVJ-82CR-HJCX...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +246 more potentially affected by CVE-2026-84369 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84369 Source advisory: OSV:GHSA-4VPR-X523-8J87...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4328 more potentially affected by CVE-2026-83608 +1 more via @xmldom/xmldom (>=0.7.0, <=0.8.14)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.12.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-83608, CVE-2026-83613 Source advisory: OSV:GHSA-27P8-2357-5QQV...

08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +11363 more potentially affected by CVE-2026-83611 via xmldom (>=0.1.2, <=0.5.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.23, =1.0.0, =0.0.3, =0.0.9 and more Source cves: CVE-2026-83611 Source advisory: OSV:GHSA-6H8R-XR42-GP59...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4328 more potentially affected by CVE-2026-83611 via @xmldom/xmldom (>=0.7.0, <=0.8.14)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.12.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-83611 Source advisory: OSV:GHSA-6H8R-XR42-GP59...

@adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35), @adobe/spacecat-shared-cloud-manager-client (>=1.0.0, <=1.4.3) +307 more potentially affected by CVE-2026-84368 via joi (>=18.0.0, <=18.2.3)

joi NPM version =18.0.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =0.0.14, =0.0.39 and more Source cves: CVE-2026-84368 Source advisory: OSV:GHSA-6W3J-5FW6-R9VR...

20yearrewards (>=1.0.7, <=1.0.8), 3id-test-helper (>=1.0.0, <=1.0.4) +2601 more potentially affected by CVE-2026-84368 via @hapi/joi (>=16.0.0, <=17.1.1)

@hapi/joi NPM version =16.0.0, =1.0.7, =1.0.0, =0.24.0, =2.0.2, =6.8.2, =1.4.0, =3.1.0, =3.2.0, =1.8.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =3.0.0-beta.1, =4.0.0-beta.2 and more Source cves: CVE-2026-84368 Source advisory: OSV:GHSA-6W3J-5FW6-R9VR...

@capawesome/capacitor-maplibre (>=0.0.0, <=0.1.1), @open-pencil-lowcode/cli (0.15.0) +5 more potentially affected by CVE-2026-85061 via maplibre-gl (>=6.0.0, <=6.4.0)

maplibre-gl NPM version =6.0.0, =0.0.0, =13.25.1, =1.3.5, =0.1.2, =0.17.0, =0.21.0 Source cves: CVE-2026-85061 Source advisory: OSV:GHSA-JRC7-96C5-Q579...

08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +11363 more potentially affected by CVE-2026-83607 via xmldom (>=0.1.2, <=0.5.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.23, =1.0.0, =0.0.3, =0.0.9 and more Source cves: CVE-2026-83607 Source advisory: OSV:GHSA-W2RR-34G9-RVRJ...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4320 more potentially affected by CVE-2026-83607 via @xmldom/xmldom (>=0.7.0, <=0.8.13)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.12.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-83607 Source advisory: OSV:GHSA-W2RR-34G9-RVRJ...

pranx (>=0.1.0-beta.10, <=0.1.0-beta.11) potentially affected by CVE-2026-72925 via @swc/html (1.13.5)

@swc/html NPM version 1.13.5 is affected by a known vulnerability. The following packages have a transitive dependency on @swc/html and may be impacted: - pranx =0.1.0-beta.10, =0.1.0-beta.11 Source cves: CVE-2026-72925 Source advisory: OSV:GHSA-5QR2-V392-M9G8...

ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess (>=0.1.0, <=0.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-quarkus-adhoc-subprocess-storage-jpa (>=0.1.0, <=0.2.0) +3024 more potentially affected by CVE-2026-86321 via com.github.java-json-tools:jackson-coreutils (>=1.9, <=2.0)

com.github.java-json-tools:jackson-coreutils MAVEN version =1.9, =0.1.0, =0.1.0, =0.4.0, =1.0.6, =1.0.28, =1.0.6, =1.0.0, =1.3.3, =0.8.38, =0.0.6, =0.0.6, =0.1.1, =0.1.0, =1.1.0, =1.2.3 and more Source cves: CVE-2026-86321 Source advisory: SNYK:JAVA-COMGITHUBJAVAJSONTOOLS-19644208...

3xhaustpi (>=0.1.3, <=0.2.5), @0x0.bug/pi-coding-agent (>=1.0.0, <=1.0.9) +1677 more potentially affected by CVE-2026-85008 via undici (>=8.0.0, <=8.10.1)

undici NPM version =8.0.0, =0.1.3, =1.0.0, =0.1.0, =0.3.5, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =5.0.1-staging.daf8e165bc4a -...

3xhaustpi (>=0.1.3, <=0.2.5), @0x0.bug/pi-coding-agent (>=1.0.0, <=1.0.9) +1677 more potentially affected by CVE-2026-84961 via undici (>=8.0.0, <=8.10.1)

undici NPM version =8.0.0, =0.1.3, =1.0.0, =0.1.0, =0.3.5, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =5.0.1-staging.daf8e165bc4a -...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +2293 more potentially affected by CVE-2026-84947 via undici (>=7.1.0, <=7.29.0)

undici NPM version =7.1.0, =0.1.1, =0.0.1-251008.90016, =0.4.0, =1.0.0, =0.6.0, =0.1.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.260505.5, =0.260605.2 and more Source cves: CVE-2026-84947 Source advisory: SNYK:JS-UNDICI-19635214...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-84947 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2216 more potentially affected by CVE-2026-18540 via undici (>=6.0.0, <=6.28.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =2.7.0, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.3.3, =4.5.7 - @adminjs/firebase-auth 1.0.0 and more Source cves: CVE-2026-18540 Source advisory: SNYK:JS-UNDICI-19635212...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +2296 more potentially affected by CVE-2026-18540 via undici (>=7.0.0, <=7.29.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.4.0, =1.0.0, =0.6.0, =0.1.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.260505.5, =0.260605.2 and more Source cves: CVE-2026-18540 Source advisory: SNYK:JS-UNDICI-19635212...

3xhaustpi (>=0.1.3, <=0.2.5), @0x0.bug/pi-coding-agent (>=1.0.0, <=1.0.9) +1677 more potentially affected by CVE-2026-18540 via undici (>=8.0.0, <=8.10.1)

undici NPM version =8.0.0, =0.1.3, =1.0.0, =0.1.0, =0.3.5, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =5.0.1-staging.daf8e165bc4a -...

3xhaustpi (>=0.1.3, <=0.2.5), @0x0.bug/pi-coding-agent (>=1.0.0, <=1.0.9) +1677 more potentially affected by CVE-2026-19534 via undici (>=8.0.0, <=8.10.1)

undici NPM version =8.0.0, =0.1.3, =1.0.0, =0.1.0, =0.3.5, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =5.0.1-staging.daf8e165bc4a -...

org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-84890 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)

org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...

@rcodex-lab/gateway (>=1.4.35, <=1.4.37), acryl (>=0.1.13, <=0.1.17) +1 more potentially affected by CVE-2026-84394 via fast-uri (3.1.6)

fast-uri NPM version 3.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on fast-uri and may be impacted: - @rcodex-lab/gateway =1.4.35, =0.1.13, =4.7.12, =4.7.13 Source cves: CVE-2026-84394 Source advisory: SNYK:JS-FASTURI-19502854...