@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +29 more potentially affected by CVE-2026-62203 via openclaw (>=2026.3.22, <=2026.6.5)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62203 Source advisory: SNYK:JS-OPENCLAW-18021340...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +29 more potentially affected by CVE-2026-62201 via openclaw (>=2026.3.22, <=2026.6.5)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62201 Source advisory: SNYK:JS-OPENCLAW-18021339...

@0xwork/connect (>=0.1.0, <=0.1.7), @chrysb/alphaclaw (>=0.8.3, <=0.9.16) +16 more potentially affected by CVE-2026-62226 via openclaw (>=2026.3.28, <=2026.5.7)

openclaw NPM version =2026.3.28, =0.1.0, =0.8.3, =0.1.0, =2.2.4, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =0.1.0, =0.2.10-beta.0, =0.1.38, =0.0.1, =0.3.0 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-62226 Source advisory: SNYK:JS-OPENCLAW-18017827...

@0xwork/connect (>=0.1.0, <=0.1.8), @chrysb/alphaclaw (>=0.9.10, <=0.9.16) +6 more potentially affected by CVE-2026-62227 via openclaw (>=2026.4.21, <=2026.5.24-beta.2)

openclaw NPM version =2026.4.21, =0.1.0, =0.9.10, =2.2.4, =4.0.0, =0.0.0, =2.1.8, =0.1.38, =0.0.1, =0.3.0 Source cves: CVE-2026-62227 Source advisory: SNYK:JS-OPENCLAW-18017823...

@whalent/agent (0.3.273) potentially affected by unknown CVE via @whalent/agent-core (0.3.273)

@whalent/agent-core NPM version 0.3.273 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.273 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.238) potentially affected by unknown CVE via @whalent/agent-core (0.3.238)

@whalent/agent-core NPM version 0.3.238 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.238 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.232) potentially affected by unknown CVE via @whalent/agent-core (0.3.232)

@whalent/agent-core NPM version 0.3.232 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.232 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.243) potentially affected by unknown CVE via @whalent/agent-core (0.3.243)

@whalent/agent-core NPM version 0.3.243 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.243 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.282) potentially affected by unknown CVE via @whalent/agent-core (0.3.282)

@whalent/agent-core NPM version 0.3.282 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.282 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.234) potentially affected by unknown CVE via @whalent/agent-core (0.3.234)

@whalent/agent-core NPM version 0.3.234 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.234 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.276) potentially affected by unknown CVE via @whalent/agent-core (0.3.276)

@whalent/agent-core NPM version 0.3.276 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.276 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.253) potentially affected by unknown CVE via @whalent/agent-core (0.3.253)

@whalent/agent-core NPM version 0.3.253 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.253 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3506 more potentially affected by CVE-2026-54490 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54490 Source advisory: SNYK:JS-WEBSOCKETDRIVER-17987674...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 3d-crystal-model (0.1.0) +3506 more potentially affected by CVE-2026-54466 via websocket-driver (>=0.3.5, <=0.7.4)

websocket-driver NPM version =0.3.5, =1.0.1, =0.1.2, =1.0.8, =0.1.0, =0.1.21, =1.0.0, =1.0.5, =0.2.0, =3.4.1, =0.1.1, =0.1.272 - @themis/usescheme 1.1.4 - @ab-task/react-tool-belt 0.1.1 and more Source cves: CVE-2026-54466 Source advisory: SNYK:JS-WEBSOCKETDRIVER-17987994...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +30 more potentially affected by CVE-2026-62192 via openclaw (>=2026.3.22, <=2026.6.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62192 Source advisory: SNYK:JS-OPENCLAW-17970202...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +30 more potentially affected by CVE-2026-62187 via openclaw (>=2026.3.22, <=2026.6.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =1.1.50, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =2026.4.3-2 and more Source cves: CVE-2026-62187 Source advisory: SNYK:JS-OPENCLAW-17970563...

@openclaw/kitchen-sink (0.2.9), @shadowob/openclaw-shadowob (>=1.1.50, <=1.1.64) +1 more potentially affected by CVE-2026-62193 via openclaw (>=2026.6.5, <=2026.6.6)

openclaw NPM version =2026.6.5, =1.1.50, =0.0.1-release20260506, =0.0.232-next Source cves: CVE-2026-62193 Source advisory: SNYK:JS-OPENCLAW-17970567...

1password-node (>=3.0.0-rc.0, <=3.0.0), 2020-react (>=1.2.2, <=1.2.6) +9782 more potentially affected by CVE-2026-39244 via adm-zip (>=0.1.4, <=0.5.17)

adm-zip NPM version =0.1.4, =3.0.0-rc.0, =1.2.2, =1.0.0, =1.0.0, =3.4.0, =1.17.6-next.0, =0.0.89, =1.0.9, =0.0.1, =0.0.1, =0.1.2-alpha.0, =0.2.0, =0.1.0, =1.0.1, =1.0.2 and more Source cves: CVE-2026-39244 Source advisory: SNYK:JS-ADMZIP-17954277...

org.webjars.npm:karma-phantomjs2-launcher (0.3.2), org.webjars.npm:phantomjs (>=1.9.17, <=1.9.18) +4 more potentially affected by CVE-2026-39244 via org.webjars.npm:adm-zip (>=0.4.4, <=0.5.9)

org.webjars.npm:adm-zip MAVEN version =0.4.4, =1.9.17, =2.52.0, =2.53.3 Source cves: CVE-2026-39244 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17954278...

flaskbb-plugin-atom (>=0.1.0, <=0.2.0), flaskbb-plugin-conversations (>=2.0.1, <=2.0.2) +6 more potentially affected by CVE-2026-22659 via flaskbb (2.2.0)

flaskbb PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flaskbb and may be impacted: - flaskbb-plugin-atom =0.1.0, =2.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0 Source cves: CVE-2026-22659 Source advisory: SNYK:PYTHON-FLASKBB-17950950...

flaskbb-plugin-atom (>=0.1.0, <=0.2.0), flaskbb-plugin-conversations (>=2.0.1, <=2.0.2) +6 more potentially affected by CVE-2026-22660 via flaskbb (2.2.0)

flaskbb PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on flaskbb and may be impacted: - flaskbb-plugin-atom =0.1.0, =2.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0 Source cves: CVE-2026-22660 Source advisory: SNYK:PYTHON-FLASKBB-17950951...

@mockoon/cli (>=9.0.0, <=9.6.1), @mockoon/cloud (>=9.0.0, <=9.6.1) +4 more potentially affected by CVE-2026-59148 via @mockoon/commons (>=9.0.0, <=9.6.1)

@mockoon/commons NPM version =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =0.0.1, =0.30.0, =0.40.0 Source cves: CVE-2026-59148 Source advisory: SNYK:JS-MOCKOONCOMMONS-17957233...

@appium/base-plugin (>=3.2.0, <=3.3.0), @appium/fake-plugin (>=4.2.0, <=4.3.0) +9 more potentially affected by CVE-2026-58191 via @appium/base-driver (>=10.3.0, <=10.6.0)

@appium/base-driver NPM version =10.3.0, =3.2.0, =4.2.0, =1.0.0, =3.0.10, =2.107.37, =2.107.37, =3.3.0, =0.1.0-beta.1, =0.79.0, =1.0.96, =1.0.115 Source cves: CVE-2026-58191 Source advisory: SNYK:JS-APPIUMBASEDRIVER-17900619...

@injectivelabs/wallet-base (1.20.21), @injectivelabs/wallet-core (1.20.21) +9 more potentially affected by unknown CVE via @injectivelabs/sdk-ts (1.20.21)

@injectivelabs/sdk-ts NPM version 1.20.21 is affected by a known vulnerability. The following packages have a transitive dependency on @injectivelabs/sdk-ts and may be impacted: - @injectivelabs/wallet-base 1.20.21 - @injectivelabs/wallet-core 1.20.21 - @injectivelabs/wallet-cosmos 1.20.21 -...

@3kles/3kles-socketio (>=2.1.5, <=2.4.1), @5minds/processcube_engine (>=16.0.0-alpha.2, <=18.0.0-renovate-fc9b99-lz9hhvt1) +261 more potentially affected by CVE-2026-59724 via engine.io (>=6.5.1, <=6.6.6)

engine.io NPM version =6.5.1, =2.1.5, =16.0.0-alpha.2, =2.17.13, =1.16.10, =3.0.4, =2.0.28, =1.1.5-13, =0.1.0, =0.1.0, =0.1.0, =1.2.0, =12.0.1, =17.0.0 and more Source cves: CVE-2026-59724 Source advisory: SNYK:JS-ENGINEIO-17900560...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +915 more potentially affected by CVE-2026-59873 via tar (>=7.0.0, <=7.5.18)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59873 Source advisory: SNYK:JS-TAR-17909152...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +719 more potentially affected by CVE-2026-59895 via hono (>=4.0.0, <=4.12.26)

hono NPM version =4.0.0, =0.1.0-dev.2580522, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.29.19 and more Source cves: CVE-2026-59895 Source advisory: SNYK:JS-HONO-17900056...

ratex-layout (0.0.3) potentially affected by CVE-2026-53531 via ratex-parser (0.0.3)

ratex-parser CARGO version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ratex-parser and may be impacted: - ratex-layout 0.0.3 Source cves: CVE-2026-53531 Source advisory: OSV:GHSA-4W5H-HX6R-28Q7...

@inkeep/agents-api (>=0.0.0-dev-20260121145510, <=0.80.6), @inkeep/agents-cli (>=0.0.0-chat-to-edit-20251119071712, <=0.80.6) +17 more potentially affected by CVE-2026-53513 via @better-auth/sso (>=1.3.28, <=1.6.9)

@better-auth/sso NPM version =1.3.28, =0.0.0-dev-20260121145510, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260106221934, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-chat-to-edit-20251119071712, =0.0.0-dev-20260203033642...

@inkeep/agents-api (>=0.73.0, <=0.80.6), @inkeep/agents-cli (>=0.73.0, <=0.80.6) +5 more potentially affected by CVE-2026-53517 via @better-auth/oauth-provider (1.6.9)

@better-auth/oauth-provider NPM version 1.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on @better-auth/oauth-provider and may be impacted: - @inkeep/agents-api =0.73.0, =0.73.0, =0.73.1, =0.73.0, =0.73.1, =0.73.1, =0.73.1, =0.80.6 Source cves:...

@agent-native/core (>=0.26.5, <=0.47.1), @automate.ax/components-core (>=0.1.3, <=0.3.1) +34 more potentially affected by CVE-2026-53517 via @better-auth/memory-adapter (>=1.6.0, <=1.6.10)

@better-auth/memory-adapter NPM version =1.6.0, =0.26.5, =0.1.3, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.11.3, =1.6.0-depup.0, =0.73.0, =0.73.0, =0.80.6 and more Source cves: CVE-2026-53517 Source advisory: SNYK:JS-BETTERAUTHMEMORYADAPTER-17889814...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +200 more potentially affected by CVE-2026-67336 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-67336 Source advisory: OSV:GHSA-9H47-PQCX-HJR4...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +200 more potentially affected by CVE-2026-53512 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53512 Source advisory: OSV:GHSA-PW9M-5JXM-XR6H...

whs4_ays (>=1.0.0, <=1.0.1) potentially affected by unknown CVE via whs4_npm (0.0.1-security)

whs4npm NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on whs4npm and may be impacted: - whs4ays =1.0.0, =1.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-WHS4NPM-17881408...

@abtnode/analytics (>=1.16.13-beta-0086a35d, <=1.17.13-beta-20260613-094425-b81920c8), @abtnode/auth (>=1.3.13, <=1.17.13-beta-20260613-094425-b81920c8) +212 more potentially affected by CVE-2026-56812 via phoenix (>=1.7.2, <=1.7.21)

phoenix NPM version =1.7.2, =1.16.13-beta-0086a35d, =1.3.13, =1.1.12, =1.6.23, =1.16.6-beta-08670107, =1.0.0, =1.16.33-beta-20241105-141729-e4608175, =1.0.0, =1.0.35, =1.16.33-beta-20241105-141729-e4608175, =1.0.2, =1.16.33-beta-20241105-141729-e4608175, =1.16.33-beta-20241105-141729-e4608175,...

20mk-utils (>=1.0.0, <=1.0.3), 2d-spirograph (>=1.0.2, <=1.0.4) +2122 more potentially affected by CVE-2026-59711 via showdown (>=0.0.1, <=2.1.0)

showdown NPM version =0.0.1, =1.0.0, =1.0.2, =2.0.4, =1.0.6, =0.1.4, =0.1.4, =0.1.4, =13.351.0, =13.351.0, =7.10.0, =7.10.0, =0.0.3, =0.5.1 - @adalink/spark-chat 1.0.0 and more Source cves: CVE-2026-59711 Source advisory: SNYK:JS-SHOWDOWN-17874448...

bdy (>=1.18.27-dev, <=1.22.61-stage) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (11.1.1)

@xhmikosr/decompress NPM version 11.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.18.27-dev, =1.22.61-stage Source cves: CVE-2026-53486 Source advisory: SNYK:JS-XHMIKOSRDECOMPRESS-17874438...

bdy (>=1.7.46-dev, <=1.18.26-stage), buddy-tunnel (>=1.3.19-dev, <=1.7.45-dev) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (10.0.1)

@xhmikosr/decompress NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.7.46-dev, =1.3.19-dev, =1.7.45-dev Source cves: CVE-2026-53486 Source advisory: SNYK:JS-XHMIKOSRDECOMPRESS-178744...

coreutils (>=0.0.14, <=0.0.16) potentially affected by CVE-2026-35371 via uu_id (>=0.0.14, <=0.0.16)

uuid CARGO version =0.0.14, =0.0.14, =0.0.16 Source cves: CVE-2026-35371 Source advisory: OSV:GHSA-XV5W-CW7X-72GJ...

@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @eclipse-che/theia-terminal (>=0.0.1-1585667205, <=0.0.1-1601469637) +36 more potentially affected by CVE-2026-10054 via @theia/terminal (>=1.1.0-next.a62a6b92, <=1.72.3)

@theia/terminal NPM version =1.1.0-next.a62a6b92, =1.11.0, =0.0.1-1585667205, =0.7.1, =1.58.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.59.0-next.62, =1.46.0-next.241, =1.46.0-next.241, =1.17.2, =1.27.0 and more Source cves: CVE-2026-10054 Source advisory: SNYK:JS-THEIATERMINAL-17810711...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +169 more potentially affected by CVE-2026-10055 via @theia/core (>=1.0.0, <=1.72.3)

@theia/core NPM version =1.0.0, =1.13.0, =1.11.0, =0.1.7, =0.0.1-1646139429, =0.0.1-1585667205, =1.0.0-theia1.27.0, =0.8.0-next.6917503, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.2.0-next.25250370, =0.2.0-next.ffc3e7a2 and more Source cves: CVE-2026-10055 Source advisory:...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @autexis/node-red-context-redis (>=1.0.0-rc1, <=1.0.1) +162 more potentially affected by CVE-2026-52746 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =1.0.0-rc1, =5.0.0, =0.0.1, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =0.3.0, =0.1.0, =1.0.0, =2.33.3-6623e55-202608121503.0, =2.7.1-7dd573e-202408290941.0, =2.32.1-fc1b7da-202607021428.0 and more Source cves: CVE-2026-52746 Source advisory: SNYK:JS-JSONATA-1781072...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @autexis/node-red-context-redis (>=1.0.0-rc1, <=1.0.1) +162 more potentially affected by CVE-2026-52746 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =1.0.0-rc1, =5.0.0, =0.0.1, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =0.3.0, =0.1.0, =1.0.0, =2.33.3-6623e55-202608121503.0, =2.7.1-7dd573e-202408290941.0, =2.32.1-fc1b7da-202607021428.0 and more Source cves: CVE-2026-52746 Source advisory: OSV:GHSA-86VW-MFPG-WWV9...

@grackle-ai/cli (>=0.19.0, <=0.132.1), @grackle-ai/server (>=0.19.0, <=0.132.1) potentially affected by unknown CVE via @grackle-ai/mcp (>=0.19.0, <=0.132.1)

@grackle-ai/mcp NPM version =0.19.0, =0.19.0, =0.19.0, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-F9FF-5X35-7GFW...

ctutils (>=0.0.0, <=0.3.2) potentially affected by CVE-2026-50185 via cmov (>=0.4.6, <=0.5.0-pre.0)

cmov CARGO version =0.4.6, =0.0.0, =0.3.2 Source cves: CVE-2026-50185 Source advisory: OSV:GHSA-3RJW-M598-PQ24...

03-gs-ee-6 (0.3.5), @albgen/capacitor-escpos-plugin (>=0.0.4, <=1.0.1) +2934 more potentially affected by CVE-2026-13149 via brace-expansion (>=3.0.0, <=5.0.6)

brace-expansion NPM version =3.0.0, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 - @angranit/phantompirs 0.1.0 -...

a-gpt (>=0.1.0, <=0.4.0), a11ywatch_cli (>=0.8.16, <=0.10.15) +2699 more potentially affected by unknown CVE via quick-xml (>=0.1.9, <=0.40.1)

quick-xml CARGO version =0.1.9, =0.1.0, =0.8.16, =0.3.1, =0.44.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0194...

10.30.npm-learning (>=1.0.0, <=1.1.0), 2017_node (1.0.0) +3312 more potentially affected by CVE-2026-11998 via angular (>=1.2.0, <=1.8.3)

angular NPM version =1.2.0, =1.0.0, =4.13.7-rc4, =1.103.1, =1.103.1, =1.102.4, =1.102.3, =1.102.3, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.5.0, =0.5.2 and more Source cves: CVE-2026-11998 Source advisory: SNYK:JS-ANGULAR-17458840...

acroform (>=0.1.2, <=0.1.3), airust (0.1.6) +106 more potentially affected by unknown CVE via lopdf (>=0.8.0, <=0.40.0)

lopdf CARGO version =0.8.0, =0.1.2, =0.1.0, =0.1.0, =0.0.1, =0.3.0, =0.1.10, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.7.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0187...

@constructions-incongrues/faircamp-cms-ui (>=0.1.0, <=0.2.1), @lightnet/sveltia-admin (>=4.0.0, <=4.0.13) +1 more potentially affected by unknown CVE via @sveltia/cms (>=0.73.1, <=0.167.1)

@sveltia/cms NPM version =0.73.1, =0.1.0, =4.0.0, =0.1.2, =0.1.5 Source cves: unknown CVE Source advisory: SNYK:JS-SVELTIACMS-17817899...