@falcondev-oss/nuxt-layers-base (>=0.1.0, <=0.25.0), @iqual/nuxt-icms (>=1.6.0-rc.1, <=1.6.0-rc.4) +25 more potentially affected by unknown CVE via @nuxt/ui (>=4.0.0, <=4.8.0)

@nuxt/ui NPM version =4.0.0, =0.1.0, =1.6.0-rc.1, =1.1.6, =0.0.19, =0.5.0, =0.0.7, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.9.0, =0.0.0-test-ld-20260520212549, =0.0.0-test-ld-20260520212549, =0.4.0, =0.4.0, =1.1.0, =1.0.1, =1.1.4 and more Source cves: unknown CVE Source...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @autexis/node-red-context-redis (>=1.0.0-rc1, <=1.0.1) +160 more potentially affected by CVE-2026-52746 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =1.0.0-rc1, =5.0.0, =0.0.1, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =0.3.0, =0.1.0, =1.0.0, =2.7.1-7dd573e-202408290941.0, =0.2.0, =1.26.1 and more Source cves: CVE-2026-52746 Source advisory: SNYK:JS-JSONATA-17810727...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-52746 via jsonata (>=1.0.10, <=1.8.8)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-52746 Source advisory: OSV:GHSA-86VW-MFPG-WWV9...

@grackle-ai/cli (>=0.72.3, <=0.132.1), @grackle-ai/core (>=0.75.4, <=0.132.1) +7 more potentially affected by unknown CVE via @grackle-ai/auth (>=0.72.3, <=0.132.1)

@grackle-ai/auth NPM version =0.72.3, =0.72.3, =0.75.4, =0.72.3, =0.96.3, =0.99.0, =0.97.0, =0.98.0, =0.72.3, =0.75.1, =0.132.1 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIAUTH-17817919...

@grackle-ai/cli (>=0.107.2, <=0.132.1), @grackle-ai/plugin-orchestration (>=0.97.0, <=0.132.1) +1 more potentially affected by unknown CVE via @grackle-ai/plugin-core (>=0.97.0, <=0.132.1)

@grackle-ai/plugin-core NPM version =0.97.0, =0.107.2, =0.97.0, =0.107.2, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-F9FF-5X35-7GFW...

@conform-to/react (>=1.8.0, <=1.19.3), @conform-to/valibot (>=1.8.0, <=1.19.3) +4 more potentially affected by CVE-2026-49250 via @conform-to/dom (>=1.8.0, <=1.19.3)

@conform-to/dom NPM version =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.17.1-depup.0, =1.17.1-depup.0, =1.18.0-depup.0 Source cves: CVE-2026-49250 Source advisory: SNYK:JS-CONFORMTODOM-17812748...

@conform-to/react (>=1.8.0, <=1.19.3), @conform-to/valibot (>=1.8.0, <=1.19.3) +4 more potentially affected by CVE-2026-49250 via @conform-to/dom (>=1.8.0, <=1.19.3)

@conform-to/dom NPM version =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.8.0, =1.17.1-depup.0, =1.17.1-depup.0, =1.18.0-depup.0 Source cves: CVE-2026-49250 Source advisory: OSV:GHSA-525M-7F82-2MF7...

@grackle-ai/cli (>=0.82.2, <=0.132.2), @grackle-ai/powerline (>=0.82.2, <=0.132.2) +6 more potentially affected by unknown CVE via @grackle-ai/runtime-sdk (>=0.82.2, <=0.132.2)

@grackle-ai/runtime-sdk NPM version =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.132.2 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIRUNTIMESDK-17817938...

@grackle-ai/cli (>=0.82.2, <=0.132.1), @grackle-ai/powerline (>=0.82.2, <=0.132.1) +6 more potentially affected by unknown CVE via @grackle-ai/runtime-sdk (>=0.82.2, <=0.132.1)

@grackle-ai/runtime-sdk NPM version =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.82.2, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-VV65-F55V-XM6G...

@grackle-ai/cli (>=0.37.0, <=0.132.2), @grackle-ai/server (>=0.37.0, <=0.132.2) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.132.2)

@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.132.2 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIPOWERLINE-17817937...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53839 via openclaw (>=2026.3.22, <=2026.5.6)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53839 Source advisory: OSV:GHSA-77Q5-RR5V-X43Q...

ctutils (>=0.0.0, <=0.3.2) potentially affected by CVE-2026-50185 via cmov (>=0.4.6, <=0.5.0-pre.0)

cmov CARGO version =0.4.6, =0.0.0, =0.3.2 Source cves: CVE-2026-50185 Source advisory: OSV:GHSA-3RJW-M598-PQ24...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +23 more potentially affected by CVE-2026-53826 via openclaw (>=2026.3.22, <=2026.4.24)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 and more Source cves: CVE-2026-53826 Source advisory: OSV:GHSA-6C4R-G249-WV3C...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53832 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53832 Source advisory: OSV:GHSA-RGGC-M335-3WVJ...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-12388 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-12388 Source advisory: SNYK:JAVA-ORGKEYCLOAK-17817223...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-13149 via brace-expansion (>=1.1.0, <=1.1.13)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-13149 Source advisory: SNYK:JS-BRACEEXPANSION-17706650...

bofhound (>=0.4.9, <=0.4.25), mseep-mcpexample (>=0.1.0, <=0.1.3) +1 more potentially affected by CVE-2026-57952 via mythic (>=0.0.38, <=0.2.10)

mythic PYPI version =0.0.38, =0.4.9, =0.1.0, =1.0.1, =1.3.1 Source cves: CVE-2026-57952 Source advisory: SNYK:PYTHON-MYTHIC-17751535...

03-api-solid (>=1.0.0, <=1.1.2), 0uth (>=1.0.5, <=1.2.1) +2926 more potentially affected by CVE-2026-13676 via fast-uri (>=2.4.4, <=3.1.2)

fast-uri NPM version =2.4.4, =1.0.0, =1.0.5, =1.0.3, =0.5.2-alpha-20231022145212-c0afe8d, =0.1.4-alpha-20231022145212-c0afe8d, =0.1.4-alpha-20231022145212-c0afe8d, =0.6.0, =0.2.0, =0.2.0, =0.0.1-alpha-20240310235646-1ea207b758e2c4cacf2c0f592448d86a94ff5ba4, =0.3.1, =0.3.4 - @adbl/cartridg...

khoj-assistant (>=1.21.0, <=1.21.1) potentially affected by CVE-2026-13508 via khoj (1.42.10)

khoj PYPI version 1.42.10 is affected by a known vulnerability. The following packages have a transitive dependency on khoj and may be impacted: - khoj-assistant =1.21.0, =1.21.1 Source cves: CVE-2026-13508 Source advisory: SNYK:PYTHON-KHOJ-17756762...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-59194 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59194 Source advisory: OSV:GHSA-72R4-9C5J-MJ57...

@pnpm/building.commands (>=1100.0.4, <=1100.1.3), @pnpm/deps.compliance.commands (>=1101.1.1, <=1101.3.3) +8 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-installer (>=1101.0.0, <=1101.8.0)

@pnpm/installing.deps-installer NPM version =1101.0.0, =1100.0.4, =1101.1.1, =1100.1.3, =1101.0.2, =1100.0.4, =1100.0.4, =1100.1.2, =1100.0.4, =1100.2.0, =0.0.2, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSINSTALLER-17660539...

@pnpm/building.commands (>=1100.0.4, <=1100.1.3), @pnpm/deps.compliance.commands (>=1101.1.1, <=1101.3.3) +9 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-restorer (>=1101.0.0, <=1101.1.10)

@pnpm/installing.deps-restorer NPM version =1101.0.0, =1100.0.4, =1101.1.1, =1100.1.3, =1101.0.2, =1100.0.4, =1100.0.4, =1100.1.2, =1101.0.0, =1100.0.4, =1100.2.0, =0.0.2, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSRESTORER-17660541...

@pnpm/building.after-install (>=1100.0.0, <=1101.0.18), @pnpm/building.commands (>=1100.0.0, <=1100.1.1) +11 more potentially affected by CVE-2026-55487 via @pnpm/building.policy (>=1100.0.0, <=1100.0.7)

@pnpm/building.policy NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-55487 Source advisory: SNYK:JS-PNPMBUILDINGPOLICY-17661052...

barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-49293 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-49293 Source advisory: OSV:GHSA-WP3C-266W-4QFQ...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-48995 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-48995 Source advisory: OSV:GHSA-HG3W-7F8C-63HP...

@27works/posto (>=1.0.0, <=2.0.2), @abc45676/mailer (1.0.0) +270 more potentially affected by CVE-2026-48801 via linkify-it (5.0.0)

linkify-it NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on linkify-it and may be impacted: - @27works/posto =1.0.0, =0.6.0, =0.2.6, =0.0.1, =2.0.2, =1.0.0, =0.0.1, =0.0.10, =1.0.0, =2.0.1 - @anjirauto/app-gmail 0.5.2 -...

aide-infra (>=0.2.2a0, <=0.3.9), aide-sdk (>=1.0.0b4, <=1.0.6) +55 more potentially affected by CVE-2026-56445 via pynetdicom (>=1.4.1, <=3.0.4)

pynetdicom PYPI version =1.4.1, =0.2.2a0, =1.0.0b4, =2020.12.2, =0.1.0, =1.3.0, =0.1.0, =0.0.8, =0.0.1, =0.2.3, =0.5.2 and more Source cves: CVE-2026-56445 Source advisory: SNYK:PYTHON-PYNETDICOM-17816663...

a3s-cron (0.1.2), a3s-lane (>=0.2.0, <=0.4.0) +185 more potentially affected by CVE-2026-48504 via opentelemetry_sdk (>=0.18.0, <=0.31.0)

opentelemetrysdk CARGO version =0.18.0, =0.2.0, =0.1.0, =0.0.1, =0.8.1, =0.3.0, =4.0.15, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-48504 Source advisory: OSV:GHSA-W9WP-H8WV-79JX...

@applydigital/claude (>=1.0.0, <=1.2.1), @bsklaroff/yaac (>=0.0.1, <=0.0.5) +11 more potentially affected by CVE-2026-46406 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.117)

@anthropic-ai/claude-code NPM version =2.1.63, =1.0.0, =0.0.1, =0.7.5, =0.6.1-beta.1, =1.83.1, =0.8.1, =0.8.0, =1.0.33, =1.0.0-dev.1, =2.1.99, =1.2.2, =1.2.3 Source cves: CVE-2026-46406 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-17660545...

@applydigital/claude (>=1.0.0, <=1.2.1), @bsklaroff/yaac (>=0.0.1, <=0.0.5) +11 more potentially affected by CVE-2026-46406 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.117)

@anthropic-ai/claude-code NPM version =2.1.63, =1.0.0, =0.0.1, =0.7.5, =0.6.1-beta.1, =1.83.1, =0.8.1, =0.8.0, =1.0.33, =1.0.0-dev.1, =2.1.99, =1.2.2, =1.2.3 Source cves: CVE-2026-46406 Source advisory: OSV:GHSA-4VP2-6Q8C-PVQ2...

@antfu/nip (0.1.1), @condu-feature/auto-package-exports (>=1.0.0, <=1.0.3) +101 more potentially affected by CVE-2026-55697 via @pnpm/config (>=1004.0.0, <=1004.11.2)

@pnpm/config NPM version =1004.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.2, =26.2.0, =1.0.6, =0.6.19, =0.1.0-beta.0, =0.2.10 - @mirta/rollup 0.3.5 and more Source cves: CVE-2026-55697 Source advisory: SNYK:JS-PNPMCONFIG-17875561...

10.30.npm-learning (>=1.0.0, <=1.1.0), 2017_node (1.0.0) +3310 more potentially affected by CVE-2026-11998 via angular (>=1.2.0, <=1.8.3)

angular NPM version =1.2.0, =1.0.0, =4.13.7-rc4, =1.103.1, =1.103.1, =1.102.4, =1.102.3, =1.102.3, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.5.0, =0.5.2 and more Source cves: CVE-2026-11998 Source advisory: SNYK:JS-ANGULAR-17458840...

10.30.npm-learning (>=1.0.0, <=1.1.0), 2017_node (1.0.0) +3310 more potentially affected by CVE-2026-11998 via angular (>=1.2.0, <=1.8.3)

angular NPM version =1.2.0, =1.0.0, =4.13.7-rc4, =1.103.1, =1.103.1, =1.102.4, =1.102.3, =1.102.3, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.5.0, =0.5.2 and more Source cves: CVE-2026-11998 Source advisory: OSV:GHSA-7X27-G8RG-X87W...

@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.016f0b0e8119, <=5.0.1-staging.ffad3b46492e) +259 more potentially affected by CVE-2026-54326 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.0)

@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.078c111a306a, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.3abdf9534c25, =0.6.4, =0.3.1, =0.4.7, =2026.5.12-zh,...

@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.016f0b0e8119, <=5.0.1-staging.ffad3b46492e) +259 more potentially affected by CVE-2026-54327 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.0)

@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.078c111a306a, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.3abdf9534c25, =0.6.4, =0.3.1, =0.4.7, =2026.5.12-zh,...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +90 more potentially affected by CVE-2026-56697 via nuxt (>=3.0.0, <=3.20.1)

nuxt NPM version =3.0.0, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-56697 Source advisory: SNYK:JS-NUXT-17430976...

bolic-network (0.0.1), futures-quic (>=0.2.4, <=0.2.8) +10 more potentially affected by CVE-2026-11941 via quiche (>=0.20.1, <=0.24.9)

quiche CARGO version =0.20.1, =0.2.4, =0.1.1, =2.0.0, =0.1.0, =0.1.19, =0.1.19, =0.1.19, =0.1.19, =0.1.21 Source cves: CVE-2026-11941 Source advisory: OSV:GHSA-MH64-PH39-MRC9...

@chaibuilder/sdk (>=0.1.0, <=1.2.19), @coderrental/csp-categorytree (>=1.1.0, <=1.1.7) +2 more potentially affected by CVE-2026-55091 via flat-to-nested (>=1.1.0, <=1.1.1)

flat-to-nested NPM version =1.1.0, =0.1.0, =1.1.0, =1.0.17, =1.0.18 - flow-dg-category-module 0.0.0 Source cves: CVE-2026-55091 Source advisory: OSV:GHSA-HP36-V28F-W3R4...

@chaibuilder/sdk (>=0.1.0, <=1.2.19), @coderrental/csp-categorytree (>=1.1.0, <=1.1.7) +2 more potentially affected by CVE-2026-55091 via flat-to-nested (>=1.1.0, <=1.1.1)

flat-to-nested NPM version =1.1.0, =0.1.0, =1.1.0, =1.0.17, =1.0.18 - flow-dg-category-module 0.0.0 Source cves: CVE-2026-55091 Source advisory: SNYK:JS-FLATTONESTED-17817904...

kozou (>=1.0.0, <=1.8.0) potentially affected by unknown CVE via @kozou/api (>=1.0.0, <=1.8.0)

@kozou/api NPM version =1.0.0, =1.0.0, =1.8.0 Source cves: unknown CVE Source advisory: OSV:GHSA-V52W-28XH-V562...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2870 more potentially affected by unknown CVE via typeorm (>=0.1.14, <=0.3.28)

typeorm NPM version =0.1.14, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-TYPEORM-17391479...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-57480 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-57480 Source advisory: OSV:GHSA-CGXM-VR2F-6FJ8...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +714 more potentially affected by CVE-2026-6733 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.33, =0.1.8, =0.0.1, =1.0.0, =0.1.7, =21.0.0-rc.2, =21.0.0-rc.2, =21.2.17 and more Source cves: CVE-2026-6733 Source advisory: OSV:GHSA-35P6-XMWP-9G52...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +23 more potentially affected by CVE-2026-53850 via openclaw (>=2026.3.22, <=2026.4.24)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 and more Source cves: CVE-2026-53850 Source advisory: SNYK:JS-OPENCLAW-17394019...

@chrysb/alphaclaw (0.9.11) potentially affected by CVE-2026-53856 via openclaw (2026.4.23)

openclaw NPM version 2026.4.23 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw 0.9.11 Source cves: CVE-2026-53856 Source advisory: OSV:GHSA-RWP6-7W3Q-75FQ...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53851 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53851 Source advisory: OSV:GHSA-FCVX-5CXC-V5P8...

@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @robertjndw/plugin-ext (>=1.58.6, <=1.58.9) +23 more potentially affected by CVE-2026-44691 via @theia/task (>=1.1.0-next.a62a6b92, <=1.68.2)

@theia/task NPM version =1.1.0-next.a62a6b92, =1.11.0, =1.58.6, =1.61.0, =1.17.2, =1.1.0-next.14531578, =1.29.0-next.50, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.46.0-next.72, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.2.2, =1.2.4 and more Source cves: CVE-2026-446...

@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @devpodio/github-extension (1.0.0) +130 more potentially affected by CVE-2026-44691 via @theia/workspace (>=1.0.0, <=1.68.2)

@theia/workspace NPM version =1.0.0, =1.11.0, =0.1.7, =0.0.1-1585667205, =0.8.0-next.6917503, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.2.0-next.25250370, =0.7.1, =1.58.6, =1.58.9 and more Source cves: CVE-2026-44691 Source advisory: SNYK:JS-THEIAWORKSPACE-17391869...

@fangoling/ai-terminal-assistant (0.1.0), @theia/ai-anthropic (>=1.57.0-next.37, <=1.70.2) +28 more potentially affected by CVE-2026-44688 via @theia/ai-core (>=1.46.0-next.241, <=1.70.2)

@theia/ai-core NPM version =1.46.0-next.241, =1.57.0-next.37, =1.46.0-next.241, =1.46.0-next.241, =1.65.0, =1.46.0-next.241, =1.67.0-next.56, =1.68.0-next.79, =1.64.0, =0.0.1, =1.60.0, =1.46.0-next.241, =1.46.0-next.241, =1.59.0-next.62, =1.70.2 - @theia/ai-ide-agents 1.57.0-next.136 and more...

@theia/ai-chat-ui (>=1.46.0-next.241, <=1.70.2), @theia/ai-claude-code (>=1.65.0, <=1.70.2) +8 more potentially affected by CVE-2026-22551 via @theia/ai-chat (>=1.46.0-next.241, <=1.70.2)

@theia/ai-chat NPM version =1.46.0-next.241, =1.46.0-next.241, =1.65.0, =1.67.0-next.56, =0.0.1, =1.62.0, =1.59.0-next.62, =1.57.0-next.37, =1.46.0-next.241, =1.46.0-next.241, =1.58.5 Source cves: CVE-2026-22551 Source advisory: OSV:GHSA-QWJM-9C66-W4Q4...