@algotech-ce/business (>=1.0.1445, <=6.0.28), @algotech-ce/interpretor (>=2.0.0, <=6.0.19) +40 more potentially affected by CVE-2026-44643 via angular-expressions (>=1.0.0, <=1.5.1)

angular-expressions NPM version =1.0.0, =1.0.1445, =2.0.0, =0.7.0, =0.1.0, =0.7.0, =0.7.0, =0.7.0, =0.7.0, =0.6.0-bootstrap.0, =0.6.0, =0.7.0, =0.7.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.6.0-bootstrap.0, =0.7.1 and more Source cves: CVE-2026-44643 Source advisory: OSV:GHSA-PW8R-6689-XVF4...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44572 via next (>=16.0.0, <=16.2.4)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-44572 Source advisory:...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44580 via next (>=16.0.0, <=16.2.4)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-44580 Source advisory:...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44575 via next (>=16.0.0, <=16.2.4)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-44575 Source advisory:...

3d-effect-cinema (>=0.1.0, <=0.4.1), 47th (0.1.0) +350 more potentially affected by CVE-2026-44574 via next (>=15.4.0-canary.17, <=15.5.15)

next NPM version =15.4.0-canary.17, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2026-44574 Source advisory: OSV:GHSA-492V-C6PP-MQQV...

0perator (>=0.1.0, <=0.3.0), 0xble (>=5.0.0, <=14.1.0) +3054 more potentially affected by CVE-2026-44902 via @opentelemetry/sdk-node (>=0.10.2, <=0.216.0)

@opentelemetry/sdk-node NPM version =0.10.2, =0.1.0, =5.0.0, =0.1.1, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.0, =0.2.6 and more Source cves: CVE-2026-44902 Source advisory: OSV:GHSA-Q7RR-3CGH-J5...

a1 (>=1.0.1, <=1.0.2), actor-kit (>=0.1.0, <=0.2.3) +132 more potentially affected by unknown CVE via rkyv (0.8.2)

rkyv CARGO version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on rkyv and may be impacted: - a1 =1.0.1, =0.1.0, =0.1.0, =0.9.0, =0.1.0, =0.2.1, =0.1.0, =0.4.0, =0.9.0, =0.5.0, =0.5.0, =2.0.0-alpha.1, =0.1.2, =0.4.2 and more Source cves: unknown...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +679 more potentially affected by CVE-2026-44458 via hono (>=4.0.0, <=4.12.17)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-44458 Source advisory: OSV:GHSA-QP7P-654G-CW7P...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +679 more potentially affected by CVE-2026-44459 via hono (>=4.0.0, <=4.12.17)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-44459 Source advisory: OSV:GHSA-HM8Q-7F3Q-5F36...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @abyedev/hono-dotenv (1.0.0) +957 more potentially affected by CVE-2026-44457 via hono (>=2.1.4, <=4.12.17)

hono NPM version =2.1.4, =0.1.8-fix.3, =0.3.1, =5.0.0, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.15 and more Source cves: CVE-2026-44457 Source advisory: SNYK:JS-HONO-16624532...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +335 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: OSV:GHSA-FV7C-FP4J-7GWP...

org.webjars.npm:degenerator (4.0.4), org.webjars.npm:pac-resolver (6.0.2) +1 more potentially affected by CVE-2026-44003 via org.webjars.npm:vm2 (3.9.19)

org.webjars.npm:vm2 MAVEN version 3.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vm2 and may be impacted: - org.webjars.npm:degenerator 4.0.4 - org.webjars.npm:pac-resolver 6.0.2 - org.webjars.npm:rocket.chatapps-engine 1.35.0...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-44008 via vm2 (>=3.0.0, <=3.11.1)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

stats-fr-emarque-basketball-extractor (>=1.0.0, <=1.0.2) potentially affected by CVE-2025-63705 via node-ts-ocr (1.0.15)

node-ts-ocr NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on node-ts-ocr and may be impacted: - stats-fr-emarque-basketball-extractor =1.0.0, =1.0.2 Source cves: CVE-2025-63705 Source advisory: OSV:GHSA-8JH2-3MW6-6PFM...

stats-fr-emarque-basketball-extractor (>=1.0.0, <=1.0.2) potentially affected by CVE-2025-63705 via node-ts-ocr (1.0.15)

node-ts-ocr NPM version 1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on node-ts-ocr and may be impacted: - stats-fr-emarque-basketball-extractor =1.0.0, =1.0.2 Source cves: CVE-2025-63705 Source advisory: SNYK:JS-NODETSOCR-16787371...

@accordproject/cicero-cli (>=0.23.0-20220318211856, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.23.0-20220318211856, <=0.24.1-20230627140514) +172 more potentially affected by CVE-2026-44007 via vm2 (>=3.9.6, <=3.10.5)

vm2 NPM version =3.9.6, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220318211856, =0.23.0-20220317205016, =0.23.0-20220317205016, =0.23.0-20220317205016, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =0.1.0, =0.0.2, =1.0.2, =3.0.34 and more Source...

@xapp/cli (1.8.11), stentor (>=1.68.30, <=1.72.1) +9 more potentially affected by CVE-2026-43998 via vm2 (3.10.5)

vm2 NPM version 3.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - @xapp/cli 1.8.11 - stentor =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.72.1 Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-43998 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-44002 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-44002 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-44000 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-44004 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@xapp/cli (1.8.11), stentor (>=1.68.30, <=1.72.1) +9 more potentially affected by CVE-2026-43999 via vm2 (3.10.5)

vm2 NPM version 3.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on vm2 and may be impacted: - @xapp/cli 1.8.11 - stentor =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.68.30, =1.72.1 Source cves:...

@caliperai/caliper (>=0.2.0, <=0.3.0), @doccov/api (>=0.6.0, <=0.6.4) +12 more potentially affected by CVE-2026-44479 via vercel (>=50.41.0, <=51.8.0)

vercel NPM version =50.41.0, =0.2.0, =0.6.0, =0.3.0-rc.2, =3.10.3, =1.1.1, =1.0.1, =1.0.2, =0.1.19, =0.4.0-rc.3, =1.0.0, =2.0.0 Source cves: CVE-2026-44479 Source advisory: OSV:GHSA-PGF8-2HGJ-GRQG...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-44437 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-44437 Source advisory: SNYK:JS-ANGULARSSR-16438975...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-44437 via @angular/ssr (>=21.1.2, <=21.2.7)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.0.2, =0.0.3 Source cves: CVE-2026-44437 Source advisory: SNYK:JS-ANGULARSSR-16438975...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @fails-components/jupyter-applet-view (>=0.0.1-alpha.3, <=0.0.4) +21 more potentially affected by CVE-2026-42557 via @jupyterlab/apputils (>=4.0.0, <=4.5.10)

@jupyterlab/apputils NPM version =4.0.0, =0.0.6, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =7.1.0-rc.1, =7.1.0-rc.1, =7.1.0-rc.1, =7.1.0-rc.1, =7.1.0-rc.1, =7.1.0-rc.1, =0.2.0-alpha.0, =0.6.0-alpha.10, =0.6.0-alpha.10, =0.6.0-alpha.3, =0.6.0-alpha.9 and more Source cves:...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @mrawdon/jupyter-react (>=0.0.23, <=0.0.32) potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-extension (>=4.0.0, <=4.1.0-beta.0)

@jupyterlab/rendermime-extension NPM version =4.0.0, =0.0.6, =0.0.23, =0.0.32 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEEXTENSION-16438958...

@fails-components/jupyter-applet-view (>=0.0.1-alpha.3, <=0.0.1-alpha.18), @fails-components/jupyter-filesystem-extension (>=0.0.1-alpha.3, <=0.0.1-alpha.18) +3 more potentially affected by CVE-2026-42557 via @jupyterlab/help-extension (>=4.0.13, <=4.4.10)

@jupyterlab/help-extension NPM version =4.0.13, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.2.0-alpha.0, =0.6.0-alpha.9 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABHELPEXTENSION-16438961...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @jupyter-notebook/application (>=7.1.0-alpha.0, <=7.4.7) +7 more potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-interfaces (>=3.1.18, <=3.12.10)

@jupyterlab/rendermime-interfaces NPM version =3.1.18, =0.0.6, =7.1.0-alpha.0, =0.1.0-alpha.23, =0.1.0-alpha.7, =0.3.0-alpha.0, =0.1.0-alpha.23, =0.0.23, =0.2.0-alpha.0, =0.1.1, =0.2.2 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEINTERFACES-16438959...

@0xchain/empty (>=0.0.1, <=1.1.0-beta.4), @0xchain/expandable-text (>=0.0.1, <=1.1.0-beta.18) +15 more potentially affected by unknown CVE via next-intl (>=4.0.2, <=4.9.1)

next-intl NPM version =4.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.8.0, =1.28.0, =0.0.3, =1.4.88, =1.5.37 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTINTL-16438971...

@mastra/auth-workos (>=0.0.0-a-b-demo-20260521201120, <=1.5.2), @workos/authkit-sveltekit (>=0.0.1-alpha.0, <=0.2.0) +1 more potentially affected by CVE-2026-42565 via @workos/authkit-session (>=0.0.1-alpha.3, <=0.4.0)

@workos/authkit-session NPM version =0.0.1-alpha.3, =0.0.0-a-b-demo-20260521201120, =0.0.1-alpha.0, =0.1.0, =0.6.0 Source cves: CVE-2026-42565 Source advisory: OSV:GHSA-VVVV-983W-R7PV...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +282 more potentially affected by CVE-2026-24120 via vm2 (>=3.0.0, <=3.10.4)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

parley-core (>=0.2.0, <=0.6.1), pqc-combo (0.1.0) +2 more potentially affected by unknown CVE via libcrux-ml-dsa (>=0.0.4, <=0.0.8)

libcrux-ml-dsa CARGO version =0.0.4, =0.2.0, =0.6.1 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0125...

@514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64), @514labs/sloan-mcp (0.0.65) +543 more potentially affected by CVE-2026-43870 via thrift (>=0.6.0-1, <=0.22.0)

thrift NPM version =0.6.0-1, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.6, =0.9.0, =0.0.1, =0.1.0, =1.0.0-beta.1, =1.0.0-beta.6, =1.0.1, =1.1.0, =0.24.0-no-protobuf-patch.1, =0.18.8, =0.24.0 and more Source cves: CVE-2026-43870 Source advisory: SNYK:JS-THRIFT-16431741...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +15275 more potentially affected by CVE-2026-42037 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42037 Source advisory: OSV:GHSA-445Q-VR5W-6Q77...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +15275 more potentially affected by CVE-2026-42033 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42033 Source advisory: OSV:GHSA-PF86-5X62-JRWF...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6321 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6321 Source advisory: SNYK:JS-FASTURI-16642399...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44118 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44118 Source advisory: SNYK:JS-OPENCLAW-16417712...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-45003 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-45003 Source advisory: SNYK:JS-OPENCLAW-16417709...

@aiconnect/codelets-runner (>=0.1.0, <=0.2.0), @cairncms/api (>=1.0.0-beta.1, <=1.0.0-beta.4) +13 more potentially affected by CVE-2023-37466 +1 more via vm2 (>=3.10.0, <=3.10.4)

vm2 NPM version =3.10.0, =0.1.0, =1.0.0-beta.1, =3.0.46, =1.0.0-beta.1, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.66.16, =1.68.29 Source cves: CVE-2023-37466, CVE-2026-24120 Source advisory: SNYK:JS-VM2-16419537...

rustdx-cmd (>=0.1.0, <=0.3.0) potentially affected by unknown CVE via rustdx (>=0.2.5, <=0.3.0)

rustdx CARGO version =0.2.5, =0.1.0, =0.3.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0123...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +63 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.4.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0117...

acme-validation-propagation (>=0.1.5, <=0.1.8), agnostic (>=0.2.1, <=0.2.6) +37 more potentially affected by CVE-2024-8508 via hickory-proto (>=0.24.4, <=0.25.0-alpha.5)

hickory-proto CARGO version =0.24.4, =0.1.5, =0.2.1, =0.24.0, =0.9.3, =0.1.0, =0.5.0, =0.1.0, =0.0.1, =0.2.6, =0.2.8 - getip 0.1.0 and more Source cves: CVE-2024-8508 Source advisory: OSV:RUSTSEC-2026-0119...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.17-canary.v20260417194309) +10 more potentially affected by CVE-2026-42349 via @clerk/backend (>=3.0.0, <=3.2.13-canary.v20260417194309)

@clerk/backend NPM version =3.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =2.0.0-canary.v20251211104600, =2.6.9-canary.v20251211104600, =0.0.1, =7.0.0-canary.v20251211104600, =2.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =1.0.0-canary.v20251211104600,...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.16-snapshot.v20260416221307) +43 more potentially affected by CVE-2026-42349 via @clerk/shared (>=4.0.0, <=4.8.2-snapshot.v20260416221307)

@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...

@clerk/chrome-extension (>=3.0.0-canary.v20251211104600, <=3.1.14-canary.v20260417194309), @clerk/expo (>=3.0.0-canary.v20251211104600, <=3.2.1-canary.v20260417194309) potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=6.0.0-canary.v20251211104600, <=6.7.4-canary.v20260417194309)

@clerk/clerk-js NPM version =6.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.2.1-canary.v20260417194309 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

0xble (>=14.0.0, <=21.9.1), 100xchat (>=1.1.5, <=1.3.5) +4482 more potentially affected by CVE-2026-8657 via jsondiffpatch (>=0.0.11, <=0.7.3)

jsondiffpatch NPM version =0.0.11, =14.0.0, =1.1.5, =1.0.0, =1.0.0, =1.0.4, =0.10.6, =0.1.6, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.1, =0.1.0-alpha.1, =0.1.0, =1.1.0, =0.3.1, =1.2.4 and more Source cves: CVE-2026-8657 Source advisory: SNYK:JS-JSONDIFFPATCH-16322990...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14152 more potentially affected by CVE-2026-42037 via axios (>=1.3.0, <=1.15.0)

axios NPM version =1.3.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =2.0.200 and more Source cves: CVE-2026-42037 Source advisory: SNYK:JS-AXIOS-16299819...

@netlify/agent-runner-cli (>=1.83.1, <=1.94.0), feishu-claude-bot (0.1.0) +1 more potentially affected by CVE-2026-40068 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.81)

@anthropic-ai/claude-code NPM version =2.1.63, =1.83.1, =1.2.2, =1.2.3 Source cves: CVE-2026-40068 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-16301567...