@caliperai/caliper (>=0.2.0, <=0.3.0), @doccov/api (>=0.6.0, <=0.6.4) +12 more potentially affected by CVE-2026-44479 via vercel (>=50.41.0, <=51.8.0)

vercel NPM version =50.41.0, =0.2.0, =0.6.0, =0.3.0-rc.2, =3.10.3, =1.1.1, =1.0.1, =1.0.2, =0.1.19, =0.4.0-rc.3, =1.0.0, =2.0.0 Source cves: CVE-2026-44479 Source advisory: SNYK:JS-VERCEL-16638653...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +544 more potentially affected by CVE-2026-44456 via hono (>=4.0.0, <=4.12.15)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =0.0.1, =2026.4.4, =1.0.2, =1.9.1 and more Source cves: CVE-2026-44456 Source advisory: OSV:GHSA-9VQF-7F2P-GF9V...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +544 more potentially affected by CVE-2026-44456 via hono (>=4.0.0, <=4.12.15)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =0.0.1, =2026.4.4, =1.0.2, =1.9.1 and more Source cves: CVE-2026-44456 Source advisory: SNYK:JS-HONO-16438966...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +544 more potentially affected by CVE-2026-44455 via hono (>=4.0.0, <=4.12.15)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =0.0.1, =2026.4.4, =1.0.2, =1.9.1 and more Source cves: CVE-2026-44455 Source advisory: SNYK:JS-HONO-16438965...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +544 more potentially affected by CVE-2026-44455 via hono (>=4.0.0, <=4.12.15)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.1.4, =0.0.1, =2026.4.4, =1.0.2, =1.9.1 and more Source cves: CVE-2026-44455 Source advisory: OSV:GHSA-69XW-7HCM-H432...

create-momentum-app (>=0.1.2, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-44437 via @angular/ssr (>=21.1.2, <=21.2.7)

@angular/ssr NPM version =21.1.2, =0.1.2, =0.0.2, =0.0.3 Source cves: CVE-2026-44437 Source advisory: SNYK:JS-ANGULARSSR-16438975...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-44437 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-44437 Source advisory: OSV:GHSA-69XR-M8H6-H664...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) potentially affected by CVE-2026-44437 via @angular/ssr (>=20.3.18, <=20.3.24)

@angular/ssr NPM version =20.3.18, =7.3.49-4369, =4.2.16-4435, =4.2.17 Source cves: CVE-2026-44437 Source advisory: SNYK:JS-ANGULARSSR-16438975...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8), @manniwatch/client-desktop (>=0.30.0, <=0.30.1) +3 more potentially affected by CVE-2026-44437 via @angular/ssr (>=19.0.5, <=19.2.19)

@angular/ssr NPM version =19.0.5, =1.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2026-44437 Source advisory: SNYK:JS-ANGULARSSR-16438975...

ldap3_cli (>=0.3.1, <=0.6.1), ldap3_client (>=0.1.0, <=0.6.1) potentially affected by unknown CVE via ldap3_proto (>=0.2.3, <=0.6.1)

ldap3proto CARGO version =0.2.3, =0.3.1, =0.1.0, =0.6.1 Source cves: unknown CVE Source advisory: OSV:GHSA-QCXQ-75WR-5CM8...

kanidm_client (>=1.1.0-alpha, <=1.1.0-alpha.12), kanidm_tools (>=1.1.0-alpha, <=1.1.0-alpha.12) potentially affected by CVE-2026-46689 via kanidm_proto (>=1.1.0-alpha.10, <=1.1.0-alpha.12)

kanidmproto CARGO version =1.1.0-alpha.10, =1.1.0-alpha, =1.1.0-alpha, =1.1.0-alpha.12 Source cves: CVE-2026-46689 Source advisory: OSV:GHSA-R5FR-9GMV-JGGH...

@backstage/plugin-catalog-backend-module-unprocessed (>=0.0.0-nightly-20240321021124, <=0.6.10), @backstage/plugin-catalog-unprocessed-entities (>=0.0.0-nightly-20251203024610, <=0.2.29) potentially affected by CVE-2026-44374 via @backstage/plugin-catalog-unprocessed-entities-common (>=0.0.0-nightly-20241116023418, <=0.0.14-next.0)

@backstage/plugin-catalog-unprocessed-entities-common NPM version =0.0.0-nightly-20241116023418, =0.0.0-nightly-20240321021124, =0.0.0-nightly-20251203024610, =0.2.29 Source cves: CVE-2026-44374 Source advisory: OSV:GHSA-P7G9-RP3G-MGFG...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44372 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44372 Source advisory: SNYK:JS-NITRO-16757947...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44372 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44372 Source advisory: OSV:GHSA-9PHM-9P8F-HW5M...

@100x/application (>=0.0.1, <=0.0.6), @aero-js/cli (0.4.0) +60 more potentially affected by CVE-2026-44373 via nitro (>=3.0.0, <=3.0.260415-beta)

nitro NPM version =3.0.0, =0.0.1, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.3.3, =0.1.0, =0.1.0, =0.4.2, =0.2.9, =2.4.0-alpha.2, =3.0.0-alpha.55 and more Source cves: CVE-2026-44373 Source advisory: SNYK:JS-NITRO-16757954...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.13.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.13.1) +1 more potentially affected by CVE-2026-44351 via fast-jwt (>=6.0.0, <=6.0.1)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.13.1 Source cves: CVE-2026-44351 Source advisory: SNYK:JS-FASTJWT-16439016...

@jsprismarine/client (>=0.12.2-unstable-20250320195345, <=0.13.1), @jsprismarine/prismarine (>=0.12.2-unstable-20250320195345, <=0.13.1) +1 more potentially affected by CVE-2026-44351 via fast-jwt (>=6.0.0, <=6.0.1)

fast-jwt NPM version =6.0.0, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.12.2-unstable-20250320195345, =0.13.1 Source cves: CVE-2026-44351 Source advisory: OSV:GHSA-GMVF-9V4P-V8JC...

lemmy_server (>=0.11.3-rc.5, <=0.16.7) potentially affected by unknown CVE via lemmy_api (>=0.11.3-rc.5, <=0.16.7)

lemmyapi CARGO version =0.11.3-rc.5, =0.11.3-rc.5, =0.16.7 Source cves: unknown CVE Source advisory: OSV:GHSA-JMXC-HHWX-GVV3...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @mrawdon/jupyter-react (>=0.0.23, <=0.0.32) potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-extension (>=4.0.0, <=4.1.0-beta.0)

@jupyterlab/rendermime-extension NPM version =4.0.0, =0.0.6, =0.0.23, =0.0.32 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEEXTENSION-16438958...

@datalayer/jupyter-react (0.9.5) potentially affected by CVE-2026-42557 via @jupyterlab/notebook-extension (4.1.0-beta.0)

@jupyterlab/notebook-extension NPM version 4.1.0-beta.0 is affected by a known vulnerability. The following packages have a transitive dependency on @jupyterlab/notebook-extension and may be impacted: - @datalayer/jupyter-react 0.9.5 Source cves: CVE-2026-42557 Source advisory:...

@datalayer/jupyter-react (0.9.5) potentially affected by CVE-2026-42557 via @jupyterlab/apputils-extension (4.1.0-beta.0)

@jupyterlab/apputils-extension NPM version 4.1.0-beta.0 is affected by a known vulnerability. The following packages have a transitive dependency on @jupyterlab/apputils-extension and may be impacted: - @datalayer/jupyter-react 0.9.5 Source cves: CVE-2026-42557 Source advisory:...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @jupyter-notebook/lab-extension (>=7.1.0-rc.1, <=7.4.7) +9 more potentially affected by CVE-2026-42557 via @jupyterlab/notebook (>=4.0.0, <=4.5.1)

@jupyterlab/notebook NPM version =4.0.0, =0.0.6, =7.1.0-rc.1, =7.1.0-rc.1, =0.0.23, =5.3.6, =1.0.0, =1.4.0 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABNOTEBOOK-16438957...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @jupyter-notebook/application-extension (>=7.1.0-rc.1, <=7.4.7) +3 more potentially affected by CVE-2026-42557 via @jupyterlab/rendermime (>=4.0.0, <=4.4.10)

@jupyterlab/rendermime NPM version =4.0.0, =0.0.6, =7.1.0-rc.1, =0.0.23, =1.29.0, =1.30.0 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIME-16438960...

@fails-components/jupyter-applet-view (>=0.0.1-alpha.3, <=0.0.1-alpha.18), @fails-components/jupyter-filesystem-extension (>=0.0.1-alpha.3, <=0.0.1-alpha.18) +3 more potentially affected by CVE-2026-42557 via @jupyterlab/help-extension (>=4.0.13, <=4.4.10)

@jupyterlab/help-extension NPM version =4.0.13, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.2.0-alpha.0, =0.6.0-alpha.9 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABHELPEXTENSION-16438961...

@datalayer/jupyter-react (0.9.5) potentially affected by CVE-2026-42557 via @jupyterlab/markdownviewer-extension (4.1.0-beta.0)

@jupyterlab/markdownviewer-extension NPM version 4.1.0-beta.0 is affected by a known vulnerability. The following packages have a transitive dependency on @jupyterlab/markdownviewer-extension and may be impacted: - @datalayer/jupyter-react 0.9.5 Source cves: CVE-2026-42557 Source advisory:...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0) +18 more potentially affected by CVE-2026-43580 via openclaw (>=2026.3.22, <=2026.4.9)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-43580 Source advisory: SNYK:JS-OPENCLAW-16438149...

@c0va23/react-router-dev (7.8.3-alpha.2), @holocron.so/cli (>=0.6.0, <=0.16.0) +16 more potentially affected by CVE-2026-23870 via @vitejs/plugin-rsc (>=0.4.11, <=0.5.24)

@vitejs/plugin-rsc NPM version =0.4.11, =0.6.0, =0.5.0, =0.0.1, =0.0.0-1ae0b37, =0.0.0-experimental-14dc7c1, =0.0.0-pr-32412-sha-076721d1, =1.0.2, =0.1.0, =0.0.1, =1.18.0-rsc.19, =0.1.0, =0.0.1-alpha.0, =0.0.1-alpha.1 and more Source cves: CVE-2026-23870 Source advisory:...

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +758 more potentially affected by CVE-2026-23870 via next (>=16.0.0, <=16.2.4)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-23870 Source advisory:...

@0xchain/empty (>=0.0.1, <=1.1.0-beta.4), @0xchain/expandable-text (>=0.0.1, <=1.1.0-beta.18) +16 more potentially affected by unknown CVE via next-intl (>=4.0.2, <=4.9.1)

next-intl NPM version =4.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =3.8.0, =1.28.0, =2.11.31, =0.0.3, =0.0.28 and more Source cves: unknown CVE Source advisory: SNYK:JS-NEXTINTL-16438971...

tauri-egui (0.3.0), tauri-plugin-single-instance (>=2.0.0-alpha.0, <=2.0.0-alpha.6) +2 more potentially affected by CVE-2026-42184 via tauri (>=2.0.0-alpha.4, <=2.0.0-alpha.21)

tauri CARGO version =2.0.0-alpha.4, =2.0.0-alpha.0, =2.0.0-alpha.0, =2.0.0-alpha.6 Source cves: CVE-2026-42184 Source advisory: OSV:GHSA-7GMJ-67G7-PHM9...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +125 more potentially affected by CVE-2026-42338 via ip-address (>=10.0.1, <=10.1.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =7.0.0-canary.2, =7.5.9 and more Source cves: CVE-2026-42338 Source advisory: SNYK:JS-IPADDRESS-16636412...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +125 more potentially affected by CVE-2026-42338 via ip-address (>=10.0.1, <=10.1.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =7.0.0-canary.2, =7.5.9 and more Source cves: CVE-2026-42338 Source advisory: OSV:GHSA-V2V4-37R5-5V8G...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +419 more potentially affected by CVE-2026-42334 via mongoose (>=6.0.1, <=6.13.8)

mongoose NPM version =6.0.1, =1.2.3, =2.0.1, =0.0.1-alpha.89, =0.0.1-alpha.89, =0.0.3, =1.0.5, =3.9.0, =1.0.9, =1.0.0-beta1, =1.4.5, =1.1.80, =0.0.1, =0.1.16 and more Source cves: CVE-2026-42334 Source advisory: OSV:GHSA-WPG9-53FQ-2R8H...

123ts-backend-setup-prod (1.0.0), 4casterschemas (>=1.0.0, <=1.0.1) +189 more potentially affected by CVE-2026-42334 via mongoose (>=8.0.0, <=8.21.1)

mongoose NPM version =8.0.0, =1.0.0, =2.1.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =3.13.0, =1.1.9, =1.5.31 and more Source cves: CVE-2026-42334 Source advisory: SNYK:JS-MONGOOSE-16425765...

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +116 more potentially affected by CVE-2026-42334 via mongoose (>=7.0.0, <=7.8.8)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =7.6.10, =7.8.6 and more Source cves: CVE-2026-42334 Source advisory: SNYK:JS-MONGOOSE-16425765...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +419 more potentially affected by CVE-2026-42334 via mongoose (>=6.0.1, <=6.13.8)

mongoose NPM version =6.0.1, =1.2.3, =2.0.1, =0.0.1-alpha.89, =0.0.1-alpha.89, =0.0.3, =1.0.5, =3.9.0, =1.0.9, =1.0.0-beta1, =1.4.5, =1.1.80, =0.0.1, =0.1.16 and more Source cves: CVE-2026-42334 Source advisory: SNYK:JS-MONGOOSE-16425765...

123ts-backend-setup-prod (1.0.0), 4casterschemas (>=1.0.0, <=1.0.1) +189 more potentially affected by CVE-2026-42334 via mongoose (>=8.0.0, <=8.21.1)

mongoose NPM version =8.0.0, =1.0.0, =2.1.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =3.13.0, =1.1.9, =1.5.31 and more Source cves: CVE-2026-42334 Source advisory: OSV:GHSA-WPG9-53FQ-2R8H...

@a-la-fois/api (>=0.0.25, <=0.0.39), @a-la-fois/doc-client (>=0.0.1-alpha.89, <=0.0.39) +116 more potentially affected by CVE-2026-42334 via mongoose (>=7.0.0, <=7.8.8)

mongoose NPM version =7.0.0, =0.0.25, =0.0.1-alpha.89, =0.0.25, =0.0.1, =0.0.25, =3.12.0, =1.0.0, =1.0.6-beta.0, =0.2.0-alpha.1, =0.2.0-alpha.0, =0.0.0, =1.0.2, =1.0.0, =7.6.10, =7.8.6 and more Source cves: CVE-2026-42334 Source advisory: OSV:GHSA-WPG9-53FQ-2R8H...

@mastra/auth-workos (>=0.0.0-a-b-demo-20260521201120, <=1.5.2), @workos/authkit-sveltekit (>=0.0.1-alpha.0, <=0.2.0) +1 more potentially affected by CVE-2026-42565 via @workos/authkit-session (>=0.0.1-alpha.3, <=0.4.0)

@workos/authkit-session NPM version =0.0.1-alpha.3, =0.0.0-a-b-demo-20260521201120, =0.0.1-alpha.0, =0.1.0, =0.6.0 Source cves: CVE-2026-42565 Source advisory: OSV:GHSA-VVVV-983W-R7PV...

@mastra/auth-workos (>=0.0.0-a-b-demo-20260521201120, <=1.5.2), @workos/authkit-sveltekit (>=0.0.1-alpha.0, <=0.2.0) +1 more potentially affected by CVE-2026-42565 via @workos/authkit-session (>=0.0.1-alpha.3, <=0.4.0)

@workos/authkit-session NPM version =0.0.1-alpha.3, =0.0.0-a-b-demo-20260521201120, =0.0.1-alpha.0, =0.1.0, =0.6.0 Source cves: CVE-2026-42565 Source advisory: SNYK:JS-WORKOSAUTHKITSESSION-16425670...

@b3dotfun/b3-api (>=0.0.42, <=0.0.102), @b3dotfun/sdk (>=0.0.27-alpha.1, <=0.1.70) +39 more potentially affected by CVE-2026-42047 via inngest (>=3.22.3, <=3.47.0)

inngest NPM version =3.22.3, =0.0.42, =0.0.27-alpha.1, =1.0.4, =0.0.26, =2.0.5, =0.0.3-canary.1, =0.1.2, =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.0, =1.0.1-alpha.0, =0.1.13, =1.0.1-alpha.0, =0.0.1, =1.0.1, =1.0.4-alpha.13 and more Source cves: CVE-2026-42047 Source advisory:...

@abtnode/analytics (>=1.16.13-beta-0086a35d, <=1.17.13-beta-20260613-094425-b81920c8), @abtnode/auth (>=1.3.13, <=1.17.13-beta-20260613-094425-b81920c8) +212 more potentially affected by CVE-2026-32689 via phoenix (>=1.7.2, <=1.7.21)

phoenix NPM version =1.7.2, =1.16.13-beta-0086a35d, =1.3.13, =1.1.12, =1.6.23, =1.16.6-beta-08670107, =1.0.0, =1.16.33-beta-20241105-141729-e4608175, =1.0.0, =1.0.35, =1.16.33-beta-20241105-141729-e4608175, =1.0.2, =1.16.33-beta-20241105-141729-e4608175, =1.16.33-beta-20241105-141729-e4608175,...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +19 more potentially affected by CVE-2026-43526 via openclaw (>=2026.3.22, <=2026.4.11)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =2.0.1, =4.2.0 and more Source cves: CVE-2026-43526 Source advisory: SNYK:JS-OPENCLAW-16420278...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-43527 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-43527 Source advisory: SNYK:JS-OPENCLAW-16420277...

actix-web-opentelemetry (>=0.2.0, <=0.11.0-beta.3), ailake-file (>=0.0.8, <=0.1.10) +229 more potentially affected by CVE-2026-43868 via thrift (>=0.0.4, <=0.17.0)

thrift CARGO version =0.0.4, =0.2.0, =0.0.8, =0.0.6, =0.2.0, =0.3.0, =0.3.5, =0.1.3, =0.2.0, =0.7.0, =0.1.0, =0.1.0, =0.32.1, =0.34.0 and more Source cves: CVE-2026-43868 Source advisory: OSV:GHSA-2F9F-GQ7V-9H6M...

@514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64), @514labs/sloan-mcp (0.0.65) +535 more potentially affected by CVE-2026-43870 via thrift (>=0.6.0-1, <=0.21.0)

thrift NPM version =0.6.0-1, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.6, =0.9.0, =0.0.1, =0.1.0, =1.0.0-beta.1, =1.0.0-beta.6, =1.0.1, =1.1.0, =0.24.0-no-protobuf-patch.1, =0.18.8, =0.24.0 and more Source cves: CVE-2026-43870 Source advisory: OSV:GHSA-526F-JXPJ-JMG2...

@514labs/aurora-mcp (>=0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, <=0.0.64), @514labs/sloan-mcp (0.0.65) +537 more potentially affected by CVE-2026-43870 via thrift (>=0.6.0-1, <=0.22.0)

thrift NPM version =0.6.0-1, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.6, =0.9.0, =0.0.1, =0.1.0, =1.0.0-beta.1, =1.0.0-beta.6, =1.0.1, =1.1.0, =0.24.0-no-protobuf-patch.1, =0.18.8, =0.24.0 and more Source cves: CVE-2026-43870 Source advisory: SNYK:JS-THRIFT-16431741...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16005 more potentially affected by CVE-2026-42037 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42037 Source advisory: OSV:GHSA-445Q-VR5W-6Q77...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16005 more potentially affected by CVE-2026-42039 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42039 Source advisory: OSV:GHSA-62HF-57XW-28J9...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16005 more potentially affected by CVE-2026-42034 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42034 Source advisory: OSV:GHSA-5C9X-8GCM-MPGX...