-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16000 more potentially affected by CVE-2026-42039 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42039 Source advisory: OSV:GHSA-62HF-57XW-28J9...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16000 more potentially affected by CVE-2026-42034 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42034 Source advisory: OSV:GHSA-5C9X-8GCM-MPGX...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16000 more potentially affected by CVE-2026-42036 via axios (>=1.0.0, <=1.15.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42036 Source advisory: OSV:GHSA-VF2M-468P-8V99...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44115 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44115 Source advisory: OSV:GHSA-X3H8-JRGH-P8JX...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44118 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44118 Source advisory: SNYK:JS-OPENCLAW-16417712...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44118 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44118 Source advisory: OSV:GHSA-R6XH-PQHR-V4XH...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.10) +21 more potentially affected by CVE-2026-44997 via openclaw (>=2026.3.22, <=2026.4.21)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44997 Source advisory: SNYK:JS-OPENCLAW-16417713...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-24781 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

org.webjars.npm:degenerator (4.0.4), org.webjars.npm:pac-resolver (6.0.2) +1 more potentially affected by CVE-2026-24781 via org.webjars.npm:vm2 (3.9.19)

org.webjars.npm:vm2 MAVEN version 3.9.19 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:vm2 and may be impacted: - org.webjars.npm:degenerator 4.0.4 - org.webjars.npm:pac-resolver 6.0.2 - org.webjars.npm:rocket.chatapps-engine 1.35.0...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-26956 via vm2 (>=3.0.0, <=3.10.4)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@puchunjie/doc-tools-mcp (>=1.0.11, <=1.0.14) potentially affected by CVE-2026-7738 via @puchunjie/doc-tools-mcp (1.0.18)

@puchunjie/doc-tools-mcp NPM version 1.0.18 is affected by a known vulnerability. The following packages have a transitive dependency on @puchunjie/doc-tools-mcp and may be impacted: - @puchunjie/doc-tools-mcp =1.0.11, =1.0.14 Source cves: CVE-2026-7738 Source advisory: OSV:GHSA-GCMM-C94J-J47X...

@aaasd/pocpoc (99.99.9996), internal-company-module-test-1337 (>=99.99.9991, <=99.99.9995) potentially affected by unknown CVE via internal-company-module-test-1337 (99.99.9996)

internal-company-module-test-1337 NPM version 99.99.9996 is affected by a known vulnerability. The following packages have a transitive dependency on internal-company-module-test-1337 and may be impacted: - @aaasd/pocpoc 99.99.9996 - internal-company-module-test-1337 =99.99.9991, =99.99.9995 Sour...

sar-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via imageproc (0.25.0)

imageproc CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on imageproc and may be impacted: - sar-core =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0116...

sar-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via imageproc (0.25.0)

imageproc CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on imageproc and may be impacted: - sar-core =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0117...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +63 more potentially affected by unknown CVE via imageproc (>=0.6.1, <=0.22.0)

imageproc CARGO version =0.6.1, =0.4.3, =0.1.0, =0.1.0, =0.1.5, =0.1.0, =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.1.0, =1.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0116...

sar-core (>=0.1.0, <=0.1.1) potentially affected by unknown CVE via imageproc (0.25.0)

imageproc CARGO version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on imageproc and may be impacted: - sar-core =0.1.0, =0.1.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0115...

@clerk/chrome-extension (>=3.0.0-canary.v20251211104600, <=3.1.14-canary.v20260417194309), @clerk/expo (>=3.0.0-canary.v20251211104600, <=3.2.1-canary.v20260417194309) potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=6.0.0-canary.v20251211104600, <=6.7.4-canary.v20260417194309)

@clerk/clerk-js NPM version =6.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.2.1-canary.v20260417194309 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

@unhook/cli (>=0.9.3, <=0.15.0) potentially affected by CVE-2026-42349 via @clerk/backend (>=2.0.0, <=2.29.3)

@clerk/backend NPM version =2.0.0, =0.9.3, =0.15.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.16-snapshot.v20260416221307) +43 more potentially affected by CVE-2026-42349 via @clerk/shared (>=4.0.0, <=4.8.2-snapshot.v20260416221307)

@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...

@clerk/chrome-extension (>=3.0.0-canary.v20251211104600, <=3.1.13-snapshot.v20260416221307), @clerk/expo (>=3.0.0-canary.v20251211104600, <=3.2.0-snapshot.v20260416221307) +7 more potentially affected by CVE-2026-42349 via @clerk/react (>=6.0.0-canary.v20251211104600, <=6.4.2-snapshot.v20260416221307)

@clerk/react NPM version =6.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =7.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =1.0.0-canary.v20251211104600, =2.0.0-dev-cli-10, =2.0.0-dev-cli-10, =0.20.1-dev-push, =0.20.3-dev-push,...

@appconda/react (1.0.242), @aurora-nexus/aurora-nexus-design-system (0.2.0) +50 more potentially affected by CVE-2026-42349 via @clerk/clerk-react (>=5.9.0, <=5.61.3)

@clerk/clerk-react NPM version =5.9.0, =1.0.0, =1.3.5-canary.v097a1ce, =2.2.11-canary.v097a1ce, =0.19.4-canary.v02b9ae0a47871adccfefb247878691b72e25e929, =1.2.0-staging.0, =0.0.1-canary.v20241209160532, =4.2.26-canary.v097a1ce, =0.12.0-canary.v20250325162153, =0.4.2-canary.v097a1ce,...

coxy (>=0.0.2, <=0.0.4), threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2026-42349 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

@aurora-nexus/aurora-nexus-design-system (0.2.0), @fireproof/core-protocols-dashboard (>=0.24.3-dev-20261224, <=0.24.12) +6 more potentially affected by CVE-2026-42349 via @clerk/shared (>=3.36.0, <=3.45.1)

@clerk/shared NPM version =3.36.0, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.0.14, =0.18.25-dev, =0.24.3-dev-20261224, =0.18.25-dev, =0.18.28-dev Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

3am-cli (0.1.0), 3am-diagnosis (0.1.0) +1447 more potentially affected by CVE-2026-41686 via @anthropic-ai/sdk (>=0.79.0, <=0.91.0)

@anthropic-ai/sdk NPM version =0.79.0, =0.5.0, =0.1.0, =1.0.0-alpha, =0.8.4, =0.1.8, =5.0.0, =5.0.0, =0.1.0, =1.3.0-canary.26.1, =1.3.0-canary.26.1, =1.3.0-canary.26.1, =1.6.3 - @adaptic/backend-legacy 0.0.941 and more Source cves: CVE-2026-41686 Source advisory: SNYK:JS-ANTHROPICAISDK-16322960...

@ainsleydev/payload-helper (>=0.0.1, <=0.0.2), @bsct/payload (1.0.0) +89 more potentially affected by CVE-2026-42353 via i18next-http-middleware (>=3.0.2, <=3.9.2)

i18next-http-middleware NPM version =3.0.2, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.0.1, =8.0.0-alpha1, =3.0.0-rc.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.3 and more Source cves: CVE-2026-42353 Source advisory: OSV:GHSA-JFGF-83C5-2C4M...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-44995 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44995 Source advisory: OSV:GHSA-MJ59-H3Q9-GHFH...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-44114 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-44114 Source advisory: OSV:GHSA-HXVM-XJVF-93F3...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-45002 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-45002 Source advisory: SNYK:JS-OPENCLAW-16298048...

@13w/local-rag (2.0.0), @amodalai/cli (>=0.1.0, <=0.1.1) +32 more potentially affected by unknown CVE via @google/gemini-cli (>=0.1.17, <=0.39.0-nightly.20260411.0957f7d3e)

@google/gemini-cli NPM version =0.1.17, =0.1.0, =0.1.5, =0.1.0, =1.0.0, =0.0.17, =0.6.4, =0.0.1, =1.3.0, =0.1.4, =0.1.10, =0.3.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-GOOGLEGEMINICLI-16301693...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16065 more potentially affected by CVE-2026-42044 via axios (>=1.0.0, <=1.15.1)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42044 Source advisory: SNYK:JS-AXIOS-16299921...

@brrinta/uikit (>=0.1.1, <=0.1.8), @dan8oren/mcp-apple-notes (>=1.0.0, <=1.0.2) +12 more potentially affected by CVE-2026-41680 via marked (>=18.0.0, <=18.0.1)

marked NPM version =18.0.0, =0.1.1, =1.0.0, =1.44.0, =2.27.1, =0.2.14, =0.0.4, =2.13.0, =3.0.0-beta.2, =1.0.0-alpha.1, =1.0.0-alpha.4, =2.5.0, =2.6.0 Source cves: CVE-2026-41680 Source advisory: SNYK:JS-MARKED-16298060...

lytx (>=0.3.0, <=0.3.15) potentially affected by CVE-2026-42190 via rwsdk (1.0.0-beta.49)

rwsdk NPM version 1.0.0-beta.49 is affected by a known vulnerability. The following packages have a transitive dependency on rwsdk and may be impacted: - lytx =0.3.0, =0.3.15 Source cves: CVE-2026-42190 Source advisory: SNYK:JS-RWSDK-16318354...

armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)

diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0136...

armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)

diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0137...

armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)

diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0135...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0-beta.7) +13 more potentially affected by CVE-2026-41358 via openclaw (>=2026.3.22, <=2026.4.1)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider 0.1.1 Source cves: CVE-2026-41358 Source advisory: SNYK:JS-OPENCLAW-16206250...

bitcoin-harness (0.1.0), bitcoin_rpc_client (>=0.5.0, <=0.6.1) +65 more potentially affected by CVE-2026-41681 via openssl (>=0.10.40, <=0.10.68)

openssl CARGO version =0.10.40, =0.5.0, =0.2.0, =0.0.1, =0.1.0-alpha.0, =0.1.24, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.1.3, =0.1.10 and more Source cves: CVE-2026-41681 Source advisory: OSV:GHSA-GHM9-CR32-G9QJ...

aesti (>=0.1.0, <=0.3.0), atarashii_imap (0.3.0) +445 more potentially affected by CVE-2026-41898 via openssl (>=0.9.24, <=0.10.68)

openssl CARGO version =0.9.24, =0.1.0, =0.1.0, =0.5.0, =0.2.0, =0.0.0, =0.2.0, =0.0.1, =0.15.0, =0.3.1, =0.0.1, =0.4.0 and more Source cves: CVE-2026-41898 Source advisory: OSV:GHSA-HPPC-G8H3-XHP3...

@marko/compiler (5.0.0-next.0), @marko/translator-default (5.0.0-next.0) +4 more potentially affected by CVE-2026-41591 via marko (>=5.0.0-next.0, <=5.21.7)

marko NPM version =5.0.0-next.0, =2.9.2, =1.15.0, =1.1.4, =1.2.1 Source cves: CVE-2026-41591 Source advisory: SNYK:JS-MARKO-16421453...

locizify (>=7.0.0, <=9.0.9), locizify-ssg (>=1.1.12, <=2.0.6) potentially affected by CVE-2026-41692 via i18nextify (>=4.0.0, <=4.0.7)

i18nextify NPM version =4.0.0, =7.0.0, =1.1.12, =2.0.6 Source cves: CVE-2026-41692 Source advisory: OSV:GHSA-6457-MXPQ-4FQQ...

@ainsleydev/payload-helper (>=0.0.1, <=0.0.2), @bsct/payload (1.0.0) +89 more potentially affected by CVE-2026-41690 via i18next-http-middleware (>=3.0.2, <=3.9.2)

i18next-http-middleware NPM version =3.0.2, =0.0.1, =1.0.1, =0.0.1, =0.0.1, =0.0.1, =8.0.0-alpha1, =3.0.0-rc.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.0.3 and more Source cves: CVE-2026-41690 Source advisory: SNYK:JS-I18NEXTHTTPMIDDLEWARE-16415526...

011xwztpjn (1.0.0), 02y9dg4qm3 (1.0.0) +11513 more potentially affected by CVE-2026-41239 via dompurify (>=1.0.10, <=3.3.3)

dompurify NPM version =1.0.10, =3.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on dompurify and may be impacted: - 011xwztpjn 1.0.0 - 02y9dg4qm3 1.0.0 - 04tw75kmd9 1.0.0 - 0650teqqly 1.0.0 - 097oi25ils 1.0.0 - 0a0fpniotn 1.0.0 - 0c7j76u46q 1.0.0 -...

instructlab-sdg (>=0.0.1rc1, <=0.0.1) potentially affected by CVE-2026-6859 via instructlab (0.17.2)

instructlab PYPI version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on instructlab and may be impacted: - instructlab-sdg =0.0.1rc1, =0.0.1 Source cves: CVE-2026-6859 Source advisory: SNYK:PYTHON-INSTRUCTLAB-16323407...

@saltcorn/cli (>=1.0.0-beta.1, <=1.4.3), @saltcorn/mobile-builder (>=1.0.0-beta.1, <=1.4.3) potentially affected by unknown CVE via @saltcorn/server (>=1.0.0, <=1.4.3)

@saltcorn/server NPM version =1.0.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-16318352...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-16318351...

@acampkin/mcc (>=2.1.0, <=2.5.0), @kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.6.0) +24 more potentially affected by CVE-2026-39861 via @anthropic-ai/claude-code (>=2.0.0, <=2.1.63)

@anthropic-ai/claude-code NPM version =2.0.0, =2.1.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.0.1, =0.4.0, =1.0.29, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =2.0.0 - ch-go 1.0.3 and more Source cves: CVE-2026-39861 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-16191021...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-16109571...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-43585 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-43585 Source advisory: OSV:GHSA-XMXX-7P24-H892...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.5) +21 more potentially affected by CVE-2026-43585 via openclaw (>=2026.3.22, <=2026.4.12)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 - @xmoxmo/bncr 0.0.8 - morpho-vault-manager 0.1.0 and more Source cves: CVE-2026-43585 Source advisory: SNYK:JS-OPENCLAW-16109684...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0) +18 more potentially affected by CVE-2026-43571 via openclaw (>=2026.3.22, <=2026.4.9)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-43571 Source advisory: OSV:GHSA-82QX-6VJ7-P8M2...