@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4), @irshadali/ngx-indexed-db (>=19.3.0, <=19.3.1) +16 more potentially affected by CVE-2026-41423 via @angular/platform-server (>=18.2.13, <=18.2.14)

@angular/platform-server NPM version =18.2.13, =1.0.0, =19.3.0, =0.0.0, =12.0.0, =0.0.0, =1.0.2, =0.0.0, =1.0.0, =0.0.1, =0.0.2 - my-unique-workspace 0.0.0 - my-workspace01 0.0.0 and more Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-41423 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.17) +1 more potentially affected by CVE-2026-41423 via @angular/platform-server (>=20.0.0, <=20.3.18)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-exui-4425, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-exui-4425, <=4.2.17) +1 more potentially affected by CVE-2026-41423 via @angular/platform-server (>=20.0.0, <=20.3.18)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-exui-4425, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-41423 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-16097942...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-41423 via @angular/platform-server (>=21.1.2, <=21.2.0)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-41423 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-16097942...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-41423 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-41423 Source advisory:...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) potentially affected by CVE-2026-41423 via @angular/platform-server (>=21.1.2, <=21.2.0)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.5.11 - foliokit 0.0.0 Source cves: CVE-2026-41423 Source advisory: OSV:GHSA-45Q2-GJVG-7973...

org.webjars.npm:bazel__typescript (1.7.0), org.webjars.npm:cesium (>=1.96.0, <=1.144.0) +13 more potentially affected by CVE-2026-41242 via org.webjars.npm:protobufjs (>=6.8.8, <=8.7.2)

org.webjars.npm:protobufjs MAVEN version =6.8.8, =1.96.0, =1.0.0, =1.0.0, =10.13.0, =4.7.0, =0.3.35, =1.6.1, =0.5.2, =0.7.15 - org.webjars.npm:tiktok-live-connector 1.0.2 Source cves: CVE-2026-41242 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16094666...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3354 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-41242 Source advisory: OSV:GHSA-XQ3M-2V4X-88GG...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @42zeroo/tescik (>=1.0.0, <=1.1.1963) +709 more potentially affected by CVE-2026-41242 via protobufjs (8.0.0)

protobufjs NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs and may be impacted: - @0xchain/telemetry =1.1.0-beta.8, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 - @adaptic/backend-legacy 0.0.941 and more...

2mxdev-gql-gateway (1.0.0), 4m-node-server (>=0.0.1, <=0.0.8) +2886 more potentially affected by CVE-2026-41242 via @apollo/protobufjs (>=1.1.0, <=1.2.7)

@apollo/protobufjs NPM version =1.1.0, =0.0.1, =1.0.2, =3.10.1, =1.2.0-pre.24, =1.0.1, =1.0.0, =1.0.0, =0.5.0, =1.0.0, =0.0.1, =0.1.1, =0.0.1, =1.0.7, =1.0.17 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-APOLLOPROTOBUFJS-16321047...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @42zeroo/tescik (>=1.0.0, <=1.1.1963) +709 more potentially affected by CVE-2026-41242 via protobufjs (8.0.0)

protobufjs NPM version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs and may be impacted: - @0xchain/telemetry =1.1.0-beta.8, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 - @adaptic/backend-legacy 0.0.941 and more...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3354 more potentially affected by CVE-2026-41242 via protobufjs (>=7.0.0, <=7.5.4)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...

3id-test-helper (>=1.0.0, <=1.0.4), @00ssh/erdnest (>=0.2.19, <=0.2.23) +3579 more potentially affected by CVE-2026-41242 via protobufjs (>=6.8.0, <=6.11.4)

protobufjs NPM version =6.8.0, =1.0.0, =0.2.19, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =2.1.0, =0.0.8-alpha.0, =0.1.0, =0.1.8-fix.3, =0.0.2, =0.0.1, =0.0.14 - @account-coddle/pokerfire 0.0.1 and more Source cves: CVE-2026-41242 Source advisory: SNYK:JS-PROTOBUFJS-16094665...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +750 more potentially affected by CVE-2026-6410 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0-beta.23, =1.0.3 and more Source cves: CVE-2026-6410 Source advisory: OSV:GHSA-PR96-94W5-MX2H...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +750 more potentially affected by CVE-2026-6414 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0-beta.23, =1.0.3 and more Source cves: CVE-2026-6414 Source advisory: OSV:GHSA-X428-GHPX-8J92...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-6270 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-6270 Source advisory: SNYK:JS-FASTIFYMIDDIE-16098213...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-6270 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-6270 Source advisory: OSV:GHSA-72C6-FX6Q-FR5W...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-33804 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-33804 Source advisory: SNYK:JS-FASTIFYMIDDIE-16098212...

@bechara/crux (>=6.0.0-alpha.1, <=6.6.2), @cappa/cli (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-33804 via @fastify/middie (>=9.0.2, <=9.3.1)

@fastify/middie NPM version =9.0.2, =6.0.0-alpha.1, =0.1.0, =0.1.0, =1.0.0-develop-pedago.0, =1.0.11, =0.1.51, =1.0.36, =11.0.0-next.1, =1.3.0, =5.0.0-beta.36, =0.6.1-dev, =1.1.63 Source cves: CVE-2026-33804 Source advisory: OSV:GHSA-V9WW-2J6R-98Q6...

flowise (>=2.0.0, <=2.2.8) potentially affected by CVE-2026-41274 via flowise-components (2.2.8)

flowise-components NPM version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on flowise-components and may be impacted: - flowise =2.0.0, =2.2.8 Source cves: CVE-2026-41274 Source advisory: SNYK:JS-FLOWISECOMPONENTS-16111007...

copilot-studio-datainsight (>=0.0.1, <=0.0.6), flowise (>=1.6.1, <=2.2.8) potentially affected by CVE-2026-41138 via flowise-components (>=1.3.4, <=2.2.8)

flowise-components NPM version =1.3.4, =0.0.1, =1.6.1, =2.2.8 Source cves: CVE-2026-41138 Source advisory: SNYK:JS-FLOWISECOMPONENTS-16110988...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-apify (0.2.1) +26 more potentially affected by CVE-2026-41324 via basic-ftp (>=5.0.2, <=5.2.2)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =1.0.5 - @neurarank/node-sftp 0.4.3 and more Source cves: CVE-2026-41324 Source advisory: SNYK:JS-BASICFTP-16094986...

@activeboxes/piece-sftp (0.2.6), @activepieces/piece-apify (0.2.1) +26 more potentially affected by CVE-2026-41324 via basic-ftp (>=5.0.2, <=5.2.2)

basic-ftp NPM version =5.0.2, =0.2.6, =1.0.0, =1.0.0, =2.0.18, =1.9.2, =1.2.0, =4.6.0-blowfish, =1.0.3, =1.0.4, =1.0.5 - @neurarank/node-sftp 0.4.3 and more Source cves: CVE-2026-41324 Source advisory: OSV:GHSA-RP42-5VXX-QPWR...

3m (>=0.1.0, <=0.1.3), a2d-diary (>=0.1.0, <=0.1.5) +1795 more potentially affected by CVE-2026-41314 via pypdf2 (>=1.24.0, <=3.0.1)

pypdf2 PYPI version =1.24.0, =0.1.0, =0.1.0, =1.1.0, =0.1.32, =0.0.0.1, =0.0.1.44, =0.0.1, =0.2.2.716, =0.1.4, =1.0.3, =0.1.3, =0.2.0, =0.4.2 - adame 0.2.2 and more Source cves: CVE-2026-41314 Source advisory: SNYK:PYTHON-PYPDF2-16097900...

3m (>=0.1.0, <=0.1.3), a2d-diary (>=0.1.0, <=0.1.5) +1795 more potentially affected by CVE-2026-41313 via pypdf2 (>=1.24.0, <=3.0.1)

pypdf2 PYPI version =1.24.0, =0.1.0, =0.1.0, =1.1.0, =0.1.32, =0.0.0.1, =0.0.1.44, =0.0.1, =0.2.2.716, =0.1.4, =1.0.3, =0.1.3, =0.2.0, =0.4.2 - adame 0.2.2 and more Source cves: CVE-2026-41313 Source advisory: SNYK:PYTHON-PYPDF2-16097904...

3m (>=0.1.0, <=0.1.3), a2d-diary (>=0.1.0, <=0.1.5) +1795 more potentially affected by CVE-2026-41312 via pypdf2 (>=1.24.0, <=3.0.1)

pypdf2 PYPI version =1.24.0, =0.1.0, =0.1.0, =1.1.0, =0.1.32, =0.0.0.1, =0.0.1.44, =0.0.1, =0.2.2.716, =0.1.4, =1.0.3, =0.1.3, =0.2.0, =0.4.2 - adame 0.2.2 and more Source cves: CVE-2026-41312 Source advisory: SNYK:PYTHON-PYPDF2-16097902...

@aurora-nexus/aurora-nexus-design-system (0.2.0), @fireproof/core-protocols-dashboard (>=0.24.3-dev-20261224, <=0.24.12) +6 more potentially affected by CVE-2026-41248 via @clerk/shared (>=3.36.0, <=3.45.1)

@clerk/shared NPM version =3.36.0, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.24.3-dev-20261224, =0.0.14, =0.18.25-dev, =0.24.3-dev-20261224, =0.18.25-dev, =0.18.28-dev Source cves: CVE-2026-41248 Source advisory: OSV:GHSA-VQX2-FGX2-5WQ9...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.14-snapshot.v20260414205636), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.14-snapshot.v20260414205636) +43 more potentially affected by CVE-2026-41248 via @clerk/shared (>=4.0.0, <=4.8.0-snapshot.v20260414205636)

@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...

@bentwnghk/chat (>=1.45.5, <=1.45.6), @clerk/elements (0.0.2-snapshot.vc65ad98) +2 more potentially affected by CVE-2026-41248 via @clerk/nextjs (>=5.0.1-snapshot.vc65ad98, <=5.7.5)

@clerk/nextjs NPM version =5.0.1-snapshot.vc65ad98, =1.45.5, =1.2.8, =1.2.9 - @spike-npm-land/code 0.9.55 Source cves: CVE-2026-41248 Source advisory: OSV:GHSA-VQX2-FGX2-5WQ9...

@bentwnghk/chat (>=1.91.2, <=1.91.6), @lobehub/chat (>=1.49.5, <=1.49.12) +2 more potentially affected by CVE-2026-41248 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =1.91.2, =1.49.5, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-41248 Source advisory: OSV:GHSA-VQX2-FGX2-5WQ9...

@bentwnghk/chat (>=1.91.2, <=1.91.6), @lobehub/chat (>=1.49.5, <=1.49.12) +2 more potentially affected by CVE-2026-41248 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =1.91.2, =1.49.5, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-41248 Source advisory: SNYK:JS-CLERKNEXTJS-16098250...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.14-snapshot.v20260414205636), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.14-snapshot.v20260414205636) +43 more potentially affected by CVE-2026-41248 via @clerk/shared (>=4.0.0, <=4.8.0-snapshot.v20260414205636)

@clerk/shared NPM version =4.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =3.0.0-snapshot.v20251216175437, =3.0.0-canary.v20251211104600, =0.4.26-snapshot.v20260226165729, =2.0.0-canary.v20251211104600,...

@bentwnghk/chat (>=1.45.5, <=1.45.6), @clerk/elements (0.0.2-snapshot.vc65ad98) +2 more potentially affected by CVE-2026-41248 via @clerk/nextjs (>=5.0.1-snapshot.vc65ad98, <=5.7.5)

@clerk/nextjs NPM version =5.0.1-snapshot.vc65ad98, =1.45.5, =1.2.8, =1.2.9 - @spike-npm-land/code 0.9.55 Source cves: CVE-2026-41248 Source advisory: SNYK:JS-CLERKNEXTJS-16098250...

flowise (>=1.6.1, <=2.2.8) potentially affected by unknown CVE via flowise-components (>=1.8.6, <=2.2.8)

flowise-components NPM version =1.8.6, =1.6.1, =2.2.8 Source cves: unknown CVE Source advisory: SNYK:JS-FLOWISECOMPONENTS-16115272...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0) +18 more potentially affected by CVE-2026-43529 via openclaw (>=2026.3.22, <=2026.4.9)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-43529 Source advisory: SNYK:JS-OPENCLAW-16098254...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (>=0.8.3-beta.1, <=0.9.0) +18 more potentially affected by CVE-2026-43529 via openclaw (>=2026.3.22, <=2026.4.9)

openclaw NPM version =2026.3.22, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =4.2.0 - openclaw-chatclaw 0.1.0 and more Source cves: CVE-2026-43529 Source advisory: OSV:GHSA-GJ9Q-8W99-MP8J...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3743 more potentially affected by unknown CVE via rustls-webpki (>=0.101.7, <=0.102.8)

rustls-webpki CARGO version =0.101.7, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XGP8-3HG3-C2MH...

a11ywatch_cli (>=0.0.26, <=0.7.16), aap (>=0.4.0, <=0.4.1) +3743 more potentially affected by unknown CVE via rustls-webpki (>=0.101.7, <=0.102.8)

rustls-webpki CARGO version =0.101.7, =0.0.26, =0.4.0, =0.1.0, =0.21.0-alpha.1, =0.1.11, =0.12.1, =0.2.0, =0.5.1, =0.0.1, =0.1.0, =0.1.0-beta.1, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-965H-392X-2MH5...

@appwise/oauth2-server (>=0.0.19, <=0.2.2), @dyne/slangroom-chain (>=1.4.0, <=1.16.10) +4 more potentially affected by CVE-2026-41213 via @node-oauth/oauth2-server (>=5.0.0, <=5.2.1)

@node-oauth/oauth2-server NPM version =5.0.0, =0.0.19, =1.4.0, =1.3.0, =1.49.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-41213 Source advisory: OSV:GHSA-JHM7-29PJ-4XVF...

@appwise/oauth2-server (>=0.0.19, <=0.2.2), @dyne/slangroom-chain (>=1.4.0, <=1.16.10) +4 more potentially affected by CVE-2026-41213 via @node-oauth/oauth2-server (>=5.0.0, <=5.2.1)

@node-oauth/oauth2-server NPM version =5.0.0, =0.0.19, =1.4.0, =1.3.0, =1.49.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-41213 Source advisory: SNYK:JS-NODEOAUTHOAUTH2SERVER-16420261...

@reldens/server-utils (0.48.0), @sap-ux/ui-components (>=2.1.4, <=2.1.10) +11 more potentially affected by CVE-2026-40186 via sanitize-html (2.17.2)

sanitize-html NPM version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @reldens/server-utils 0.48.0 - @sap-ux/ui-components =2.1.4, =0.6.17, =0.3.16, =0.1.32, =0.0.31, =0.30.19, =1.0.0-alpha.5, =0.19.3,...

@aumoai/mcp-data-analyst (>=0.1.0, <=0.2.8), @geobio/code_execution_server (>=0.2.0, <=0.2.1) +35 more potentially affected by CVE-2026-39313 via mcp-framework (>=0.1.27, <=0.2.15)

mcp-framework NPM version =0.1.27, =0.1.0, =0.2.0, =1.0.11, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves: CVE-2026-39313 Source advisory: OSV:GHSA-353C-V8X9-V7C3...

@aumoai/mcp-data-analyst (>=0.1.0, <=0.2.8), @geobio/code_execution_server (>=0.2.0, <=0.2.1) +35 more potentially affected by CVE-2026-39313 via mcp-framework (>=0.1.27, <=0.2.15)

mcp-framework NPM version =0.1.27, =0.1.0, =0.2.0, =1.0.11, =0.2.0, =0.2.0, =0.0.1, =0.0.4 and more Source cves: CVE-2026-39313 Source advisory: SNYK:JS-MCPFRAMEWORK-16420257...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +750 more potentially affected by CVE-2026-6410 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0-beta.23, =1.0.3 and more Source cves: CVE-2026-6410 Source advisory: SNYK:JS-FASTIFYSTATIC-16098211...

@13w/local-rag (>=1.6.0, <=1.7.2), @24letters/devservers (>=0.1.0, <=0.6.0) +750 more potentially affected by CVE-2026-6414 via @fastify/static (>=8.0.0, <=9.1.0)

@fastify/static NPM version =8.0.0, =1.6.0, =0.1.0, =0.1.0, =0.4.0, =0.1.0-rc.1, =0.1.0, =1.1.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =1.0.0-beta.23, =1.0.3 and more Source cves: CVE-2026-6414 Source advisory: SNYK:JS-FASTIFYSTATIC-16098210...

@secustor/backstage-plugin-renovate-backend-module-runtime-direct (4.0.1) potentially affected by unknown CVE via renovate (43.77.2)

renovate NPM version 43.77.2 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 4.0.1 Source cves: unknown CVE Source advisory: SNYK:JS-RENOVATE-16083197...

@secustor/backstage-plugin-renovate-backend-module-runtime-direct (4.0.1) potentially affected by CVE-2026-76226 via renovate (43.77.2)

renovate NPM version 43.77.2 is affected by a known vulnerability. The following packages have a transitive dependency on renovate and may be impacted: - @secustor/backstage-plugin-renovate-backend-module-runtime-direct 4.0.1 Source cves: CVE-2026-76226 Source advisory: OSV:GHSA-5VJQ-5JMG-39XQ...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +3205 more potentially affected by CVE-2026-41182 via langsmith (>=0.0.5, <=0.5.4)

langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2026-41182 Source advisory: OSV:GHSA-RR7J-V2Q5-CHGV...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +3205 more potentially affected by CVE-2026-41182 via langsmith (>=0.0.5, <=0.5.4)

langsmith NPM version =0.0.5, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2026-41182 Source advisory: SNYK:JS-LANGSMITH-16082039...