@openrewrite/recipes-nodejs 0.47.0-20260630-173749 → 0.47.2

package/dist/migrate/increase-node-engine-version.d.ts

@@ -2,12 +2,12 @@ import { ExecutionContext, Recipe, TreeVisitor } from "@openrewrite/rewrite";
 export declare class IncreaseNodeEngineVersion extends Recipe {
     readonly name = "org.openrewrite.node.migrate.increase-node-engine-version";
     readonly displayName = "Increase Node.js engine version";
-    readonly description = "Increases the upper bound of the `engines.node` version range in package.json to allow the specified Node.js version.";
+    readonly description: string;
     version: string;
     constructor(options: {
         version: string;
     });
     editor(): Promise<TreeVisitor<any, ExecutionContext>>;
 }
-export declare function increaseUpperBound(range: string, targetVersion: number): string;
+export declare function raiseMinimumVersion(range: string, targetVersion: number): string;
 //# sourceMappingURL=increase-node-engine-version.d.ts.map

package/dist/migrate/increase-node-engine-version.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"increase-node-engine-version.d.ts","sourceRoot":"","sources":["../../src/migrate/increase-node-engine-version.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,gBAAgB,EAAU,MAAM,EAAgB,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAIjG,qBAAa,yBAA0B,SAAQ,MAAM;IACjD,QAAQ,CAAC,IAAI,+DAA+D;IAC5E,QAAQ,CAAC,WAAW,qCAAqC;IACzD,QAAQ,CAAC,WAAW,2HAA2H;IAQ/I,OAAO,EAAG,MAAM,CAAC;gBAEL,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;IAKlC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;CA2C9D;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CA+D/E"}
+{"version":3,"file":"increase-node-engine-version.d.ts","sourceRoot":"","sources":["../../src/migrate/increase-node-engine-version.ts"],"names":[],"mappings":"AAMA,OAAO,EAAC,gBAAgB,EAAU,MAAM,EAAgB,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAIjG,qBAAa,yBAA0B,SAAQ,MAAM;IACjD,QAAQ,CAAC,IAAI,+DAA+D;IAC5E,QAAQ,CAAC,WAAW,qCAAqC;IACzD,QAAQ,CAAC,WAAW,SAGY;IAQhC,OAAO,EAAG,MAAM,CAAC;gBAEL,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;IAKlC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;CAgD9D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAwDhF"}

package/dist/migrate/increase-node-engine-version.js

@@ -49,7 +49,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IncreaseNodeEngineVersion = void 0;
-exports.increaseUpperBound = increaseUpperBound;
+exports.raiseMinimumVersion = raiseMinimumVersion;
 const rewrite_1 = require("@openrewrite/rewrite");
 const json_1 = require("@openrewrite/rewrite/json");
 const semver = __importStar(require("semver"));
@@ -58,7 +58,10 @@ class IncreaseNodeEngineVersion extends rewrite_1.Recipe {
         super();
         this.name = "org.openrewrite.node.migrate.increase-node-engine-version";
         this.displayName = "Increase Node.js engine version";
-        this.description = "Increases the upper bound of the `engines.node` version range in package.json to allow the specified Node.js version.";
+        this.description = "Raises the lower bound of the `engines.node` version range in package.json to the specified " +
+            "Node.js version, performing a hard cutover that drops support for older, end-of-life versions " +
+            "(`22.x` → `24.x`, `>= 22` → `>= 24`). The original constraint style is preserved where possible and the " +
+            "version is never lowered.";
         this.version = options.version;
     }
     editor() {
@@ -83,12 +86,15 @@ class IncreaseNodeEngineVersion extends rewrite_1.Recipe {
                         if (typeof nodeRange !== 'string') {
                             return doc;
                         }
-                        const updatedRange = increaseUpperBound(nodeRange, targetVersion);
+                        const updatedRange = raiseMinimumVersion(nodeRange, targetVersion);
                         if (updatedRange === nodeRange) {
                             return doc;
                         }
-                        packageJson.engines.node = updatedRange;
-                        const modifiedContent = JSON.stringify(packageJson, null, 2);
+                        const nodeMemberRegex = /("engines"\s*:\s*\{[\s\S]*?"node"\s*:\s*)"([^"]+)"/;
+                        const modifiedContent = content.replace(nodeMemberRegex, `$1${JSON.stringify(updatedRange)}`);
+                        if (modifiedContent === content) {
+                            return doc;
+                        }
                         const parsed = yield new json_1.JsonParser({}).parseOne({
                             text: modifiedContent,
                             sourcePath: doc.sourcePath
@@ -109,56 +115,56 @@ __decorate([
         example: "22"
     })
 ], IncreaseNodeEngineVersion.prototype, "version", void 0);
-function increaseUpperBound(range, targetVersion) {
+function raiseMinimumVersion(range, targetVersion) {
+    const trimmed = range.trim();
+    let minVersion = null;
     try {
-        if (semver.satisfies(`${targetVersion}.0.0`, range)) {
-            return range;
-        }
+        minVersion = semver.minVersion(trimmed);
     }
     catch (_a) {
     }
-    const hyphenMatch = range.match(/^(.+\s+-\s+)(\d+)(\.0\.0)?$/);
-    if (hyphenMatch) {
-        return `${hyphenMatch[1]}${targetVersion}${hyphenMatch[3] || ''}`;
+    if (minVersion && minVersion.major >= targetVersion) {
+        return range;
     }
-    if (range.includes('||') && !/[<>]/.test(range)) {
-        const separatorMatch = range.match(/(\s*\|\|\s*)/);
-        const separator = separatorMatch ? separatorMatch[1] : ' || ';
-        const lastPart = range.split(/\s*\|\|\s*/).pop().trim();
-        let newPart;
-        if (lastPart.startsWith('^')) {
-            newPart = `^${targetVersion}`;
-        }
-        else if (lastPart.startsWith('~')) {
-            newPart = `~${targetVersion}`;
-        }
-        else if (lastPart.endsWith('.x')) {
-            newPart = `${targetVersion}.x`;
-        }
-        else {
-            newPart = `${targetVersion}`;
+    if (trimmed.includes('||') && !/[<>]/.test(trimmed)) {
+        const parts = trimmed.split(/\s*\|\|\s*/).map(p => p.trim());
+        const kept = parts.filter(p => {
+            try {
+                const m = semver.minVersion(p);
+                return m !== null && m.major >= targetVersion;
+            }
+            catch (_a) {
+                return false;
+            }
+        });
+        if (kept.length > 0) {
+            return kept.join(' || ');
         }
-        return `${range}${separator}${newPart}`;
-    }
-    const upperBoundRegex = /(?<!>)(<=?)(\d+)(\.0\.0)?(?=[^<]*$)/;
-    const upperMatch = range.match(upperBoundRegex);
-    if (upperMatch) {
-        const op = upperMatch[1];
-        const suffix = upperMatch[3] || '';
-        const newMajor = op === '<' ? targetVersion + 1 : targetVersion;
-        return range.replace(upperBoundRegex, `${op}${newMajor}${suffix}`);
+        return floorTerm(parts[parts.length - 1], targetVersion);
     }
-    const caretMatch = range.match(/^\^(\d+)(\.0\.0)?$/);
-    if (caretMatch) {
-        return `${range} || ^${targetVersion}${caretMatch[2] || ''}`;
-    }
-    const tildeMatch = range.match(/^~(\d+)(\.0\.0)?$/);
-    if (tildeMatch) {
-        return `${range} || ~${targetVersion}${tildeMatch[2] || ''}`;
+    const hyphenMatch = trimmed.match(/^(.+?)\s+-\s+(.+)$/);
+    if (hyphenMatch) {
+        const upper = hyphenMatch[2].trim();
+        const upperMajor = parseInt(upper, 10);
+        if (!Number.isNaN(upperMajor) && upperMajor < targetVersion) {
+            return `>=${targetVersion}`;
+        }
+        return `${targetVersion} - ${upper}`;
     }
-    if (/^\d+\.x$/.test(range)) {
-        return `${range} || ${targetVersion}.x`;
+    if (/</.test(trimmed)) {
+        const upperMatch = trimmed.match(/(<=?)\s*(\d+)(?:\.\d+)*/);
+        let upper = '';
+        if (upperMatch) {
+            const op = upperMatch[1];
+            const upperMajor = parseInt(upperMatch[2], 10);
+            const admitsTarget = op === '<=' ? upperMajor >= targetVersion : upperMajor > targetVersion;
+            upper = admitsTarget ? ` ${op}${upperMatch[2]}` : '';
+        }
+        return `>=${targetVersion}${upper}`;
     }
-    return range;
+    return floorTerm(trimmed, targetVersion);
+}
+function floorTerm(part, targetVersion) {
+    return part.replace(/\d+/, String(targetVersion));
 }
 //# sourceMappingURL=increase-node-engine-version.js.map

package/dist/migrate/increase-node-engine-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"increase-node-engine-version.js","sourceRoot":"","sources":["../../src/migrate/increase-node-engine-version.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyEA,gDA+DC;AAlID,kDAAiG;AACjG,oDAAwE;AACxE,+CAAiC;AAEjC,MAAa,yBAA0B,SAAQ,gBAAM;IAajD,YAAY,OAA4B;QACpC,KAAK,EAAE,CAAC;QAbH,SAAI,GAAG,2DAA2D,CAAC;QACnE,gBAAW,GAAG,iCAAiC,CAAC;QAChD,gBAAW,GAAG,uHAAuH,CAAC;QAY3I,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACnC,CAAC;IAEK,MAAM;;YACR,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAEjD,OAAO,IAAI,KAAM,SAAQ,kBAA6B;gBAClC,aAAa,CAAC,GAAkB,EAAE,IAAsB;;;wBACpE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;4BAC3C,OAAO,GAAG,CAAC;wBACf,CAAC;wBAED,MAAM,OAAO,GAAG,MAAM,sBAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAC9C,IAAI,WAAgC,CAAC;wBACrC,IAAI,CAAC;4BACD,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBACtC,CAAC;wBAAC,WAAM,CAAC;4BACL,OAAO,GAAG,CAAC;wBACf,CAAC;wBAED,MAAM,SAAS,GAAG,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,OAAO,0CAAE,IAAI,CAAC;wBAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;4BAChC,OAAO,GAAG,CAAC;wBACf,CAAC;wBAED,MAAM,YAAY,GAAG,kBAAkB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;wBAClE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;4BAC7B,OAAO,GAAG,CAAC;wBACf,CAAC;wBAED,WAAW,CAAC,OAAO,CAAC,IAAI,GAAG,YAAY,CAAC;wBACxC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;wBAE7D,MAAM,MAAM,GAAG,MAAM,IAAI,iBAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;4BAC7C,IAAI,EAAE,eAAe;4BACrB,UAAU,EAAE,GAAG,CAAC,UAAU;yBAC7B,CAAkB,CAAC;wBAEpB,OAAO,gCACA,GAAG,KACN,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,GAAG,EAAE,MAAM,CAAC,GAAG,GACD,CAAC;oBACvB,CAAC;iBAAA;aACJ,CAAC;QACN,CAAC;KAAA;CACJ;AA7DD,8DA6DC;AAlDG;IANC,IAAA,gBAAM,EAAC;QACJ,WAAW,EAAE,SAAS;QACtB,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KAChB,CAAC;0DACe;AAoDrB,SAAgB,kBAAkB,CAAC,KAAa,EAAE,aAAqB;IACnE,IAAI,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,aAAa,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IAAC,WAAM,CAAC;IAET,CAAC;IAGD,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,IAAI,WAAW,EAAE,CAAC;QACd,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACtE,CAAC;IAGD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACnD,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,EAAG,CAAC,IAAI,EAAE,CAAC;QAEzD,IAAI,OAAe,CAAC;QACpB,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;QAClC,CAAC;aAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,OAAO,GAAG,IAAI,aAAa,EAAE,CAAC;QAClC,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,OAAO,GAAG,GAAG,aAAa,IAAI,CAAC;QACnC,CAAC;aAAM,CAAC;YACJ,OAAO,GAAG,GAAG,aAAa,EAAE,CAAC;QACjC,CAAC;QAED,OAAO,GAAG,KAAK,GAAG,SAAS,GAAG,OAAO,EAAE,CAAC;IAC5C,CAAC;IAGD,MAAM,eAAe,GAAG,qCAAqC,CAAC;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,UAAU,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;QAChE,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAGD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACrD,IAAI,UAAU,EAAE,CAAC;QACb,OAAO,GAAG,KAAK,QAAQ,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IAGD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACpD,IAAI,UAAU,EAAE,CAAC;QACb,OAAO,GAAG,KAAK,QAAQ,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACjE,CAAC;IAGD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,KAAK,OAAO,aAAa,IAAI,CAAC;IAC5C,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC"}
+{"version":3,"file":"increase-node-engine-version.js","sourceRoot":"","sources":["../../src/migrate/increase-node-engine-version.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiFA,kDAwDC;AAnID,kDAAiG;AACjG,oDAAwE;AACxE,+CAAiC;AAEjC,MAAa,yBAA0B,SAAQ,gBAAM;IAgBjD,YAAY,OAA4B;QACpC,KAAK,EAAE,CAAC;QAhBH,SAAI,GAAG,2DAA2D,CAAC;QACnE,gBAAW,GAAG,iCAAiC,CAAC;QAChD,gBAAW,GAAG,8FAA8F;YACjH,gGAAgG;YAChG,0GAA0G;YAC1G,2BAA2B,CAAC;QAY5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACnC,CAAC;IAEK,MAAM;;YACR,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAEjD,OAAO,IAAI,KAAM,SAAQ,kBAA6B;gBAClC,aAAa,CAAC,GAAkB,EAAE,IAAsB;;;wBACpE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;4BAC3C,OAAO,GAAG,CAAC;wBACf,CAAC;wBAED,MAAM,OAAO,GAAG,MAAM,sBAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAC9C,IAAI,WAAgC,CAAC;wBACrC,IAAI,CAAC;4BACD,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;wBACtC,CAAC;wBAAC,WAAM,CAAC;4BACL,OAAO,GAAG,CAAC;wBACf,CAAC;wBAED,MAAM,SAAS,GAAG,MAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,OAAO,0CAAE,IAAI,CAAC;wBAC7C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;4BAChC,OAAO,GAAG,CAAC;wBACf,CAAC;wBAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;wBACnE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;4BAC7B,OAAO,GAAG,CAAC;wBACf,CAAC;wBAID,MAAM,eAAe,GAAG,oDAAoD,CAAC;wBAC7E,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;wBAC9F,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;4BAC9B,OAAO,GAAG,CAAC;wBACf,CAAC;wBAED,MAAM,MAAM,GAAG,MAAM,IAAI,iBAAU,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;4BAC7C,IAAI,EAAE,eAAe;4BACrB,UAAU,EAAE,GAAG,CAAC,UAAU;yBAC7B,CAAkB,CAAC;wBAEpB,OAAO,gCACA,GAAG,KACN,KAAK,EAAE,MAAM,CAAC,KAAK,EACnB,GAAG,EAAE,MAAM,CAAC,GAAG,GACD,CAAC;oBACvB,CAAC;iBAAA;aACJ,CAAC;QACN,CAAC;KAAA;CACJ;AArED,8DAqEC;AAvDG;IANC,IAAA,gBAAM,EAAC;QACJ,WAAW,EAAE,SAAS;QACtB,WAAW,EAAE,oDAAoD;QACjE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;KAChB,CAAC;0DACe;AAyDrB,SAAgB,mBAAmB,CAAC,KAAa,EAAE,aAAqB;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,UAAU,GAAyB,IAAI,CAAC;IAC5C,IAAI,CAAC;QACD,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,WAAM,CAAC;IAET,CAAC;IACD,IAAI,UAAU,IAAI,UAAU,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACjB,CAAC;IAID,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YAC1B,IAAI,CAAC;gBACD,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAC/B,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC;YAClD,CAAC;YAAC,WAAM,CAAC;gBACL,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC7D,CAAC;IAGD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxD,IAAI,WAAW,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,aAAa,EAAE,CAAC;YAC1D,OAAO,KAAK,aAAa,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,GAAG,aAAa,MAAM,KAAK,EAAE,CAAC;IACzC,CAAC;IAGD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC5D,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,YAAY,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,UAAU,GAAG,aAAa,CAAC;YAC5F,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,KAAK,aAAa,GAAG,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,OAAO,SAAS,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,aAAqB;IAClD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/resources/advisories-npm.csv

@@ -910,7 +910,7 @@ CVE-2019-15602,2020-04-01T16:36:15Z,"Cross-Site Scripting in fileview",fileview,
 CVE-2019-15603,2020-04-01T16:36:31Z,"Cross-Site Scripting in seeftl",seeftl,0,,0.1.1,HIGH,CWE-79,
 CVE-2019-15607,2020-01-30T21:00:21Z,"Cross-Site Scripting in node-red",node-red,0,0.20.8,,MODERATE,CWE-79,
 CVE-2019-15608,2022-02-09T22:49:38Z,"TOCTOU Race Condition in Yarn",yarn,0,1.19.0,,MODERATE,CWE-367,
-CVE-2019-15609,2022-02-10T20:20:31Z,"OS Command Injection and Command Injection in kill-port-process",kill-port-process,0,2.2.0,,CRITICAL,CWE-78;CWE-77,
+CVE-2019-15609,2022-02-10T20:20:31Z,"OS Command Injection and Command Injection in kill-port-process",kill-port-process,0,2.2.0,,CRITICAL,CWE-77;CWE-78,
 CVE-2019-15657,2019-08-26T16:59:56Z,"Arbitrary Code Execution in eslint-utils",eslint-utils,1.2.0,1.4.1,,CRITICAL,CWE-20,
 CVE-2019-15658,2019-08-26T16:59:45Z,"SQL Injection in connect-pg-simple",connect-pg-simple,0,6.0.1,,HIGH,CWE-89,
 CVE-2019-15782,2019-09-04T10:02:50Z,"Cross-Site Scripting in webtorrent",webtorrent,0,0.107.6,,MODERATE,CWE-79,
@@ -1953,9 +1953,9 @@ CVE-2021-41720,2021-12-03T20:37:32Z,"Withdrawn: Arbitrary code execution in loda
 CVE-2021-42057,2022-05-24T19:19:42Z,"Obsidian Dataview vulnerable to code injection due to unsafe eval",obsidian-dataview,0,0.4.13,,HIGH,CWE-94,
 CVE-2021-42227,2021-10-18T19:44:32Z,"Cross site scripting in kindeditor",kindeditor,0,,4.1.12,MODERATE,CWE-79,
 CVE-2021-42228,2021-10-18T19:44:06Z,"Cross Site Request Forgery in kindeditor",kindeditor,0,,4.1.12,HIGH,CWE-352,
-CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,0.7.29,0.7.30,,HIGH,CWE-829;CWE-912,
-CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,0.8.0,0.8.1,,HIGH,CWE-829;CWE-912,
-CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,1.0.0,1.0.1,,HIGH,CWE-829;CWE-912,
+CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,0.7.29,0.7.30,,HIGH,CWE-506;CWE-912,
+CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,0.8.0,0.8.1,,HIGH,CWE-506;CWE-912,
+CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,1.0.0,1.0.1,,HIGH,CWE-506;CWE-912,
 CVE-2021-4231,2022-05-27T00:01:08Z,"Angular vulnerable to Cross-site Scripting",@angular/core,0,10.2.5,,MODERATE,CWE-79,
 CVE-2021-4231,2022-05-27T00:01:08Z,"Angular vulnerable to Cross-site Scripting",@angular/core,11.0.0,11.0.5,,MODERATE,CWE-79,
 CVE-2021-4231,2022-05-27T00:01:08Z,"Angular vulnerable to Cross-site Scripting",@angular/core,11.1.0-next.0,11.1.0-next.3,,MODERATE,CWE-79,
@@ -3664,7 +3664,7 @@ CVE-2025-1398,2025-03-17T15:31:50Z,"Mattermost Desktop App allows the bypass of
 CVE-2025-14284,2025-12-09T18:30:35Z,"@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)",@tiptap/extension-link,0,2.10.4,,LOW,CWE-79,
 CVE-2025-14505,2026-01-08T21:30:34Z,"Elliptic Uses a Cryptographic Primitive with a Risky Implementation",elliptic,0,,6.6.1,LOW,CWE-1240,
 CVE-2025-1467,2025-02-23T18:30:24Z,"tarteaucitron Cross-site Scripting (XSS)",tarteaucitronjs,0,1.17.0,,LOW,CWE-79,
-CVE-2025-14874,2025-12-01T20:44:25Z,"Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls",nodemailer,0,7.0.11,,HIGH,CWE-703,
+CVE-2025-14874,2025-12-01T20:44:25Z,"Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls",nodemailer,3.0.0,7.0.11,,HIGH,CWE-703,
 CVE-2025-15104,2026-01-16T15:31:25Z,"Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability",vnu-jar,0,,26.1.11,MODERATE,CWE-918,
 CVE-2025-1520,2025-04-23T18:30:58Z,"PostHog Plugin Server SQL Injection Vulnerability",@posthog/plugin-server,0,,1.10.7,HIGH,CWE-89,
 CVE-2025-15265,2026-01-15T20:13:33Z,"svelte vulnerable to Cross-site Scripting",svelte,5.46.0,5.46.4,,MODERATE,CWE-79,
@@ -4524,17 +4524,24 @@ CVE-2025-9862,2025-09-15T20:31:14Z,"Ghost vulnerable to Server Side Request Forg
 CVE-2025-9910,2025-09-11T06:30:23Z,"jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin",jsondiffpatch,0,0.7.2,,MODERATE,CWE-79,
 CVE-2026-0540,2026-03-03T18:31:33Z,"DOMPurify contains a Cross-site Scripting vulnerability",dompurify,2.5.3,2.5.9,,MODERATE,CWE-79,
 CVE-2026-0540,2026-03-03T18:31:33Z,"DOMPurify contains a Cross-site Scripting vulnerability",dompurify,3.1.3,3.3.2,,MODERATE,CWE-79,
-CVE-2026-0621,2026-01-05T21:30:33Z,"Anthropic's MCP TypeScript SDK has a ReDoS vulnerability","@modelcontextprotocol/sdk",0,1.25.2,,HIGH,CWE-1333,
+CVE-2026-0621,2026-01-05T21:30:33Z,"Anthropic's MCP TypeScript SDK has a ReDoS vulnerability","@modelcontextprotocol/sdk",1.3.0,1.25.2,,HIGH,CWE-1333,
 CVE-2026-0755,2026-06-18T20:44:58Z,"gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)",gemini-mcp-tool,1.1.2,1.1.6,,CRITICAL,CWE-78,
 CVE-2026-0775,2026-01-23T06:31:24Z,"Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability",npm,0,,11.8.0,HIGH,CWE-732,
 CVE-2026-0824,2026-01-10T15:31:22Z,"QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting",@questdb/web-console,0,1.1.10,,LOW,CWE-79,
 CVE-2026-0933,2026-01-21T23:00:35Z,"Wrangler affected by OS Command Injection in `wrangler pages deploy`",wrangler,2.0.15,3.114.17,,HIGH,CWE-78,
 CVE-2026-0933,2026-01-21T23:00:35Z,"Wrangler affected by OS Command Injection in `wrangler pages deploy`",wrangler,4.0.0,4.59.1,,HIGH,CWE-78,
 CVE-2026-0969,2026-02-12T03:31:01Z,"next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content",next-mdx-remote,4.3.0,6.0.0,,HIGH,CWE-94,
+CVE-2026-10281,2026-06-01T21:30:42Z,"Claw Orchestrator is missing authentication for the component API Endpoint","@enderfga/claw-orchestrator",0,3.5.6,,MODERATE,CWE-287,
+CVE-2026-10291,2026-06-02T00:31:57Z,"Claw Orchestrator has inefficient regular expression complexity via validateRegex()","@enderfga/claw-orchestrator",0,3.7.1,,MODERATE,CWE-1333;CWE-400,
+CVE-2026-10690,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to SSRF","@wonderwhy-er/desktop-commander",0,,0.2.37,LOW,CWE-918,
+CVE-2026-10691,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption","@wonderwhy-er/desktop-commander",0,0.2.39,,LOW,CWE-400,
+CVE-2026-10802,2026-06-04T12:30:26Z,"Keystone: GraphQL API Endpoint Lacks Query Depth Limits",@keystone-6/core,0,,6.5.3,LOW,CWE-400,
+CVE-2026-11330,2026-06-05T15:32:23Z,"claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision",claude-mem,0,12.0.0,,LOW,CWE-327,
 CVE-2026-11417,2026-06-15T20:47:36Z,"aws-cdk-lib: OS Command Injection in NodejsFunction Bundling",aws-cdk-lib,0,2.246.0,,HIGH,CWE-78,
 CVE-2026-11525,2026-06-19T14:34:46Z,"undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",undici,0,6.27.0,,LOW,CWE-183,
 CVE-2026-11525,2026-06-19T14:34:46Z,"undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",undici,7.0.0,7.28.0,,LOW,CWE-183,
 CVE-2026-11525,2026-06-19T14:34:46Z,"undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",undici,8.0.0,8.5.0,,LOW,CWE-183,
+CVE-2026-11998,2026-06-24T21:30:44Z,"Angular's deprecated package has a Cross-Site Scripting issue",angular,1.2.0-rc.3,,1.8.3,HIGH,CWE-79;CWE-791,
 CVE-2026-12143,2026-06-15T17:26:26Z,"form-data: CRLF injection in form-data via unescaped multipart field names and filenames",form-data,0,2.5.6,,HIGH,CWE-93,
 CVE-2026-12143,2026-06-15T17:26:26Z,"form-data: CRLF injection in form-data via unescaped multipart field names and filenames",form-data,3.0.0,3.0.5,,HIGH,CWE-93,
 CVE-2026-12143,2026-06-15T17:26:26Z,"form-data: CRLF injection in form-data via unescaped multipart field names and filenames",form-data,4.0.0,4.0.6,,HIGH,CWE-93,
@@ -5762,6 +5769,7 @@ CVE-2026-35626,2026-03-26T19:50:41Z,"OpenClaw is vulnerable to unauthenticated r
 CVE-2026-35627,2026-03-26T19:08:34Z,"OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement",openclaw,0,2026.3.22,,HIGH,CWE-863,
 CVE-2026-35628,2026-03-27T22:37:35Z,"OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret",openclaw,0,,2026.3.24,MODERATE,CWE-307;CWE-521,
 CVE-2026-35629,2026-03-29T15:48:42Z,"OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)",openclaw,0,2026.3.28,,HIGH,CWE-918,
+CVE-2026-35630,2026-07-02T16:05:20Z,"OpenClaw: QQBot native approval buttons did not enforce configured approver identity",openclaw,0,2026.5.18,,HIGH,CWE-862,
 CVE-2026-35632,2026-03-26T21:49:25Z,"OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)",openclaw,0,,2026.2.22,MODERATE,CWE-61,
 CVE-2026-35633,2026-03-26T19:50:06Z,"OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure",openclaw,0,2026.3.22,,HIGH,CWE-400;CWE-770,
 CVE-2026-35634,2026-03-26T18:59:00Z,"OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication",openclaw,0,2026.3.23,,MODERATE,CWE-287,
@@ -5798,6 +5806,8 @@ CVE-2026-35668,2026-03-30T18:31:02Z,"OpenClaw has Sandbox Media Root Bypass via
 CVE-2026-35669,2026-03-27T22:30:57Z,"OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers",openclaw,0,,2026.3.24,HIGH,CWE-266;CWE-863,
 CVE-2026-35670,2026-03-26T19:08:16Z,"OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.",openclaw,0,2026.3.22,,MODERATE,CWE-639;CWE-706;CWE-807,
 CVE-2026-3635,2026-03-25T19:32:28Z,"fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",fastify,0,5.8.3,,MODERATE,CWE-348,
+CVE-2026-38728,2026-05-15T15:30:45Z,"smtp-server's command parser memory exhaustion denial-of-service",smtp-server,0,3.18.3,,HIGH,CWE-400,
+CVE-2026-39244,2026-07-10T18:32:19Z,"adm-zip: Crafted ZIP file triggers 4GB memory allocation",adm-zip,0,0.6.0,,HIGH,CWE-400;CWE-789,
 CVE-2026-39313,2026-04-16T20:44:32Z,"MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport",mcp-framework,0,0.2.22,,HIGH,CWE-770,
 CVE-2026-39315,2026-04-09T20:28:05Z,"Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()",unhead,0,2.1.13,,MODERATE,CWE-184,
 CVE-2026-39320,2026-04-21T17:17:00Z,"Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths",signalk-server,0,2.25.0,,HIGH,CWE-1333;CWE-400,
@@ -6336,8 +6346,8 @@ CVE-2026-44488,2026-06-04T14:21:37Z,"Allocation of Resources Without Limits or T
 CVE-2026-44489,2026-05-29T15:51:02Z,"Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix",axios,1.15.2,1.16.0,,LOW,CWE-113;CWE-1321,
 CVE-2026-44490,2026-05-29T15:54:57Z,"axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions",axios,0,0.32.0,,MODERATE,CWE-1321,
 CVE-2026-44490,2026-05-29T15:54:57Z,"axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions",axios,1.0.0,1.16.0,,MODERATE,CWE-1321,
-CVE-2026-44492,2026-05-29T15:59:30Z,"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)",axios,0,0.32.0,,HIGH,CWE-918,
-CVE-2026-44492,2026-05-29T15:59:30Z,"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)",axios,1.0.0,1.16.0,,HIGH,CWE-918,
+CVE-2026-44492,2026-05-29T15:59:30Z,"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)",axios,0,0.32.0,,HIGH,CWE-289;CWE-918,
+CVE-2026-44492,2026-05-29T15:59:30Z,"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)",axios,1.15.0,1.16.0,,HIGH,CWE-289;CWE-918,
 CVE-2026-44494,2026-05-29T16:04:00Z,"axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`",axios,1.0.0,1.16.0,,HIGH,CWE-1321;CWE-441,
 CVE-2026-44495,2026-05-29T16:07:31Z,"axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge",axios,0.19.0,0.31.1,,HIGH,CWE-1321;CWE-94,
 CVE-2026-44495,2026-05-29T16:07:31Z,"axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge",axios,1.0.0,1.15.2,,HIGH,CWE-1321;CWE-94,
@@ -6444,6 +6454,7 @@ CVE-2026-45242,2026-05-18T21:31:50Z,"Summarize contains a path traversal vulnera
 CVE-2026-45243,2026-05-18T21:31:50Z,"Summarize contains a missing authorization vulnerability",@steipete/summarize,0,0.15.0,,MODERATE,CWE-862,
 CVE-2026-45244,2026-05-18T21:31:51Z,"Summarize contains a missing authorization vulnerability",@steipete/summarize,0,0.15.0,,LOW,CWE-862,
 CVE-2026-45245,2026-05-18T21:31:51Z,"Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links",@steipete/summarize,0,0.15.1,,MODERATE,CWE-918,
+CVE-2026-45249,2026-05-26T13:30:40Z,"Apache ECharts has a cross-site scripting (XSS) vulnerability",echarts,0,6.1.0,,MODERATE,CWE-79,
 CVE-2026-45302,2026-05-18T16:43:12Z,"parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names",parse-nested-form-data,0,1.0.1,,HIGH,CWE-1321,
 CVE-2026-45310,2026-05-14T20:29:26Z,"DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool",deepseek-tui,0,0.8.22,,HIGH,CWE-918,
 CVE-2026-45311,2026-05-14T20:29:33Z,"DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval",deepseek-tui,0.3.0,0.8.23,,CRITICAL,CWE-94,
@@ -6568,7 +6579,7 @@ CVE-2026-45740,2026-05-19T16:21:33Z,"protobufjs: Denial of Service via unbounded
 CVE-2026-45772,2026-05-19T19:46:44Z,"Turbo: Unexpected local code execution during Yarn Berry detection",@turbo/codemod,2.3.4,2.9.14,,LOW,CWE-426,
 CVE-2026-45772,2026-05-19T19:46:44Z,"Turbo: Unexpected local code execution during Yarn Berry detection",@turbo/workspaces,2.3.4,2.9.14,,LOW,CWE-426,
 CVE-2026-45772,2026-05-19T19:46:44Z,"Turbo: Unexpected local code execution during Yarn Berry detection",turbo,1.1.0,2.9.14,,LOW,CWE-426,
-CVE-2026-45773,2026-05-19T19:49:52Z,"Trubo: Login callback CSRF/session fixation",turbo,0,2.9.14,,MODERATE,CWE-352,
+CVE-2026-45773,2026-05-19T19:49:52Z,"Turbo: Login callback CSRF/session fixation",turbo,0,2.9.14,,MODERATE,CWE-352,
 CVE-2026-45783,2026-05-19T20:07:52Z,"@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes",@libp2p/kad-dht,0,16.2.6,,HIGH,CWE-20;CWE-400,
 CVE-2026-45787,2026-05-14T20:30:04Z,"electerm's encrypt method not safe enough",electerm,0,3.9.5,,MODERATE,"CWE-326;CWE-329;CWE-353;CWE-759;CWE-916",
 CVE-2026-45805,2026-05-19T19:57:36Z,"PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE",@penpot/mcp,0,2.15.0,,HIGH,CWE-749,
@@ -6592,7 +6603,7 @@ CVE-2026-46395,2026-05-19T14:44:55Z,"HAXcms: Private Key Disclosure via Broken H
 CVE-2026-46396,2026-05-19T14:46:47Z,"Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover",@haxtheweb/haxcms-nodejs,0,26.0.0,,HIGH,CWE-79,
 CVE-2026-46396,2026-05-19T14:46:47Z,"Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover",@haxtheweb/iframe-loader,0,26.0.0,,HIGH,CWE-79,
 CVE-2026-46396,2026-05-19T14:46:47Z,"Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover",@haxtheweb/video-player,0,26.0.0,,HIGH,CWE-79,
-CVE-2026-46406,2026-06-25T16:53:00Z,"@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write","@anthropic-ai/claude-code",2.1.59,2.1.128,,MODERATE,CWE-59;CWE-200;CWE-377,
+CVE-2026-46406,2026-06-25T16:53:00Z,"@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write","@anthropic-ai/claude-code",2.1.59,2.1.128,,MODERATE,CWE-200;CWE-377;CWE-59,
 CVE-2026-46412,2026-05-19T20:28:07Z,"Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm",@beproduct/nestjs-auth,0.1.2,,0.1.19,CRITICAL,CWE-506,
 CVE-2026-46417,2026-05-19T20:29:49Z,"@angular/platform-server: SSRF via Hostname Hijacking",@angular/platform-server,0,,18.2.14,HIGH,CWE-918,
 CVE-2026-46417,2026-05-19T20:29:49Z,"@angular/platform-server: SSRF via Hostname Hijacking",@angular/platform-server,19.0.0-next.0,19.2.22,,HIGH,CWE-918,
@@ -6701,14 +6712,14 @@ CVE-2026-47718,2026-05-28T20:33:11Z,"FUXA provides guest and invalid-token acces
 CVE-2026-47719,2026-06-08T23:06:40Z,"FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading",fuxa-server,0,,1.1.14-1243,HIGH,CWE-918,
 CVE-2026-47720,2026-06-08T23:06:43Z,"FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString",fuxa-server,0,,1.1.14-1243,MODERATE,CWE-89,
 CVE-2026-47721,2026-06-08T23:07:02Z,"FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions",fuxa-server,0,,1.1.14-1243,MODERATE,CWE-862,
-CVE-2026-47759,2026-06-05T20:27:50Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes",tinymce,0,,,HIGH,CWE-79,
+CVE-2026-47759,2026-06-05T20:27:50Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes",tinymce,0,,5.10.9,HIGH,CWE-79,
 CVE-2026-47759,2026-06-05T20:27:50Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes",tinymce,6.0.0,7.9.3,,HIGH,CWE-79,
 CVE-2026-47759,2026-06-05T20:27:50Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes",tinymce,8.0.0,8.5.1,,HIGH,CWE-79,
 CVE-2026-47760,2026-06-05T20:09:38Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs",tinymce,6.8.0,7.1.0,,HIGH,CWE-79,
-CVE-2026-47761,2026-06-05T20:29:43Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection",tinymce,0,,,HIGH,CWE-79,
+CVE-2026-47761,2026-06-05T20:29:43Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection",tinymce,0,,5.10.9,HIGH,CWE-79,
 CVE-2026-47761,2026-06-05T20:29:43Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection",tinymce,6.0.0,7.9.3,,HIGH,CWE-79,
 CVE-2026-47761,2026-06-05T20:29:43Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection",tinymce,8.0.0,8.5.1,,HIGH,CWE-79,
-CVE-2026-47762,2026-06-05T20:29:07Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",tinymce,0,,,HIGH,CWE-79,
+CVE-2026-47762,2026-06-05T20:29:07Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",tinymce,0,,5.10.9,HIGH,CWE-79,
 CVE-2026-47762,2026-06-05T20:29:07Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",tinymce,6.0.0,7.9.3,,HIGH,CWE-79,
 CVE-2026-47762,2026-06-05T20:29:07Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",tinymce,8.0.0,8.5.1,,HIGH,CWE-79,
 CVE-2026-4800,2026-04-01T23:51:12Z,"lodash vulnerable to Code Injection via `_.template` imports key names",lodash,4.0.0,4.18.0,,HIGH,CWE-94,
@@ -6763,13 +6774,18 @@ CVE-2026-48712,2026-06-15T17:30:15Z,"protobufjs: Denial of service through unbou
 CVE-2026-48713,2026-06-25T17:28:46Z,"i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string",i18next-fs-backend,0,2.6.6,,CRITICAL,CWE-1321,
 CVE-2026-48714,2026-06-25T17:28:12Z,"i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names",i18next-http-middleware,0,3.9.7,,CRITICAL,CWE-1321,
 CVE-2026-48758,2026-06-26T19:11:19Z,"@sigstore/core has DSSE payloadType type-binding failure",@sigstore/core,0,3.2.1,,MODERATE,CWE-347,
-CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,1.1.0,5.2.5,,HIGH,CWE-400;CWE-770,
-CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,6.0.0,6.2.4,,HIGH,CWE-400;CWE-770,
-CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,7.0.0,7.5.11,,HIGH,CWE-400;CWE-770,
-CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,8.0.0,8.21.0,,HIGH,CWE-400;CWE-770,
+CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,1.1.0,5.2.5,,HIGH,CWE-1050;CWE-400;CWE-770,
+CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,6.0.0,6.2.4,,HIGH,CWE-1050;CWE-400;CWE-770,
+CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,7.0.0,7.5.11,,HIGH,CWE-1050;CWE-400;CWE-770,
+CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,8.0.0,8.21.0,,HIGH,CWE-1050;CWE-400;CWE-770,
+CVE-2026-48795,2026-06-30T18:34:32Z,"@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754",@adonisjs/bodyparser,10.1.3,10.1.5,,HIGH,CWE-1321,
+CVE-2026-48795,2026-06-30T18:34:32Z,"@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754",@adonisjs/bodyparser,11.0.0-next.9,11.0.3,,HIGH,CWE-1321,
 CVE-2026-48797,2026-06-26T20:34:29Z,"Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication","@mcptoolshop/backpropagate",1.1.0,1.2.0,,CRITICAL,CWE-1295;CWE-358;CWE-862,
 CVE-2026-48801,2026-06-26T20:47:58Z,"LinkifyIt#match scan loop has quadratic algorithmic complexity",linkify-it,0,5.0.1,,HIGH,CWE-1333,
 CVE-2026-48814,2026-06-19T13:34:24Z,"Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests",network-ai,0,5.7.2,,CRITICAL,CWE-306,
+CVE-2026-48815,2026-07-01T19:58:28Z,"sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced",sigstore,0,4.1.1,,HIGH,CWE-347,
+CVE-2026-48816,2026-07-01T19:57:45Z,"sigstore-js has Insufficient Verification of Data Authenticity",@sigstore/verify,3.1.0,3.1.1,,MODERATE,CWE-345,
+CVE-2026-48819,2026-07-01T20:55:17Z,"@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key",@hey-api/openapi-ts,0,0.97.3,,MODERATE,CWE-1321,
 CVE-2026-48988,2026-06-15T20:41:06Z,"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations",markdown-it,0,14.2.0,,MODERATE,CWE-400;CWE-407,
 CVE-2026-48995,2026-06-26T21:49:22Z,"pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile",pnpm,0,10.33.4,,MODERATE,CWE-353,
 CVE-2026-48995,2026-06-26T21:49:22Z,"pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile",pnpm,11.0.0,11.0.7,,MODERATE,CWE-353,
@@ -6777,23 +6793,38 @@ CVE-2026-49143,2026-06-03T21:39:32Z,"browserstack-runner vulnerable to Remote Co
 CVE-2026-49144,2026-06-03T21:38:40Z,"browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server",browserstack-runner,0,,0.9.5,HIGH,CWE-22,
 CVE-2026-49229,2026-06-22T23:19:56Z,"@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens",@actual-app/sync-server,0,26.6.0,,HIGH,CWE-613,
 CVE-2026-4923,2026-03-27T22:23:52Z,"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards",path-to-regexp,8.0.0,8.4.0,,MODERATE,CWE-1333,
+CVE-2026-49250,2026-07-02T19:18:41Z,"@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields",@conform-to/dom,1.8.0,1.19.4,,HIGH,CWE-407,
 CVE-2026-49252,2026-06-26T21:03:59Z,"deepstream is vulnerable to prototype pollution",@deepstream/server,0,10.0.5,,CRITICAL,CWE-1321,
+CVE-2026-49253,2026-07-02T19:20:20Z,"electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling",electerm,0,3.11.11,,HIGH,CWE-22,
+CVE-2026-49255,2026-07-02T19:22:31Z,"electerm has Command Injection in File System Operations (rmrf, mv, cp)",electerm,0,3.11.11,,HIGH,CWE-78,
 CVE-2026-4926,2026-03-27T22:23:27Z,"path-to-regexp vulnerable to Denial of Service via sequential optional groups",path-to-regexp,8.0.0,8.4.0,,HIGH,CWE-1333;CWE-400,
 CVE-2026-49293,2026-06-26T22:21:43Z,"js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals",js-toml,0,1.1.1,,HIGH,CWE-1333;CWE-400;CWE-407,
 CVE-2026-49336,2026-06-26T22:23:11Z,"@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter","@microsoft/kiota-http-fetchlibrary",1.0.0-preview.97,1.0.0-preview.102,,MODERATE,CWE-178;CWE-200,
+CVE-2026-49352,2026-07-02T20:56:55Z,"9router's Hardcoded Default fallback JWT Secret  Allows Authentication Bypass",9router,0.2.21,0.4.45,,CRITICAL,CWE-798,
+CVE-2026-49353,2026-07-02T21:13:19Z,"9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING",9router,0,,0.4.55,HIGH,CWE-290,
 CVE-2026-49356,2026-06-15T17:14:14Z,"@babel/core: Arbitrary File Read via sourceMappingURL Comment",@babel/core,0,7.29.6,,LOW,CWE-200;CWE-22,
 CVE-2026-49356,2026-06-15T17:14:14Z,"@babel/core: Arbitrary File Read via sourceMappingURL Comment",@babel/core,8.0.0-alpha.0,8.0.0-rc.6,,LOW,CWE-200;CWE-22,
 CVE-2026-49357,2026-06-26T21:50:49Z,"Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication",line-desktop-mcp,0,1.1.2,,HIGH,CWE-306;CWE-862,
 CVE-2026-49444,2026-06-16T17:37:21Z,"n8n: Python sandbox escape",n8n,0,1.123.48,,HIGH,CWE-20,
 CVE-2026-49444,2026-06-16T17:37:21Z,"n8n: Python sandbox escape",n8n,2.0.0-rc.0,2.21.8,,HIGH,CWE-20,
 CVE-2026-49444,2026-06-16T17:37:21Z,"n8n: Python sandbox escape",n8n,2.22.0,2.22.4,,HIGH,CWE-20,
+CVE-2026-49455,2026-07-08T20:27:11Z,"Waku: Cross-Origin CSRF on RSC Server Action Dispatch",waku,0,1.0.0-beta.1,,MODERATE,CWE-352,
+CVE-2026-49456,2026-07-08T20:30:21Z,"Waku has an Open Redirect via `unstable_redirect` Helper",waku,0,1.0.0-beta.1,,LOW,CWE-601,
 CVE-2026-49458,2026-06-15T19:56:35Z,"DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks",dompurify,0,3.4.6,,MODERATE,CWE-501;CWE-693;CWE-79,
 CVE-2026-49459,2026-06-15T19:53:05Z,"DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM",dompurify,0,3.4.6,,MODERATE,CWE-1321;CWE-693;CWE-79,
 CVE-2026-49465,2026-06-16T17:37:54Z,"n8n: Git Node Clone and Push Operations Bypass File Sandbox",n8n,0,1.123.48,,MODERATE,CWE-22,
 CVE-2026-49465,2026-06-16T17:37:54Z,"n8n: Git Node Clone and Push Operations Bypass File Sandbox",n8n,2.0.0-rc.0,2.21.8,,MODERATE,CWE-22,
 CVE-2026-49465,2026-06-16T17:37:54Z,"n8n: Git Node Clone and Push Operations Bypass File Sandbox",n8n,2.22.0,2.22.4,,MODERATE,CWE-22,
+CVE-2026-49473,2026-06-30T18:09:13Z,"@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation","@cedar-policy/authorization-for-expressjs",0,0.3.0,,HIGH,CWE-436;CWE-863,
+CVE-2026-49856,2026-07-01T18:14:57Z,"@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization",@jshookmcp/jshook,0.3.1,0.3.2,,MODERATE,CWE-918,
+CVE-2026-49857,2026-07-01T18:16:22Z,"auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback",auth-fetch-mcp,0,3.0.2,,HIGH,CWE-918,
+CVE-2026-49864,2026-07-01T18:19:39Z,"wetty vulnerable to DOM XSS via file-download filename",wetty,0,3.0.4,,HIGH,CWE-79,
+CVE-2026-49866,2026-07-10T16:04:49Z,"libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays",@libp2p/gossipsub,0,16.0.0,,HIGH,CWE-20;CWE-400;CWE-770,
+CVE-2026-49977,2026-07-10T16:05:00Z,"tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies",tarteaucitronjs,0,1.33.0,,MODERATE,CWE-285,
 CVE-2026-49978,2026-06-15T20:01:45Z,"DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content",dompurify,0,3.4.7,,MODERATE,CWE-79,
 CVE-2026-49982,2026-06-15T16:36:46Z,"tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template",tmp,0.2.6,0.2.7,,HIGH,CWE-20;CWE-22,
+CVE-2026-49987,2026-07-01T19:00:50Z,"repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection",repomix,0,1.14.1,,HIGH,CWE-88,
+CVE-2026-49988,2026-07-01T19:01:41Z,"repomix: attach_packed_output can bypass file-read secret scanning for supported local files",repomix,0,1.14.1,,MODERATE,CWE-200,
 CVE-2026-49993,2026-06-16T23:39:16Z,"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)",@nuxt/rspack-builder,3.15.4,3.21.7,,MODERATE,CWE-749,
 CVE-2026-49993,2026-06-16T23:39:16Z,"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)",@nuxt/rspack-builder,4.0.0,4.4.7,,MODERATE,CWE-749,
 CVE-2026-49993,2026-06-16T23:39:16Z,"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)",@nuxt/webpack-builder,3.15.4,3.21.7,,MODERATE,CWE-749,
@@ -6810,9 +6841,18 @@ CVE-2026-50017,2026-06-26T22:59:25Z,"pnpm binds unscoped user-level npm auth cre
 CVE-2026-50021,2026-06-26T22:53:01Z,"pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field",pnpm,0,10.34.1,,MODERATE,CWE-354,
 CVE-2026-50021,2026-06-26T22:53:01Z,"pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field",pnpm,11.0.0,11.4.0,,MODERATE,CWE-354,
 CVE-2026-50029,2026-06-26T22:49:28Z,"js-toml has silent type confusion via falsy-primitive duplicate-key bypass",js-toml,0,1.1.2,,MODERATE,CWE-697,
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,0.11.2,1.9.12,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,1.10.0,1.10.11,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,2.0.0,2.0.19,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,2.1.0,2.1.15,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,2.2.0,2.2.4,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/vocab-runtime,0,2.0.19,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/vocab-runtime,2.1.0,2.1.15,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/vocab-runtime,2.2.0,2.2.4,,HIGH,"CWE-918;CWE-1286;CWE-1389",
 CVE-2026-50132,2026-06-22T23:08:23Z,"Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF",@budibase/server,0,3.39.0,,HIGH,CWE-284;CWE-352,
-CVE-2026-50136,2026-06-22T23:15:10Z,"Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials",@budibase/server,0,3.39.2,,HIGH,,
+CVE-2026-50136,2026-06-22T23:15:10Z,"Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials",@budibase/server,0,3.39.2,,HIGH,CWE-306,
 CVE-2026-50137,2026-06-22T23:19:26Z,"Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials",@budibase/server,0,3.39.0,,HIGH,CWE-862,
+CVE-2026-50143,2026-07-01T22:02:15Z,"Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token",@apify/actors-mcp-server,0,0.10.11,,HIGH,CWE-918,
 CVE-2026-50146,2026-06-16T14:05:06Z,"Astro: Reflected XSS via unescaped slot name",astro,0,6.3.3,,HIGH,CWE-79;CWE-80,
 CVE-2026-50168,2026-06-15T16:39:20Z,"@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass",@angular/platform-server,0,,18.2.14,HIGH,CWE-346;CWE-918,
 CVE-2026-50168,2026-06-15T16:39:20Z,"@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass",@angular/platform-server,19.0.0-next.0,19.2.23,,HIGH,CWE-346;CWE-918,
@@ -6840,7 +6880,11 @@ CVE-2026-50184,2026-06-15T17:13:05Z,"@angular/service-worker: Request Credential
 CVE-2026-50184,2026-06-15T17:13:05Z,"@angular/service-worker: Request Credential & Cache Policy Stripping",@angular/service-worker,20.0.0-next.0,20.3.22,,MODERATE,CWE-200;CWE-524,
 CVE-2026-50184,2026-06-15T17:13:05Z,"@angular/service-worker: Request Credential & Cache Policy Stripping",@angular/service-worker,21.0.0-next.0,21.2.15,,MODERATE,CWE-200;CWE-524,
 CVE-2026-50184,2026-06-15T17:13:05Z,"@angular/service-worker: Request Credential & Cache Policy Stripping",@angular/service-worker,22.0.0-next.0,22.0.0-rc.2,,MODERATE,CWE-200;CWE-524,
+CVE-2026-50272,2026-07-15T22:58:52Z,"dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS",dd-trace,0,5.100.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-50287,2026-06-01T13:58:33Z,"@agenticmail/mcp Missing Authentication for Critical Function",@agenticmail/mcp,0,0.9.27,,HIGH,CWE-306,
+CVE-2026-50288,2026-07-02T18:59:33Z,"@asymmetric-effort/specifyjs: URL parse failure silently allows request","@asymmetric-effort/specifyjs",0,0.2.136,,HIGH,CWE-918,
+CVE-2026-50289,2026-07-15T23:09:28Z,"systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux",systeminformation,0,5.31.7,,HIGH,CWE-78,
+CVE-2026-50290,2026-07-02T19:08:45Z,"@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-79,
 CVE-2026-5038,2026-06-17T18:11:48Z,"Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",multer,2.0.0-alpha.1,2.2.0,,MODERATE,CWE-459,
 CVE-2026-5038,2026-06-17T18:11:48Z,"Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",multer,3.0.0-alpha.1,3.0.0-alpha.2,,MODERATE,CWE-459,
 CVE-2026-50555,2026-06-15T17:20:30Z,"@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",@angular/platform-server,0,,18.2.14,HIGH,CWE-79,
@@ -6865,6 +6909,7 @@ CVE-2026-50557,2026-06-15T17:21:58Z,"Angular: Template and Attribute Namespace S
 CVE-2026-50557,2026-06-15T17:21:58Z,"Angular: Template and Attribute Namespace Sanitization Bypass (XSS)",@angular/core,22.0.0-next.0,22.0.0-rc.2,,MODERATE,CWE-79,
 CVE-2026-50573,2026-06-26T22:52:33Z,"pnpm: Unsafe default behavior breaks integrity check",pnpm,0,10.34.0,,MODERATE,CWE-345,
 CVE-2026-50573,2026-06-26T22:52:33Z,"pnpm: Unsafe default behavior breaks integrity check",pnpm,11.0.0,11.4.0,,MODERATE,CWE-345,
+CVE-2026-5078,2026-07-10T14:32:15Z,"morgan vulnerable to Log Forging via unneutralized control characters in :remote-user",morgan,1.2.0,1.11.0,,MODERATE,CWE-117,
 CVE-2026-5079,2026-06-17T18:12:27Z,"Multer vulnerable to Denial of Service via deeply nested field names",multer,1.0.0,2.2.0,,HIGH,CWE-400,
 CVE-2026-5079,2026-06-17T18:12:27Z,"Multer vulnerable to Denial of Service via deeply nested field names",multer,3.0.0-alpha.1,3.0.0-alpha.2,,HIGH,CWE-400,
 CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",@angular/core,0,,18.2.14,MODERATE,CWE-79,
@@ -6872,13 +6917,30 @@ CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic
 CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",@angular/core,20.0.0-next.0,20.3.22,,MODERATE,CWE-79,
 CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",@angular/core,21.0.0-next.0,21.2.15,,MODERATE,CWE-79,
 CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",@angular/core,22.0.0-next.0,22.0.0-rc.2,,MODERATE,CWE-79,
+CVE-2026-52746,2026-07-02T20:13:55Z,"jsonata: Malicious inputs to ""$toMillis"" function can cause resource exhaustion",jsonata,0,2.2.0,,HIGH,CWE-1333,
 CVE-2026-5323,2026-04-02T09:30:24Z,"a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function",a11y-mcp,0,1.0.5,,LOW,CWE-918,
 CVE-2026-5327,2026-04-02T12:31:05Z,"fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function",fast-filesystem-mcp,0,,3.5.0,LOW,CWE-74,
-CVE-2026-53550,2026-06-15T17:15:07Z,"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",js-yaml,0,4.2.0,,MODERATE,CWE-407,
+CVE-2026-53486,2026-07-06T20:27:38Z,"Decompress: Archive extraction can create files and links outside of the target directory",@xhmikosr/decompress,0,10.2.1,,CRITICAL,CWE-22;CWE-59;CWE-732,
+CVE-2026-53486,2026-07-06T20:27:38Z,"Decompress: Archive extraction can create files and links outside of the target directory",@xhmikosr/decompress,11.0.0,11.1.3,,CRITICAL,CWE-22;CWE-59;CWE-732,
+CVE-2026-53486,2026-07-06T20:27:38Z,"Decompress: Archive extraction can create files and links outside of the target directory",decompress,0,,4.2.1,CRITICAL,CWE-22;CWE-59;CWE-732,
+CVE-2026-53496,2026-07-17T20:19:39Z,"ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes",exifreader,0,4.40.1,,MODERATE,CWE-248;CWE-755,
+CVE-2026-53509,2026-07-07T19:35:57Z,"@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)","@aborruso/ckan-mcp-server",0,0.4.106,,MODERATE,CWE-918,
+CVE-2026-53512,2026-07-07T20:11:50Z,"Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins",better-auth,0,1.6.11,,CRITICAL,"CWE-287;CWE-306;CWE-345;CWE-863",
+CVE-2026-53513,2026-07-07T20:56:19Z,"@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints",@better-auth/sso,0.1.0,1.6.11,,CRITICAL,"CWE-20;CWE-345;CWE-441;CWE-918",
+CVE-2026-53514,2026-07-07T20:54:51Z,"Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin",better-auth,0,1.6.11,,HIGH,"CWE-287;CWE-345;CWE-441;CWE-862",
+CVE-2026-53516,2026-07-07T20:55:13Z,"Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email",better-auth,0,1.6.11,,HIGH,CWE-287;CWE-345,
+CVE-2026-53517,2026-07-07T20:55:48Z,"Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption","@better-auth/oauth-provider",1.6.0,1.6.11,,HIGH,"CWE-294;CWE-362;CWE-367;CWE-613",
+CVE-2026-53517,2026-07-07T20:55:48Z,"Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption",better-auth,1.4.8-beta.7,1.6.0,,HIGH,"CWE-294;CWE-362;CWE-367;CWE-613",
+CVE-2026-53518,2026-07-07T20:56:35Z,"@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive","@better-auth/oauth-provider",1.6.0,1.6.11,,HIGH,CWE-294;CWE-362;CWE-367,
+CVE-2026-53518,2026-07-07T20:56:35Z,"@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive",better-auth,0,1.6.11,,HIGH,CWE-294;CWE-362;CWE-367,
+CVE-2026-53550,2026-06-15T17:15:07Z,"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",js-yaml,0,3.15.0,,MODERATE,CWE-407,
+CVE-2026-53550,2026-06-15T17:15:07Z,"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",js-yaml,4.0.0,4.2.0,,MODERATE,CWE-407,
 CVE-2026-53571,2026-06-15T17:17:45Z,"vite: `server.fs.deny` bypass on Windows alternate paths",vite,0,6.4.3,,HIGH,CWE-200;CWE-22,
 CVE-2026-53571,2026-06-15T17:17:45Z,"vite: `server.fs.deny` bypass on Windows alternate paths",vite,7.0.0,7.3.5,,HIGH,CWE-200;CWE-22,
 CVE-2026-53571,2026-06-15T17:17:45Z,"vite: `server.fs.deny` bypass on Windows alternate paths",vite,8.0.0,8.0.16,,HIGH,CWE-200;CWE-22,
 CVE-2026-53571,2026-06-15T17:17:45Z,"vite: `server.fs.deny` bypass on Windows alternate paths",vite-plus,0,0.1.24,,HIGH,CWE-200;CWE-22,
+CVE-2026-53597,2026-07-17T19:53:34Z,"Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader",@prompty/core,2.0.0-alpha.1,2.0.0-beta.3,,HIGH,CWE-94,
+CVE-2026-53598,2026-07-17T19:46:05Z,"Prompty: Arbitrary file read via file reference expansion",@prompty/core,0,2.0.0-beta.2,,HIGH,CWE-22;CWE-200,
 CVE-2026-53632,2026-06-15T17:18:31Z,"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",launch-editor,0,2.14.1,,MODERATE,CWE-522;CWE-73,
 CVE-2026-53632,2026-06-15T17:18:31Z,"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",vite,0,6.4.3,,MODERATE,CWE-522;CWE-73,
 CVE-2026-53632,2026-06-15T17:18:31Z,"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",vite,7.0.0,7.3.5,,MODERATE,CWE-522;CWE-73,
@@ -6901,6 +6963,18 @@ CVE-2026-53725,2026-06-19T19:35:15Z,"parse-server: Endpoints `/login` and `/veri
 CVE-2026-53726,2026-06-19T19:35:19Z,"parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL",parse-server,0,8.6.80,,MODERATE,CWE-639,
 CVE-2026-53726,2026-06-19T19:35:19Z,"parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL",parse-server,9.0.0,9.9.1-alpha.6,,MODERATE,CWE-639,
 CVE-2026-53765,2026-06-17T14:01:04Z,"Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory",chrome-devtools-mcp,0.20.0,1.1.0,,MODERATE,CWE-59,
+CVE-2026-53806,2026-07-02T17:11:43Z,"OpenClaw: Combined POSIX shell options could confuse exec revalidation",openclaw,0,2026.5.12,,HIGH,CWE-367,
+CVE-2026-53809,2026-07-02T16:58:51Z,"OpenClaw: Embedded runner policy could be confused by provider aliases",openclaw,0,2026.4.25,,MODERATE,CWE-863,
+CVE-2026-53810,2026-07-02T16:00:42Z,"OpenClaw's marketplace runtime extension metadata could point at unscanned payloads",openclaw,0,2026.5.18,,HIGH,"CWE-284;CWE-78;CWE-829;CWE-94",
+CVE-2026-53811,2026-07-02T17:13:58Z,"OpenClaw: Matrix allowFrom could bind to mutable display names",openclaw,0,2026.5.7,,HIGH,CWE-290,
+CVE-2026-53812,2026-07-02T16:00:03Z,"OpenClaw's browser act interactions could bypass private-network navigation checks",openclaw,0,2026.5.18,,MODERATE,CWE-284;CWE-918,
+CVE-2026-53813,2026-07-02T16:57:56Z,"OpenClaw: Fake package roots could influence memory-core artifact loading",openclaw,0,2026.4.25,,HIGH,CWE-427,
+CVE-2026-53814,2026-07-02T16:05:03Z,"OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority",openclaw,0,2026.5.20,,HIGH,CWE-200;CWE-266;CWE-284,
+CVE-2026-53815,2026-07-02T15:40:01Z,"OpenClaw: Message read actions could skip channel allowlist checks",openclaw,0,2026.5.19,,HIGH,CWE-200;CWE-862,
+CVE-2026-53816,2026-07-02T17:12:03Z,"OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance",openclaw,0,2026.5.18,,HIGH,CWE-284;CWE-862;CWE-863,
+CVE-2026-53817,2026-07-02T16:04:35Z,"OpenClaw: Control UI locality spoofing could mint a durable admin device token",openclaw,0,2026.5.22,,HIGH,"CWE-284;CWE-287;CWE-290;CWE-863",
+CVE-2026-53818,2026-07-02T17:11:35Z,"OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers",openclaw,0,2026.4.24,,MODERATE,CWE-862,
+CVE-2026-53819,2026-07-02T16:57:30Z,"OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows",openclaw,0,2026.5.27,,HIGH,CWE-426,
 CVE-2026-53840,2026-06-17T17:55:06Z,"OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin",openclaw,0,2026.5.12,,HIGH,CWE-200,
 CVE-2026-53841,2026-06-18T20:14:40Z,"OpenClaw: Exported session HTML could keep unsafe markdown links",openclaw,0,2026.5.12,,MODERATE,CWE-79,
 CVE-2026-53842,2026-06-18T13:04:09Z,"OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution",openclaw,0,2026.5.2,,HIGH,CWE-426,
@@ -6934,7 +7008,9 @@ CVE-2026-53928,2026-06-17T14:07:33Z,"NocoDB: Refresh Tokens Persist Through Pass
 CVE-2026-53929,2026-06-17T14:07:52Z,"NocoDB: Stored Cross-Site Scripting via Secure Attachment",nocodb,0,,0.301.3,MODERATE,CWE-79,
 CVE-2026-53930,2026-06-17T14:08:04Z,"NocoDB: Server-Side Request Forgery via Base Migration URL",nocodb,0,,0.301.3,MODERATE,CWE-918,
 CVE-2026-53931,2026-06-17T14:08:26Z,"NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint",nocodb,0,,0.301.3,MODERATE,CWE-441;CWE-918,
+CVE-2026-53943,2026-07-01T21:58:32Z,"Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header",ghost,4.0.0,6.37.0,,CRITICAL,CWE-524,
 CVE-2026-54051,2026-06-19T13:35:05Z,"Network-AI: Improper Neutralization of Special Elements used in an OS Command ",network-ai,0,5.9.1,,CRITICAL,CWE-78,
+CVE-2026-54052,2026-07-14T19:07:14Z,"n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments",n8n-mcp,0,2.56.1,,CRITICAL,CWE-639;CWE-862,
 CVE-2026-54074,2026-06-19T21:15:16Z,"@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels",@tinacms/cli,0,2.4.3,,HIGH,CWE-94,
 CVE-2026-54157,2026-06-16T20:15:57Z,"LobeHub: Unauthenticated SSRF in `/webapi/proxy`",@lobehub/lobehub,0,2.1.57,,CRITICAL,CWE-918,
 CVE-2026-54257,2026-06-15T20:20:24Z,"Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow",electron,42.3.1,42.3.3,,CRITICAL,CWE-120,
@@ -7012,12 +7088,19 @@ CVE-2026-54327,2026-06-17T13:54:37Z,"Pi Agent: Race condition in Pi auth.json wr
 CVE-2026-54327,2026-06-17T13:54:37Z,"Pi Agent: Race condition in Pi auth.json writes could expose stored credentials","@mariozechner/pi-coding-agent",0.28.0,,0.73.1,LOW,CWE-367;CWE-732,
 CVE-2026-54328,2026-06-17T13:55:13Z,"Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts","@earendil-works/pi-coding-agent",0.74.0,0.78.1,,HIGH,CWE-379,
 CVE-2026-54328,2026-06-17T13:55:13Z,"Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts","@mariozechner/pi-coding-agent",0.50.0,,0.73.1,HIGH,CWE-379,
+CVE-2026-54335,2026-07-14T19:40:05Z,"Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__",@feathersjs/commons,0,5.0.45,,LOW,CWE-1321,
 CVE-2026-54350,2026-06-23T17:43:10Z,"Budibase has nonymous NoSQL operator injection via published-app query templates",@budibase/server,0,3.39.12,,CRITICAL,CWE-89;CWE-943,
 CVE-2026-54351,2026-06-22T23:20:20Z,"Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override",@budibase/server,0,3.39.9,,HIGH,CWE-915,
 CVE-2026-54352,2026-06-22T23:33:35Z,"Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload",@budibase/server,0,3.39.9,,CRITICAL,CWE-22;CWE-59,
 CVE-2026-54353,2026-06-22T23:39:24Z,"@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation",@budibase/backend-core,0,3.39.9,,HIGH,CWE-367;CWE-918,
+CVE-2026-54466,2026-07-15T22:07:24Z,"websocket-driver: Message corruption via abuse of protocol length headers",websocket-driver,0,0.7.5,,CRITICAL,CWE-130,
+CVE-2026-54490,2026-07-15T22:08:17Z,"websocket-driver: Resource limit bypass via message compression",websocket-driver,0,0.7.5,,MODERATE,CWE-770,
+CVE-2026-54504,2026-07-15T23:26:57Z,"@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default","@andrea9293/mcp-documentation-server",1.13.0,1.13.1,,HIGH,CWE-306;CWE-668,
 CVE-2026-54527,2026-06-19T19:36:04Z,"jupyterlab-git extension: Stored XSS leading to RCE",@jupyterlab/git,0.30.0b3,0.54.0,,HIGH,CWE-79,
+CVE-2026-54546,2026-07-17T19:02:37Z,"TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard",@tak-ps/cloudtak,0,,13.5.0,MODERATE,CWE-918,
+CVE-2026-54561,2026-07-17T19:23:07Z,"mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath",mcp-memory-keeper,0,0.13.0,,MODERATE,CWE-22;CWE-209,
 CVE-2026-55091,2026-06-19T20:47:52Z,"flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key",flat-to-nested,0,1.1.2,,HIGH,CWE-1321;CWE-915,
+CVE-2026-55177,2026-07-17T21:35:10Z,"CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard",@tak-ps/cloudtak,0,13.10.0,,HIGH,CWE-918,
 CVE-2026-55180,2026-06-26T23:12:25Z,"pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",pnpm,0,10.34.2,,MODERATE,CWE-200;CWE-201;CWE-522,
 CVE-2026-55180,2026-06-26T23:12:25Z,"pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",pnpm,11.0.0,11.5.3,,MODERATE,CWE-200;CWE-201;CWE-522,
 CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE via inherited options.filename",piscina,0,4.9.3,,HIGH,CWE-1321;CWE-94,
@@ -7025,12 +7108,15 @@ CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE
 CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE via inherited options.filename",piscina,6.0.0-rc.1,6.0.0-rc.2,,HIGH,CWE-1321;CWE-94,
 CVE-2026-55487,2026-06-26T23:18:13Z,"pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",pnpm,0,10.34.2,,HIGH,CWE-346;CWE-693;CWE-829,
 CVE-2026-55487,2026-06-26T23:18:13Z,"pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",pnpm,11.0.0,11.5.3,,HIGH,CWE-346;CWE-693;CWE-829,
+CVE-2026-55500,2026-07-06T21:37:49Z,"9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover",9router,0,,0.4.71,CRITICAL,CWE-200,
+CVE-2026-55501,2026-07-06T21:46:20Z,"9router: Login brute-force protection bypass via spoofed X-Forwarded-For header",9router,0,0.4.77,,HIGH,CWE-290;CWE-307,
 CVE-2026-55591,2026-06-18T21:13:36Z,"Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints",signalk-server,0,2.28.0,,MODERATE,CWE-918,
-CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,0.16.0,2.0.10,,MODERATE,CWE-20;CWE-187,
-CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,3.0.0,3.0.6,,MODERATE,CWE-20;CWE-187,
-CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,4.0.0,4.1.0,,MODERATE,CWE-20;CWE-187,
+CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,0.16.0,2.0.10,,MODERATE,CWE-187;CWE-20,
+CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,3.0.0,3.0.6,,MODERATE,CWE-187;CWE-20,
+CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,4.0.0,4.1.0,,MODERATE,CWE-187;CWE-20,
 CVE-2026-55603,2026-06-18T13:06:21Z,"http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`",http-proxy-middleware,3.0.4,3.0.7,,HIGH,CWE-93,
 CVE-2026-55603,2026-06-18T13:06:21Z,"http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`",http-proxy-middleware,4.0.0,4.1.1,,HIGH,CWE-93,
+CVE-2026-55608,2026-07-14T20:26:39Z,"n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode",n8n-mcp,0,2.57.4,,MODERATE,CWE-200;CWE-863,
 CVE-2026-55617,2026-06-18T13:06:35Z,"Hydro: Insufficient session expiration when recreating sessions",hydrooj,4.10.4,5.0.2,,MODERATE,CWE-613,
 CVE-2026-55650,2026-06-19T21:18:44Z,"Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure",@outerbase/studio,0,,0.10.2,MODERATE,CWE-79,
 CVE-2026-55660,2026-06-19T21:15:29Z,"TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover",@tinacms/app,0,2.5.6,,HIGH,"CWE-346;CWE-601;CWE-79;CWE-940",
@@ -7067,7 +7153,9 @@ CVE-2026-5758,2026-04-15T18:31:58Z,"Mafintosh's protocol-buffers-schema is vulne
 CVE-2026-5831,2026-04-09T03:31:14Z,"Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts",taskflow-ai,0,2.1.9,,MODERATE,CWE-77,
 CVE-2026-5832,2026-04-09T03:31:15Z,"api-lab-mcp vulnerable to SSRF",api-lab-mcp,0,,0.2.1,MODERATE,CWE-918,
 CVE-2026-5833,2026-04-09T06:30:27Z,"awwaiid mcp-server-taskwarrior vulnerable to command injection",mcp-server-taskwarrior,0,,1.0.1,LOW,CWE-74,
+CVE-2026-58399,2026-06-18T17:22:47Z,"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()",@acastellon/auth,0,2.3.0,,CRITICAL,CWE-290,
 CVE-2026-5842,2026-04-09T06:30:28Z,"decolua 9router vulnerable to authorization bypass",9router,0,0.3.75,,MODERATE,CWE-285,
+CVE-2026-59800,2026-07-02T20:17:56Z,"9router: Missing Authorization and OS Command Injection",9router,0,0.4.44,,CRITICAL,CWE-78;CWE-862,
 CVE-2026-5986,2026-04-10T00:30:31Z,"Zod jsVideoUrlParser vulnerable to ReDoS in util.js",js-video-url-parser,0,,0.5.1,MODERATE,CWE-400,
 CVE-2026-6011,2026-04-10T06:31:38Z,"OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts",openclaw,0,2026.1.29,,LOW,CWE-918,
 CVE-2026-6216,2026-04-13T21:30:45Z,"DbGate has cross site scripting via the  SVG Icon String Handler component",dbgate-web,0,7.1.5,,LOW,CWE-79,
@@ -7102,7 +7190,10 @@ CVE-2026-8769,2026-05-18T00:31:37Z,"@ai-sdk/provider-utils has an Uncontrolled R
 CVE-2026-8813,2026-05-29T17:58:37Z,"ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag",exifreader,2.10.0,4.39.0,,HIGH,CWE-1284,
 CVE-2026-8814,2026-05-29T17:52:26Z,"ExifReader is vulnerable to denial of service via unbounded decompression of image metadata",exifreader,4.20.0,4.39.0,,MODERATE,CWE-409,
 CVE-2026-9277,2026-06-09T14:27:15Z,"shell-quote quote() does not escape newlines in object .op values",shell-quote,1.1.0,1.8.4,,CRITICAL,CWE-77;CWE-78,
+CVE-2026-9495,2026-05-26T13:30:54Z,"@koa/router has an Access Control Bypass",@koa/router,14.0.0,15.0.0,,MODERATE,CWE-284,
+CVE-2026-9520,2026-05-26T13:30:53Z,"Blitz has a Cross-site Scripting issue",blitz,0,,3.0.2,LOW,CWE-79,
 CVE-2026-9595,2026-06-17T18:13:31Z,"webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies",webpack-dev-server,0,5.2.5,,MODERATE,CWE-346;CWE-441,
+CVE-2026-9673,2026-05-28T06:31:09Z,"json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio",json-2-csv,3.15.0,5.5.11,,MODERATE,CWE-1236,
 CVE-2026-9675,2026-06-18T14:28:10Z,"undici WebSocket client vulnerable to denial of service via cumulative fragment bypass",undici,8.0.0,8.5.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-9678,2026-06-18T14:28:13Z,"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",undici,7.0.0,7.28.0,,MODERATE,CWE-524,
 CVE-2026-9678,2026-06-18T14:28:13Z,"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",undici,8.0.0,8.5.0,,MODERATE,CWE-524,
@@ -7132,6 +7223,7 @@ GHSA-268h-hp4c-crq3,2026-06-15T17:36:06Z,"Nodemailer: CRLF injection in Nodemail
 GHSA-26hg-crh6-mjrw,2021-02-23T21:28:28Z,"Directory Traversal",list-n-stream,0,0.0.11,,HIGH,,
 GHSA-26pp-8wgv-hjvm,2026-04-08T00:17:02Z,"Hono missing validation of cookie name on write path in setCookie()",hono,0,4.12.12,,MODERATE,CWE-113,
 GHSA-26wg-9xf2-q495,2026-04-14T23:23:01Z,"Novu has a XSS sanitization bypass",novu/api,0,3.15.0,,HIGH,CWE-79,
+GHSA-275c-xpvc-jgfw,2026-07-02T17:11:03Z,"OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload",openclaw,0,2026.4.22,,MODERATE,CWE-613,
 GHSA-277h-px4m-62q8,2024-10-03T19:46:12Z,"@saltcorn/server arbitrary file zip read and download when downloading auto backups",@saltcorn/server,0,1.0.0-beta.14,,MODERATE,CWE-22,
 GHSA-277p-xwpp-3jf7,2020-09-02T15:49:22Z,"Malicious Package in rrgod",rrgod,0.0.0,,,CRITICAL,CWE-506,
 GHSA-27pq-2ph8-8x25,2026-06-16T21:31:59Z,"Duplicate Advisory: Shell positional parameters could weaken strict inline-eval checks",openclaw,0,,,HIGH,CWE-184,
@@ -7142,6 +7234,7 @@ GHSA-28hp-fgcr-2r4h,2019-06-27T17:25:42Z,"Cross-Site Scripting via JSONP",angula
 GHSA-28qq-5f47-r5x2,2026-01-23T06:31:23Z,"Duplicate Advisory: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)",gemini-mcp-tool,1.1.2,1.1.6,,CRITICAL,CWE-78,
 GHSA-28xh-wpgr-7fm8,2019-06-20T15:35:49Z,"Command Injection in open",open,0,6.0.0,,CRITICAL,CWE-77,
 GHSA-28xx-8j99-m32j,2020-09-01T20:37:25Z,"Malicious Package in nginxbeautifier",nginxbeautifier,1.0.14,1.0.15,,CRITICAL,CWE-506,
+GHSA-2944-57xv-2682,2026-07-02T19:07:44Z,"@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-918,
 GHSA-29fh-xcjr-p7rx,2020-09-03T17:02:22Z,"Malicious Package in web3-eht",web3-eht,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2c83-wfv3-q25f,2021-09-07T23:07:56Z,"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown",rebber,0,5.2.1,,CRITICAL,CWE-78,
 GHSA-2cf5-4w76-r9qv,2020-09-04T14:57:38Z,"Arbitrary Code Execution in handlebars",handlebars,0,3.0.8,,HIGH,CWE-94,
@@ -7161,6 +7254,7 @@ GHSA-2hqf-qqmq-pgpp,2020-09-02T15:48:16Z,"Malicious Package in commander-js",com
 GHSA-2hv5-4h3g-4hjv,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification",openclaw,0,2026.3.31,,MODERATE,CWE-799,
 GHSA-2hwp-g4g7-mwwj,2019-05-29T20:25:35Z,"Reflected Cross-Site Scripting in jquery.terminal",jquery.terminal,0,1.21.0,,MODERATE,CWE-79,
 GHSA-2j53-2c28-g9v2,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement",openclaw,0,2026.3.22,,MODERATE,CWE-696,
+GHSA-2j8v-hwgc-x698,2026-07-02T15:57:49Z,"OpenClaw: Shell wrapper argv could change between approval and execution",Openclaw,0,2026.5.18,,HIGH,CWE-284,
 GHSA-2jm5-2cqf-6vw9,2020-09-04T15:30:32Z,"Malicious Package in baes-x",baes-x,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2m96-9w4j-wgv7,2020-09-03T18:06:00Z,"Prototype Pollution in lodash.merge",lodash.merge,0,4.6.1,,HIGH,CWE-1321,
 GHSA-2mc2-g238-722j,2026-03-03T21:35:21Z,"OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)",openclaw,0,2026.2.19,,MODERATE,CWE-295;CWE-78,
@@ -7176,6 +7270,8 @@ GHSA-2r2p-4cgf-hv7h,2026-04-22T14:52:03Z,"engram: HTTP server CORS wildcard + au
 GHSA-2r8f-2665-3gxq,2020-09-02T21:36:36Z,"Malicious Package in froever",froever,0,,,CRITICAL,CWE-506,
 GHSA-2r8f-cf6w-x5vq,2026-02-03T18:30:47Z,"Duplicate Advisory: FUXA contains a hard-coded credential vulnerability",fuxa-server,0,,1.2.7,HIGH,CWE-798,
 GHSA-2rqg-gjgv-84jm,2026-03-13T20:55:30Z,"OpenClaw: Gateway `agent` calls could override the workspace boundary",openclaw,0,2026.3.11,,HIGH,CWE-668,
+GHSA-2vg6-77g8-24mp,2026-07-07T20:56:45Z,"Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows",@better-auth/scim,1.6.0,1.6.11,,LOW,CWE-459;CWE-613;CWE-672,
+GHSA-2vg6-77g8-24mp,2026-07-07T20:56:45Z,"Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows",better-auth,0.3.4,1.6.11,,LOW,CWE-459;CWE-613;CWE-672,
 GHSA-2vqq-jgxx-fxjc,2020-09-11T21:24:33Z,"Malicious Package in motiv.scss",motiv.scss,0.4.20,0.4.21,,CRITICAL,CWE-506,
 GHSA-2vx9-7wpg-88jq,2026-05-19T15:55:43Z,"n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions",n8n,0,2.19.3,,MODERATE,CWE-22,
 GHSA-2w22-3f6x-3hf4,2026-06-16T21:32:00Z,"Duplicate Advisory: Workspace-derived service PATH could influence trash command selection",openclaw,0,,,HIGH,CWE-426,
@@ -7185,6 +7281,7 @@ GHSA-2w9p-xf5h-qwj3,2023-03-27T03:30:16Z,"Duplicate Advisory: pullit Command Inj
 GHSA-2xp4-qhr4-xqm2,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode",openclaw,0,2026.3.31,,LOW,CWE-352,
 GHSA-2xv3-h762-ccxv,2019-05-29T19:18:02Z,"Out-of-bounds Read in concat-with-sourcemaps",concat-with-sourcemaps,1.0.0,1.0.6,,MODERATE,CWE-125,
 GHSA-2xw5-3767-qxvm,2020-09-11T21:21:20Z,"Malicious Package in ng-ui-library",ng-ui-library,1.0.987,1.0.990,,CRITICAL,CWE-506,
+GHSA-322x-v876-g883,2026-07-02T20:19:20Z,"@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write","@asymmetric-effort/nogginlessdom",0,0.0.22,,HIGH,CWE-22,
 GHSA-3233-rgx3-c2wh,2018-10-09T00:38:09Z,"Moderate severity vulnerability that affects mustache",mustache,0,2.2.1,,MODERATE,,
 GHSA-32vw-r77c-gm67,2020-08-03T17:57:05Z,"Withdrawn Advisory: marked cross-site scripting vulnerability",marked,0,0.3.3,,MODERATE,,
 GHSA-33gc-f8v9-v8hm,2020-09-01T20:41:40Z,"Malicious Package in ladder-text-js",ladder-text-js,0,,,CRITICAL,CWE-506,
@@ -7204,6 +7301,7 @@ GHSA-36r8-9qq7-mh43,2020-09-03T17:02:40Z,"Malicious Package in we3b",we3b,0.0.0,
 GHSA-36rh-ggpr-j3gj,2020-09-14T16:38:40Z,"Renovate vulnerable to Azure DevOps token leakage in logs",renovate,19.180.0,23.25.1,,MODERATE,,
 GHSA-377f-vvrc-9wgg,2020-09-03T19:09:07Z,"Malicious Package in zemen",zemen,0.0.5,0.0.6,,CRITICAL,CWE-506,
 GHSA-37vc-gwvp-6cgv,2020-09-04T15:42:49Z,"Malicious Package in bitcoijns-lib",bitcoijns-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-382c-vx95-w3p5,2026-07-09T13:44:51Z,"Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data","@jsonbored/gittensory-mcp",0,,0.1.0,MODERATE,CWE-284,
 GHSA-3846-mfvc-xwpf,2026-03-19T03:30:57Z,"Duplicate Advisory: Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains",openclaw,0,,,HIGH,CWE-78,
 GHSA-388g-jwpg-x6j4,2020-09-11T21:20:14Z,"Cross-Site Scripting in swagger-ui",swagger-ui,0,3.0.13,,MODERATE,CWE-79,
 GHSA-38c7-23hj-2wgq,2026-02-26T22:47:06Z,"n8n has Webhook Forgery on Zendesk Trigger Node",n8n,0,1.123.18,,MODERATE,CWE-290,
@@ -7252,6 +7350,7 @@ GHSA-3rw8-4xrq-3f7p,2025-03-17T21:30:34Z,"Duplicate Advisory: Uptime Kuma ReDoS
 GHSA-3v3j-737j-7g74,2026-06-16T21:31:59Z,"Duplicate Advisory: Linux and macOS exec allowlists skipped configured argument patterns",openclaw,0,,,HIGH,CWE-693,
 GHSA-3w6x-gv34-mqpf,2026-03-26T21:24:34Z,"OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement",openclaw,0,2026.3.22,,HIGH,CWE-862,
 GHSA-3wqh-h42r-x8fq,2020-09-03T15:46:22Z,"Denial of Service in @hapi/content",@hapi/content,0,5.0.2,,HIGH,,
+GHSA-3wqp-prf6-2m72,2026-07-02T17:08:08Z,"OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement",openclaw,0,2026.5.6,,LOW,CWE-862,
 GHSA-3xc7-xg67-pw99,2019-06-05T20:43:10Z,"Sensitive Data Exposure in sequelize-cli",sequelize-cli,0,,5.4.0,LOW,CWE-532,
 GHSA-3xx2-mqjm-hg9x,2026-04-16T22:49:46Z,"Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise",@paperclipai/server,0,2026.416.0,,CRITICAL,CWE-639,
 GHSA-435c-qcpm-wjw5,2020-09-03T17:05:43Z,"Malicious Package in fs-extar",fs-extar,0.0.0,,,CRITICAL,CWE-506,
@@ -7297,6 +7396,7 @@ GHSA-4jqc-jvh2-pxg9,2022-06-17T01:11:10Z,"Path traversal for local publishers in
 GHSA-4jqc-jvh2-pxg9,2022-06-17T01:11:10Z,"Path traversal for local publishers in TechDocs backend","@backstage/techdocs-common",0,0.11.16,,MODERATE,,
 GHSA-4m3j-h8f2-4xh4,2020-09-03T19:41:31Z,"Malicious Package in coinstrig",coinstrig,0.0.0,,,CRITICAL,CWE-506,
 GHSA-4m3p-x2hp-2pgx,2020-09-04T16:45:23Z,"Malicious Package in bitcroe-lib",bitcroe-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-4m3v-q747-pc6h,2026-07-02T17:13:01Z,"OpenClaw: Mattermost slash token revocation could lag until monitor refresh",openclaw,0,2026.4.24,,MODERATE,CWE-613,
 GHSA-4mhr-cxr4-2prm,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests",openclaw,2026.4.5,2026.4.20,,MODERATE,CWE-441,
 GHSA-4pmg-jgm5-3jg6,2020-09-02T21:16:26Z,"Malicious Package in erquest",erquest,0,,,CRITICAL,CWE-506,
 GHSA-4q2f-8g74-qm56,2020-09-03T17:18:05Z,"Cross-Site Scripting in takeapeek",takeapeek,0.0.0,,,HIGH,CWE-79,
@@ -7371,6 +7471,7 @@ GHSA-59xv-588h-2vmm,2026-04-10T19:30:32Z,"@saltcorn/data vulnerable to SQL Injec
 GHSA-59xv-588h-2vmm,2026-04-10T19:30:32Z,"@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler",@saltcorn/data,1.5.0,1.5.5,,LOW,CWE-89,
 GHSA-59xv-588h-2vmm,2026-04-10T19:30:32Z,"@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler",@saltcorn/data,1.6.0-alpha.0,1.6.0-beta.4,,LOW,CWE-89,
 GHSA-5c6j-r48x-rmvq,2026-02-28T02:50:45Z,"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",serialize-javascript,0,7.0.3,,HIGH,CWE-96,
+GHSA-5c7w-4wm3-85vw,2026-07-02T19:00:12Z,"@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-943,
 GHSA-5ccf-884p-4jjq,2025-03-20T12:32:51Z,"Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability",open-webui,0,,0.3.21,HIGH,CWE-400,
 GHSA-5cp4-xmrw-59wf,2020-08-05T21:47:02Z,"XSS via JQLite DOM manipulation functions in AngularJS",angular,0,1.8.0,,MODERATE,CWE-79,
 GHSA-5cph-wvm9-45gj,2024-11-21T22:21:03Z,"Flowise OverrideConfig security vulnerability",flowise,0,2.1.4,,HIGH,CWE-15,
@@ -7413,7 +7514,7 @@ GHSA-5r8f-96gm-5j6g,2026-04-01T00:00:34Z,"OpenClaw Gateway `operator.write` can
 GHSA-5rp4-cwgh-gvwq,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes",openclaw,0,2026.3.12,,MODERATE,CWE-78,
 GHSA-5rqg-jm4f-cqx7,2022-01-10T17:29:53Z,"Infinite loop causing Denial of Service in colors",colors,1.4.1,,1.4.2,HIGH,CWE-835,
 GHSA-5rrq-pxf6-6jx5,2022-01-08T00:22:42Z,"Prototype Pollution in node-forge debug API.",node-forge,0,1.0.0,,LOW,CWE-1321,
-GHSA-5v72-xg48-5rpm,2019-06-04T19:37:52Z,"Denial of Service in ws",ws,0.2.6,1.1.5,,HIGH,CWE-400,
+GHSA-5v72-xg48-5rpm,2019-06-04T19:37:52Z,"Denial of Service in ws",ws,0.6.0,1.1.5,,HIGH,CWE-400,
 GHSA-5v72-xg48-5rpm,2019-06-04T19:37:52Z,"Denial of Service in ws",ws,2.0.0,3.3.1,,HIGH,CWE-400,
 GHSA-5v7r-jg9r-vq44,2020-09-03T21:19:46Z,"Insecure Cryptography Algorithm in simple-crypto-js",simple-crypto-js,0,2.3.0,,MODERATE,CWE-327,
 GHSA-5vj8-3v2h-h38v,2020-09-04T18:04:08Z,"Remote Code Execution in next",next,0.9.9,5.1.0,,HIGH,CWE-20,
@@ -7427,6 +7528,7 @@ GHSA-5wrg-8fxp-cx9r,2023-06-21T22:06:22Z,"passport-wsfed-saml2 Signature Bypass
 GHSA-5x7p-gm79-383m,2020-09-01T21:11:57Z,"Malicious Package in regenraotr",regenraotr,0,,,CRITICAL,CWE-506,
 GHSA-5x8q-gj67-rhf2,2020-09-02T21:18:33Z,"Malicious Package in discord_debug_log",discord_debug_log,0,,,CRITICAL,CWE-506,
 GHSA-629c-j867-3v45,2020-09-04T16:41:04Z,"Malicious Package in bitcoisnj-lib",bitcoisnj-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-62gx-5q78-wrvx,2026-07-15T21:56:45Z,"obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete",obsidian-local-rest-api,0,,,HIGH,CWE-22,
 GHSA-6343-m2qr-66gf,2020-09-03T23:10:41Z,"Malicious Package in js-sja3",js-sja3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6394-6h9h-cfjg,2019-06-07T21:12:35Z,"Regular Expression Denial of Service",nwmatcher,0,1.4.4,,MODERATE,CWE-400,
 GHSA-63f5-hhc7-cx6p,2026-03-16T20:40:23Z,"OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval",openclaw,0,2026.3.13,,HIGH,CWE-269,
@@ -7465,6 +7567,7 @@ GHSA-69mf-2cw2-38m8,2020-09-03T23:04:40Z,"Malicious Package in js-shc3",js-shc3,
 GHSA-69p9-9qm9-h447,2020-08-19T22:34:43Z,"Sandbox Breakout / Arbitrary Code Execution in safer-eval",safer-eval,0,1.3.2,,MODERATE,,
 GHSA-69r6-7h4f-9p7q,2020-09-03T20:41:01Z,"Malicious Package in discord.js-user",discord.js-user,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6c37-2rw5-9j7x,2020-09-02T20:25:46Z,"Malicious Package in requesst",requesst,0,,,CRITICAL,CWE-506,
+GHSA-6c4r-g249-wv3c,2026-07-02T17:06:10Z,"OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts",openclaw,0,2026.4.26,,MODERATE,CWE-668,
 GHSA-6chw-6frg-f759,2020-04-03T21:48:38Z,"Regular Expression Denial of Service in Acorn",acorn,5.5.0,5.7.4,,HIGH,CWE-400,
 GHSA-6chw-6frg-f759,2020-04-03T21:48:38Z,"Regular Expression Denial of Service in Acorn",acorn,6.0.0,6.4.1,,HIGH,CWE-400,
 GHSA-6chw-6frg-f759,2020-04-03T21:48:38Z,"Regular Expression Denial of Service in Acorn",acorn,7.0.0,7.1.1,,HIGH,CWE-400,
@@ -7522,6 +7625,8 @@ GHSA-76qf-6mvw-c5hm,2020-09-03T19:45:42Z,"Malicious Package in js-base64-int",js
 GHSA-76xq-58hj-vwm2,2020-09-11T21:16:59Z,"Malicious Package in test-module-a",test-module-a,0,,,CRITICAL,CWE-506,
 GHSA-779f-wgxg-qr8f,2020-09-03T18:10:22Z,"Prototype Pollution in lodash.mergewith",lodash.mergewith,0,4.6.2,,HIGH,CWE-1321,
 GHSA-77hf-7fqf-f227,2026-03-03T21:32:35Z,"OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)",openclaw,0,2026.3.2,,MODERATE,CWE-400;CWE-409,
+GHSA-77pv-3w4q-vrj5,2026-07-02T16:56:24Z,"OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks",openclaw,0,2026.4.27,,MODERATE,CWE-863,
+GHSA-77q5-rr5v-x43q,2026-07-02T17:22:11Z,"OpenClaw: Trusted retry endpoint checks could match hostname prefixes",openclaw,0,2026.5.7,,HIGH,CWE-1023;CWE-20;CWE-345,
 GHSA-785g-gx74-gr39,2020-09-03T23:12:48Z,"Malicious Package in js-wha3",js-wha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-788m-pj96-7w2c,2020-09-02T21:23:51Z,"Cross-Site Scripting in fomantic-ui",fomantic-ui,0,2.7.0,,HIGH,CWE-79,
 GHSA-78p3-fwcq-62c2,2024-10-03T19:50:59Z,"@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution  by manipulating `lang` and  `defstring` parameters when setting localizer strings",@saltcorn/server,0,1.0.0-beta.14,,HIGH,CWE-1321,
@@ -7583,6 +7688,7 @@ GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",
 GHSA-82rm-qcfx-2v78,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay",openclaw,2026.4.10,2026.4.14,,MODERATE,CWE-862,
 GHSA-83pq-466j-fc6j,2020-09-04T15:17:50Z,"Prototype Pollution in sahmat",sahmat,0.0.0,,,HIGH,CWE-1321,
 GHSA-83rx-c8cr-6j8q,2019-06-05T20:48:55Z,"Insecure Default Configuration in tesseract.js",tesseract.js,0,1.0.19,,MODERATE,CWE-829,
+GHSA-83w9-h5wv-j9xm,2026-07-02T16:23:41Z,"OpenClaw: Node pairing reconnection could confuse approval scope state",openclaw,0,2026.5.27,,HIGH,CWE-367,
 GHSA-846p-hgpv-vphc,2026-04-07T18:15:00Z,"OpenClaw: QQ Bot structured payloads could read arbitrary local files",openclaw,0,2026.4.2,,MODERATE,CWE-22,
 GHSA-84c3-j8r2-mcm8,2024-02-26T20:10:10Z,"@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys",@nfid/embed,0.10.0,0.10.1-alpha.6,,CRITICAL,CWE-321;CWE-330,
 GHSA-84jw-g43v-8gjm,2024-09-19T17:30:05Z,"DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS",@rspack/core,0,1.0.0-rc.1,,MODERATE,CWE-79,
@@ -7592,6 +7698,8 @@ GHSA-855m-jchh-9qjc,2020-09-02T20:19:22Z,"Malicious Package in commnader",commna
 GHSA-85q4-v37c-wfpc,2020-09-04T15:39:28Z,"Malicious Package in bitcion-ops",bitcion-ops,0.0.0,,,CRITICAL,CWE-506,
 GHSA-866c-wwm5-4rj7,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing",openclaw,0,,2026.2.24,MODERATE,CWE-294,
 GHSA-86gv-xpwv-jprc,2020-09-03T17:36:00Z,"Malicious Package in diamond-clien",diamond-clien,0.0.0,,,CRITICAL,CWE-506,
+GHSA-86j7-9j95-vpqj,2026-07-07T20:55:28Z,"Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp",better-auth,0,1.6.13,,HIGH,CWE-601;CWE-79,
+GHSA-86j7-9j95-vpqj,2026-07-07T20:55:28Z,"Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp",better-auth,1.7.0-beta.0,1.7.0-beta.4,,HIGH,CWE-601;CWE-79,
 GHSA-86jj-29wc-7q2w,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks",openclaw,0,,2026.2.24,MODERATE,CWE-863,
 GHSA-86mr-6m89-vgj3,2020-09-03T15:51:38Z,"Buffer Overflow in node-weakauras-parser",node-weakauras-parser,1.0.4,1.0.5,,MODERATE,CWE-120,
 GHSA-86mr-6m89-vgj3,2020-09-03T15:51:38Z,"Buffer Overflow in node-weakauras-parser",node-weakauras-parser,2.0.0,2.0.2,,MODERATE,CWE-120,
@@ -7703,6 +7811,7 @@ GHSA-98pf-gfh3-x3mp,2022-11-10T16:02:51Z,"Read the Docs vulnerable to Cross-Site
 GHSA-992f-wf4w-x36v,2020-09-01T21:16:13Z,"Prototype Pollution in merge-objects",merge-objects,0.0.0,,,LOW,CWE-1321,
 GHSA-9959-c6q6-6qp3,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects validator",validator,0,2.0.0,,MODERATE,,
 GHSA-99pg-hqvx-r4gf,2025-09-15T20:00:39Z,"Flowise has an Arbitrary File Read",flowise,3.0.5,3.0.6,,CRITICAL,,
+GHSA-9c3v-684m-579c,2026-07-01T22:09:28Z,"OpenClaw MCP SSE redirects could forward Authorization headers",openclaw,0,2026.6.5,,MODERATE,CWE-200;CWE-522;CWE-601,
 GHSA-9c83-rr99-vfwj,2026-06-19T21:42:24Z,"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested",@bitbonsai/mcpvault,0,0.11.5,,MODERATE,CWE-22;CWE-538,
 GHSA-9cph-cqqh-36pw,2020-09-04T15:29:25Z,"Malicious Package in babel-loqder",babel-loqder,0.0.0,,,CRITICAL,CWE-506,
 GHSA-9f72-qcpw-2hxc,2026-03-03T19:08:08Z,"OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs",openclaw,0,2026.2.24,,HIGH,CWE-200;CWE-284,
@@ -7710,7 +7819,9 @@ GHSA-9f79-7pw8-3fj8,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw: workspac
 GHSA-9ggv-8w38-r7pm,2026-06-19T19:18:49Z,"TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)",typeorm,0.1.12,0.3.29,,MODERATE,CWE-89,
 GHSA-9gvx-vj57-vqqx,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication",openclaw,0,2026.3.23,,MODERATE,CWE-288,
 GHSA-9gxr-rhx6-4jgv,2020-09-04T15:18:57Z,"Sandbox Breakout / Prototype Pollution in notevil",notevil,0,1.3.3,,MODERATE,CWE-1321,
+GHSA-9h47-pqcx-hjr4,2026-07-07T20:55:41Z,"Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default",better-auth,0,1.6.11,,HIGH,CWE-1188;CWE-327;CWE-757,
 GHSA-9h6g-pr28-7cqp,2024-01-31T22:42:54Z,"nodemailer ReDoS when trying to send a specially crafted email",nodemailer,0,6.9.9,,MODERATE,CWE-1333,
+GHSA-9hc2-hjx8-q6pv,2026-07-14T19:52:41Z,"TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution",tidgi,0,,0.13.0,CRITICAL,CWE-94,
 GHSA-9hc2-w9gg-q6jw,2020-09-01T21:07:41Z,"Malicious Package in boogeyman",boogeyman,0.0.0,,,CRITICAL,CWE-506,
 GHSA-9hqj-38j2-5jgm,2020-09-01T21:19:23Z,"Command Injection in ascii-art",ascii-art,0,1.4.4,,LOW,CWE-77,
 GHSA-9hrv-gvrv-6gf2,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise,0,3.1.0,,MODERATE,CWE-918,
@@ -7768,6 +7879,7 @@ GHSA-9xgp-hfw7-73rq,2020-08-19T21:30:04Z,"Authentication Weakness in keystone",k
 GHSA-9xr8-8hmc-389f,2019-11-22T13:45:33Z,"Cross-Site Scripting in vant",vant,0,2.1.8,,HIGH,CWE-79,
 GHSA-9xww-fwh9-95c5,2020-09-02T21:43:59Z,"Malicious Package in uglyfi-js",uglyfi-js,0,,,CRITICAL,CWE-506,
 GHSA-c27r-x354-4m68,2020-10-27T20:39:46Z,"xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion",xml-crypto,0,2.0.0,,HIGH,CWE-287,
+GHSA-c29c-2q9c-pc86,2026-07-02T16:43:38Z,"OpenClaw: Slack allowFrom could bind to mutable display names",openclaw,0,2026.5.3,,HIGH,CWE-290,
 GHSA-c2fv-2fmj-9xrx,2025-07-28T06:30:23Z,"Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability",ssrfcheck,0,1.2.0,,HIGH,CWE-918,
 GHSA-c2g6-57fp-22wp,2020-09-03T22:48:35Z,"Malicious Package in fuffer-xor",fuffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-c35v-qwqg-87jc,2019-06-06T15:32:32Z,"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison",express-basic-auth,0,1.1.7,,LOW,CWE-208,
@@ -7819,6 +7931,7 @@ GHSA-cp47-r258-q626,2023-03-02T23:36:22Z," Vega vulnerable to arbitrary code exe
 GHSA-cpgr-wmr9-qxv4,2020-09-11T21:20:14Z,"Cross-Site Scripting in serve",serve,0,10.0.2,,MODERATE,CWE-79,
 GHSA-cpqf-f22c-r95x,2025-12-12T16:41:08Z,"Vite Plugin React has a Denial of Service Vulnerability in React Server Components",@vitejs/plugin-rsc,0,0.5.7,,HIGH,CWE-1395;CWE-400;CWE-502,
 GHSA-cqmh-pcgr-q42f,2026-05-06T23:23:25Z,"@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening",@axonflow/openclaw,0,2.0.0,,MODERATE,CWE-552;CWE-732,
+GHSA-cqwv-9qjx-vxw2,2026-07-02T16:38:03Z,"OpenClaw: Skill Workshop apply flow could override pending approval",openclaw,0,2026.5.6,,MODERATE,CWE-807,
 GHSA-cr3w-cw5w-h3fj,2026-01-26T23:34:49Z,"Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE",@saltcorn/server,1.1.1,1.5.0-beta.19,,CRITICAL,CWE-77;CWE-79,
 GHSA-cr4x-w2v7-4mmf,2020-09-03T22:26:13Z,"Malicious Package in bufver-xor",bufver-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-cr56-66mx-293v,2020-09-03T15:53:50Z,"Cross-Site Scripting in @toast-ui/editor",@toast-ui/editor,0,2.2.0,,HIGH,CWE-79,
@@ -7831,7 +7944,7 @@ GHSA-crhg-xgrg-vvcc,2023-01-13T21:34:29Z,"a12nserver vulnerable to potential SQL
 GHSA-crpm-fm48-chj7,2020-09-11T21:13:44Z,"SQL Injection in resquel",resquel,0,,,HIGH,CWE-89,
 GHSA-crr2-ph72-c52g,2020-09-03T17:27:22Z,"Malicious Package in my-very-own-package",my-very-own-package,0.0.0,,,CRITICAL,CWE-506,
 GHSA-crvj-3gj9-gm2p,2018-10-09T00:44:29Z,"High severity vulnerability that affects qs",qs,0,1.0.0,,HIGH,,
-GHSA-cv3v-7846-6pxm,2020-09-03T21:15:19Z,"Unauthorized File Access in node-git-server",node-git-server,0,0.6.1,,HIGH,CWE-552,
+GHSA-cv3v-7846-6pxm,2020-09-03T21:15:19Z,"Unauthorized File Access in node-git-server",node-git-server,0.2.0,0.6.1,,HIGH,CWE-552,
 GHSA-cvfm-xjc8-f2vm,2020-09-03T15:46:36Z,"Denial of Service in @commercial/subtext",@commercial/subtext,5.1.1,5.1.2,,HIGH,,
 GHSA-cw28-63x4-37c3,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection",openclaw,0,2026.3.31,,MODERATE,CWE-367,
 GHSA-cwj3-vqpp-pmxr,2026-05-05T18:44:31Z,"OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes",openclaw,0,2026.4.23,,HIGH,CWE-862,
@@ -7868,6 +7981,9 @@ GHSA-f8r2-vg7x-gh8m,2026-03-13T20:55:03Z,"OpenClaw: Exec approval allowlist patt
 GHSA-f8rq-m28h-8hxj,2020-09-03T15:50:29Z,"Cross-Site Scripting in htmr",htmr,0,0.8.7,,HIGH,CWE-79,
 GHSA-f8vf-6hwg-hw55,2020-09-04T15:38:21Z,"Malicious Package in bictore-lib",bictore-lib,0.0.0,,,CRITICAL,CWE-506,
 GHSA-f934-5rqf-xx47,2026-04-17T22:33:33Z,"OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths",openclaw,0,2026.4.15,,MODERATE,CWE-22,
+GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/auth,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
+GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/mcp,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
+GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/plugin-core,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
 GHSA-ff5x-w9wg-h275,2020-03-06T01:15:46Z,"Holder can generate proof of ownership for credentials it does not control in vp-toolkit",vp-toolkit,0,0.2.2,,HIGH,,
 GHSA-ff6g-gm92-rf32,2020-09-03T19:42:06Z,"Malicious Package in coinstirng",coinstirng,0.0.0,,,CRITICAL,CWE-506,
 GHSA-ff98-w8hj-qrxf,2026-03-03T21:39:26Z,"OpenClaw plugin runtime command execution is part of trusted plugin boundary",openclaw,0,2026.2.19,,MODERATE,CWE-78,
@@ -7956,13 +8072,13 @@ GHSA-gcfc-mgg3-8j2c,2020-09-03T18:11:29Z,"Malicious Package in sdfjghlkfjdshlkjd
 GHSA-gcj7-r3hg-m7w6,2026-03-03T22:25:37Z,"OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity",openclaw,0,2026.2.26,,LOW,CWE-294;CWE-345,
 GHSA-gf8q-jrpm-jvxq,2022-01-08T00:22:02Z,"URL parsing in node-forge could lead to undesired behavior.",node-forge,0,1.0.0,,LOW,CWE-601,
 GHSA-gfg9-5357-hv4c,2026-04-29T21:34:39Z,"OpenClaw: Webchat audio embedding could read local files without local-root containment",openclaw,0,2026.4.15,,MODERATE,CWE-200;CWE-22,
-GHSA-gfj5-979r-92pw,2026-06-18T17:22:47Z,"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()",@acastellon/auth,0,2.3.0,,CRITICAL,CWE-290,
 GHSA-gfj6-p24g-6hpm,2020-09-03T22:55:06Z,"Malicious Package in jc-sha3",jc-sha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gfjr-xqhm-qvv3,2020-09-02T20:16:09Z,"Malicious Package in aysnc",aysnc,0,,,CRITICAL,CWE-506,
 GHSA-gfm8-g3vm-53jh,2020-09-03T17:21:19Z,"Malicious Package in leetlog",leetlog,0.1.2,,,CRITICAL,CWE-506,
 GHSA-gfmx-pph7-g46x,2026-04-09T14:22:14Z,"OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade",openclaw,0,2026.4.8,,HIGH,CWE-501,
 GHSA-gfp8-mp24-5vxg,2026-05-21T20:43:27Z,"@hulumi/baseline: CloudTrail selector tampering events were not fully detected",@hulumi/baseline,0,1.3.2,,MODERATE,CWE-778,
 GHSA-ggm6-h3mx-cmmp,2026-03-19T03:30:57Z,"Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags",openclaw,0,,2026.2.17,LOW,CWE-78,
+GHSA-gj2h-2fpw-fhv9,2026-07-02T20:16:12Z,"@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration",@nuxt/ui,0,,4.7.1,MODERATE,CWE-200;CWE-598,
 GHSA-gjhc-6xm7-mc8q,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,5.9.0,,MODERATE,CWE-79,
 GHSA-gjph-xf5q-6mfq,2020-09-03T15:46:02Z,"Denial of Service in @hapi/ammo",@hapi/ammo,0,3.1.2,,HIGH,,
 GHSA-gjph-xf5q-6mfq,2020-09-03T15:46:02Z,"Denial of Service in @hapi/ammo",@hapi/ammo,4.0.0,5.0.1,,HIGH,,
@@ -7972,6 +8088,7 @@ GHSA-gm9m-x74r-8whg,2026-03-31T15:31:56Z,"Duplicate Advisory: OpenClaw's Nextclo
 GHSA-gm9x-q798-hmr4,2020-07-29T14:53:40Z,"Command Injection in git-tags-remote",git-tags-remote,0,1.0.4,,HIGH,CWE-78,
 GHSA-gmjp-776j-2394,2020-09-03T17:04:24Z,"Malicious Package in ripmed160",ripmed160,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gp3q-wpq4-5c5h,2026-03-12T14:21:45Z,"OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries",openclaw,0,2026.2.26,,HIGH,CWE-863,
+GHSA-gp79-m99v-gjmh,2026-07-02T16:45:14Z,"OpenClaw: Mattermost handlers could fall open when channel type was missing",openclaw,0,2026.5.6,,MODERATE,CWE-636,
 GHSA-gpg2-7r7j-4pm9,2020-09-03T22:09:56Z,"Malicious Package in buffer-xob",buffer-xob,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gpv5-7x3g-ghjv,2023-06-15T19:05:13Z,"fast-xml-parser regex vulnerability patch could be improved from a safety perspective",fast-xml-parser,4.2.4,4.2.5,,LOW,,
 GHSA-gq3j-xvxp-8hrf,2026-02-19T20:15:59Z,"Hono added timing comparison hardening in basicAuth and bearerAuth",hono,0,4.11.10,,LOW,CWE-208,
@@ -7981,6 +8098,7 @@ GHSA-gqq4-937c-2282,2020-09-03T22:49:42Z,"Malicious Package in juffer-xor",juffe
 GHSA-gqqj-85qm-8qhf,2026-04-16T22:47:40Z,"Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email",paperclipai,0,,2026.403.0,HIGH,CWE-284,
 GHSA-gr4j-r575-g665,2020-08-25T14:04:47Z,"Cross-Site Scripting in highcharts",highcharts,0,7.2.2,,HIGH,CWE-79,
 GHSA-gr4j-r575-g665,2020-08-25T14:04:47Z,"Cross-Site Scripting in highcharts",highcharts,8.0.0,8.1.1,,HIGH,CWE-79,
+GHSA-grc3-2j34-p6gm,2026-07-02T16:53:15Z,"OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs",openclaw,0,2026.5.2,,MODERATE,CWE-522,
 GHSA-gv2f-q4wp-fvh5,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials",openclaw,0,2026.3.28,,HIGH,CWE-346,
 GHSA-gv7w-rqvm-qjhr,2026-06-12T20:08:59Z,"Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY",esbuild,0.17.0,0.28.1,,HIGH,CWE-426;CWE-494,
 GHSA-gvff-25cc-4f66,2020-09-03T17:15:56Z,"Path Traversal in restify-swagger-jsdoc",restify-swagger-jsdoc,0,3.2.1,,HIGH,CWE-22,
@@ -8034,6 +8152,7 @@ GHSA-h9h6-pwqv-j9hv,2026-06-16T21:32:00Z,"Duplicate Advisory: Bootstrap token re
 GHSA-h9wq-xcqx-mqxm,2023-07-11T22:46:19Z,"Vendure Cross Site Request Forgery vulnerability impacting all API requests",@vendure/core,0,2.0.3,,LOW,,
 GHSA-h9wr-xr4r-66fh,2020-09-03T18:20:20Z,"Cross-Site Scripting in dmn-js-properties-panel",dmn-js-properties-panel,0,0.3.0,,HIGH,CWE-79,
 GHSA-hc4w-hm59-9w88,2026-06-16T21:31:59Z,"Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment",openclaw,0,,2026.4.24,LOW,CWE-636,
+GHSA-hcm3-8f6r-6xwg,2026-07-02T16:54:44Z,"OpenClaw: Browser debug/export routes could reuse already-open blocked tabs",openclaw,0,2026.4.29,,MODERATE,CWE-862,
 GHSA-hfpr-jhpq-x4rm,2026-03-09T19:54:41Z,"OpenClaw: `operator.write` chat.send could reach admin-only config writes",openclaw,0,2026.3.7,,MODERATE,CWE-863,
 GHSA-hfwx-c7q6-g54c,2021-03-12T23:04:46Z,"Vulnerability allowing for reading internal HTTP resources",highcharts-export-server,0,2.1.0,,HIGH,CWE-552,
 GHSA-hfxh-rjv7-2369,2023-11-27T17:25:11Z,"Uptime Kuma Authenticated remote code execution via TailscalePing",uptime-kuma,1.23.0,1.23.7,,MODERATE,,
@@ -8066,7 +8185,9 @@ GHSA-hv93-r4j3-q65f,2026-02-17T16:43:34Z,"OpenClaw Hook Session Key Override Ena
 GHSA-hvgc-mggg-pxr2,2020-09-03T23:02:33Z,"Malicious Package in js-sha7",js-sha7,0.0.0,,,CRITICAL,CWE-506,
 GHSA-hvqh-jw65-wcpq,2026-06-22T23:00:50Z,"devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs",devbridge-autocomplete,0,2.0.1,,MODERATE,CWE-79,
 GHSA-hvxq-j2r4-4jm8,2020-09-03T20:31:04Z,"Regular Expression Denial of Service in sql-injection",sql-injection,0.0.0,,,HIGH,,
+GHSA-hw9r-h9mr-4jff,2026-07-02T16:06:00Z,"OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
 GHSA-hwh3-fhf6-73x9,2020-09-04T15:36:09Z,"Malicious Package in bictoinjs-lib",bictoinjs-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-hx4v-668p-g2qr,2026-05-29T18:31:33Z,"Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity",openclaw,0,2026.5.18,,HIGH,CWE-862,
 GHSA-hx5x-49mm-vmhw,2020-09-03T02:36:43Z,"SQL Injection in sails-mysql",sails-mysql,0,0.10.8,,HIGH,CWE-89,
 GHSA-hx78-272p-mqqh,2020-09-03T19:21:11Z,"Authorization Bypass in graphql-shield",graphql-shield,0,6.0.6,,LOW,CWE-285,
 GHSA-hxcm-v35h-mg2x,2019-06-07T21:12:50Z,"Prototype Pollution in querystringify",querystringify,0,2.0.0,,HIGH,CWE-1321,
@@ -8082,6 +8203,7 @@ GHSA-j425-whc4-4jgc,2026-03-09T19:52:59Z,"OpenClaw's `system.run` env override f
 GHSA-j42q-r6qx-xrfp,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName",openclaw,0,,2026.3.24,LOW,CWE-807,
 GHSA-j44m-5v8f-gc9c,2025-10-10T22:55:09Z,"Flowise is vulnerable to arbitrary file exposure through its ReadFileTool",flowise,0,3.0.8,,HIGH,CWE-22,
 GHSA-j44m-5v8f-gc9c,2025-10-10T22:55:09Z,"Flowise is vulnerable to arbitrary file exposure through its ReadFileTool",flowise-components,0,3.0.8,,HIGH,CWE-22,
+GHSA-j472-gf56-x589,2026-07-02T17:22:52Z,"OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks",openclaw,0,2026.5.12,,HIGH,CWE-184,
 GHSA-j4c5-89f5-f3pm,2026-04-25T23:49:42Z,"OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks",openclaw,0,2026.4.20,,LOW,CWE-918,
 GHSA-j4f3-55x4-r6q2,2026-06-18T14:26:48Z,"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call",praisonai,1.5.0,1.7.2,,CRITICAL,CWE-1188;CWE-306;CWE-862,
 GHSA-j4mr-9xw3-c9jx,2019-05-31T23:47:01Z,"Out-of-bounds Read in base64-url",base64-url,0,2.0.0,,HIGH,CWE-125,
@@ -8092,6 +8214,7 @@ GHSA-j5g3-5c8r-7qfx,2023-08-30T21:24:57Z,"Prevent logging invalid header values"
 GHSA-j5g3-5c8r-7qfx,2023-08-30T21:24:57Z,"Prevent logging invalid header values",apollo-server-core,0,2.26.1,,LOW,,
 GHSA-j5g3-5c8r-7qfx,2023-08-30T21:24:57Z,"Prevent logging invalid header values",apollo-server-core,3.0.0,3.12.1,,LOW,,
 GHSA-j5qh-5234-4rqp,2026-03-31T12:31:35Z,"Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories",openclaw,0,2026.3.12,,HIGH,CWE-829,
+GHSA-j5qp-p44g-2m49,2026-07-02T19:08:04Z,"@asymmetric-effort/specifyjs: No redirect target validation in secureFetch","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-918,
 GHSA-j67m-jg9p-ppg4,2020-09-03T23:18:05Z,"Malicious Package in ns-sha3",ns-sha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-j6v9-xgvh-f796,2020-09-11T21:11:34Z,"Command Injection in wxchangba",wxchangba,0.0.0,,,MODERATE,CWE-77,
 GHSA-j6x7-42x2-hpcf,2020-09-03T22:14:20Z,"Malicious Package in buffer-xoz",buffer-xoz,0.0.0,,,CRITICAL,CWE-506,
@@ -8101,6 +8224,7 @@ GHSA-j899-348x-h3rq,2020-09-03T19:57:54Z,"Malicious Package in serializes",seria
 GHSA-j8hw-49gg-vq3w,2020-09-03T17:45:41Z,"Malicious Package in retcodelog",retcodelog,0.0.0,,,CRITICAL,CWE-506,
 GHSA-j8qr-rvcv-crhv,2020-09-11T21:18:05Z,"Malicious Package in electron-native-notify",electron-native-notify,0,,,CRITICAL,,
 GHSA-j8r2-2x94-2q67,2020-09-11T21:19:09Z,"Cross-Site Scripting in diagram-js-direct-editing","diagram-js-direct-editing",0,1.4.3,,MODERATE,CWE-79,
+GHSA-j8v8-g9cx-5qf4,2026-07-07T20:57:05Z,"@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers",@better-auth/scim,1.5.0,1.7.0-beta.4,,HIGH,CWE-639;CWE-862,
 GHSA-j95h-wmx9-4279,2021-02-25T17:15:39Z,"Denial of Service",sails,0,0.12.0,,HIGH,,
 GHSA-j965-2qgj-vjmq,2026-01-08T22:04:26Z,"JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3",aws-sdk,2.0.0,,3.0.0,LOW,CWE-20,
 GHSA-j99q-93c9-h869,2026-06-18T14:30:43Z,"MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence",@bitbonsai/mcpvault,0,0.11.4,,MODERATE,CWE-178;CWE-41,
@@ -8142,6 +8266,7 @@ GHSA-jr6x-2q95-fh2g,2026-03-02T21:59:51Z,"OpenClaw's authorization mismatch allo
 GHSA-jrj9-5qp6-2v8q,2020-09-03T23:22:19Z,"Machine-In-The-Middle in airtable",airtable,0.1.19,0.7.2,,HIGH,,
 GHSA-jvcm-f35g-w78p,2026-06-19T21:42:29Z,"Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory",network-ai,0,5.12.2,,MODERATE,CWE-22;CWE-23,
 GHSA-jvfv-jhw9-jmpp,2020-09-03T21:23:09Z,"Malicious Package in b5ffer-xor",b5ffer-xor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-jvm4-4j77-39p6,2026-07-02T16:34:39Z,"OpenClaw: QQBot streaming command could mutate config without explicit allowFrom",openclaw,0,2026.4.29,,HIGH,CWE-863,
 GHSA-jwm3-qcfw-c5pp,2026-06-16T22:39:46Z,"n8n: Python Code Node AST Validator Bypass",n8n,0,2.25.7,,MODERATE,CWE-693,
 GHSA-jwm3-qcfw-c5pp,2026-06-16T22:39:46Z,"n8n: Python Code Node AST Validator Bypass",n8n,2.26.0,2.26.2,,MODERATE,CWE-693,
 GHSA-jx3c-247h-cxwp,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code",openclaw,0,2026.3.31,,HIGH,CWE-829,
@@ -8201,6 +8326,7 @@ GHSA-mgv2-57vj-99xc,2019-10-07T16:54:24Z,"Low severity vulnerability that affect
 GHSA-mh5c-679w-hh4r,2020-09-03T21:12:01Z,"Denial of Service in mongodb",mongodb,0,3.1.13,,HIGH,,
 GHSA-mh6f-8j2x-4483,2018-11-26T23:58:21Z,"Critical severity vulnerability that affects event-stream and flatmap-stream",event-stream,3.3.6,4.0.0,,CRITICAL,CWE-506,
 GHSA-mh6f-8j2x-4483,2018-11-26T23:58:21Z,"Critical severity vulnerability that affects event-stream and flatmap-stream",flatmap-stream,0,,,CRITICAL,CWE-506,
+GHSA-mhq8-78pj-5j79,2026-07-02T16:05:38Z,"OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion",openclaw,0,2026.5.18,,HIGH,CWE-200;CWE-284;CWE-78,
 GHSA-mhwj-73qx-jqxm,2026-05-11T16:10:12Z,"@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function","@theecryptochad/merge-guard",0,1.0.1,,HIGH,CWE-1321,
 GHSA-mhxg-pr3j-v9gr,2020-09-03T19:41:22Z,"Malicious Package in colne",colne,0.0.0,,,CRITICAL,CWE-506,
 GHSA-mj4p-rc52-m843,2026-03-13T15:48:16Z,"OpenClaw: Sandbox staged writes could escape the verified parent directory before commit",openclaw,0,2026.3.11,,HIGH,CWE-367;CWE-59,
@@ -8236,6 +8362,8 @@ GHSA-mxjx-28vx-xjjj,2026-06-19T21:42:32Z,"Network-AI: ApprovalInbox HTTP server
 GHSA-mxmg-3p7m-2ghr,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed",openclaw,0,,2026.2.24,MODERATE,CWE-436,
 GHSA-mxmj-84q8-34r7,2020-09-03T02:39:49Z,"Command Injection in expressfs",expressfs,0,,,HIGH,CWE-77,
 GHSA-mxq6-vrrr-ppmg,2022-05-24T17:04:00Z,"Duplicate Advisory: tree-kill vulnerable to remote code execution",tree-kill,0,,1.2.1,CRITICAL,CWE-94,
+GHSA-p2fh-f5fc-44hr,2026-07-02T16:18:02Z,"OpenClaw: memory-wiki ingest could read local files with operator.write scope",openclaw,0,2026.5.12,,MODERATE,CWE-732,
+GHSA-p2fr-6hmx-4528,2026-07-07T20:54:32Z,"@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators","@better-auth/oauth-provider",1.4.8,1.7.0-beta.4,,MODERATE,CWE-285;CWE-863,
 GHSA-p33q-w45h-2hcj,2020-09-02T18:30:03Z,"Malicious Package in 4equest",4equest,0,,,CRITICAL,CWE-506,
 GHSA-p3h2-2j4p-p83g,2026-04-22T20:50:19Z,"MCPHub has Path Traversal via Malicious MCPB Manifest Name",@samanhappy/mcphub,0,0.12.13,,HIGH,CWE-22,
 GHSA-p3jx-g34v-q56j,2020-09-03T22:54:02Z,"Malicious Package in j3-sha3",j3-sha3,0.0.0,,,CRITICAL,CWE-506,
@@ -8251,6 +8379,7 @@ GHSA-p69m-4f92-2v84,2026-06-18T14:26:37Z,"PraisonAI: Remote Code Execution via S
 GHSA-p6gq-j5cr-w38f,2026-06-18T14:28:05Z,"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message",nodemailer,0,9.0.1,,HIGH,CWE-73;CWE-918,
 GHSA-p6j4-wvmc-vx2h,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete",openclaw,0,2026.3.22,,MODERATE,CWE-696,
 GHSA-p72p-rjr2-r439,2019-05-29T20:24:02Z,"Server-Side Request Forgery in terriajs-server",terriajs-server,0,2.7.4,,HIGH,CWE-918,
+GHSA-p73f-w79w-jqr5,2026-07-02T17:23:43Z,"OpenClaw: Native command authorization could skip owner-command enforcement",openclaw,0,2026.5.6,,HIGH,CWE-863,
 GHSA-p77h-hv6g-fmfp,2020-09-03T20:43:16Z,"Sensitive Data Exposure in ibm_db",ibm_db,0,2.6.0,,MODERATE,,
 GHSA-p7j5-4mwm-hv86,2021-05-06T17:28:14Z,"Duplicate Advisory: Cross-site scripting in TinyMCE",tinymce,0,4.9.7,,MODERATE,CWE-79,
 GHSA-p7j5-4mwm-hv86,2021-05-06T17:28:14Z,"Duplicate Advisory: Cross-site scripting in TinyMCE",tinymce,5.0.0,5.1.4,,MODERATE,CWE-79,
@@ -8328,11 +8457,13 @@ GHSA-qcc4-p59m-p54m,2026-03-12T14:21:54Z,"OpenClaw: Sandbox dangling-symlink ali
 GHSA-qcc9-q247-3m2m,2020-09-03T19:46:49Z,"Malicious Package in js-regular",js-regular,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qccf-q7p4-3q3j,2020-09-04T15:16:42Z,"Prototype Pollution in safe-object2",safe-object2,0.0.0,,,HIGH,CWE-1321,
 GHSA-qcff-ffx3-m25c,2020-09-04T17:31:44Z,"Command Injection in meta-git",meta-git,0.0.0,,,CRITICAL,CWE-77,
+GHSA-qcr8-x557-7cp3,2026-07-02T19:03:10Z,"@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state","@asymmetric-effort/specifyjs",0,0.2.140,,MODERATE,CWE-209,
 GHSA-qf6h-p3mr-vmh5,2024-08-15T03:30:28Z,"Duplicate Advisory: Code injection in Directus",directus,0,,10.13.0,MODERATE,CWE-79,
 GHSA-qfc9-x7gv-27jr,2020-09-03T18:12:36Z,"Malicious Package in deasyncp",deasyncp,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qfmr-6qvh-49gm,2021-02-25T01:44:38Z,XSS,knockout,0,3.5.0,,MODERATE,,
 GHSA-qgp3-3rj7-qqq4,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist",openclaw,0,2026.3.31,,LOW,CWE-863,
 GHSA-qgx9-6px9-7p75,2026-04-23T18:33:04Z,"Duplicate Advisory: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization",openclaw,0,2026.4.20,,LOW,CWE-863,
+GHSA-qh2f-99mv-mrcf,2026-07-02T15:42:42Z,"OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn",openclaw,0,2026.5.12,,MODERATE,CWE-284;CWE-78,
 GHSA-qhh4-458h-xwh2,2026-05-08T20:06:00Z,"@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry",@cyclonedx/cdxgen,9.9.5,12.3.3,,MODERATE,CWE-346;CWE-522,
 GHSA-qhrr-grqp-6x2g,2026-03-03T19:50:45Z,"OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode",openclaw,0,2026.2.22,,MODERATE,CWE-426,
 GHSA-qhwp-454g-2gv4,2025-09-15T00:30:15Z,"Duplicate Advisory: express-xss-sanitizer has an unbounded recursion depth",express-xss-sanitizer,0,,2.0.0,MODERATE,CWE-674,
@@ -8343,6 +8474,7 @@ GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via ma
 GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency",@metamask/sdk,0.16.0,0.33.1,,MODERATE,CWE-506,
 GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency",@metamask/sdk-react,0.16.0,0.33.1,,MODERATE,CWE-506,
 GHSA-qjfh-xc44-rm9x,2020-09-03T16:49:43Z,"Path Traversal in file-static-server",file-static-server,0.0.0,,,HIGH,CWE-22,
+GHSA-qjpc-qf9m-xwmr,2026-07-02T16:43:53Z,"OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
 GHSA-qm4q-f956-fg64,2020-09-03T17:39:13Z,"Malicious Package in luna-mock",luna-mock,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,2.0.0,2.25.3,,HIGH,CWE-79,
 GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,3.0.0,3.4.1,,HIGH,CWE-79,
@@ -8425,6 +8557,7 @@ GHSA-rcv7-4w2m-gj9v,2020-09-03T23:24:26Z,"Malicious Package in sj-tw-test-securi
 GHSA-rcx4-77x4-hjx5,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata",openclaw,0,,2026.2.22-2,MODERATE,CWE-807,
 GHSA-rf75-g96h-j3rm,2026-04-02T21:32:52Z,"Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation",openclaw,0,2026.4.2,,MODERATE,CWE-184,
 GHSA-rffp-mc78-wjf7,2020-09-02T18:26:48Z,"Command Injection in cocos-utils",cocos-utils,0,,,HIGH,CWE-77,
+GHSA-rggc-m335-3wvj,2026-07-02T16:03:10Z,"OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers",openclaw,0,2026.5.18,,HIGH,"CWE-269;CWE-284;CWE-287;CWE-290;CWE-863",
 GHSA-rggq-f2wf-m6cp,2020-09-02T18:31:08Z,"Malicious Package in jajajejejiji",jajajejejiji,0,,,CRITICAL,CWE-506,
 GHSA-rhc3-76jw-4f2x,2020-09-04T17:58:46Z,"Denial of Service in @commercial/ammo",@commercial/ammo,0,2.1.1,,HIGH,,
 GHSA-rj39-33v7-9xrq,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)",openclaw,0,,,HIGH,CWE-78,
@@ -8486,6 +8619,7 @@ GHSA-vh4c-j2xv-9pv9,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw: BlueBubb
 GHSA-vh4h-fvqf-q9wv,2025-05-01T03:31:17Z,"Duplicate Advisory: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack","@cloudflare/workers-oauth-provider",0,0.0.5,,MODERATE,CWE-287,
 GHSA-vh5j-5fhq-9xwg,2025-06-27T22:06:48Z,"Taylor has race condition in /get-patch that allows purchase token replay",taylored,0,8.1.3,,LOW,CWE-362,
 GHSA-vj2p-7pgw-g2wf,2026-03-27T15:46:53Z,"Postiz App has a High-Severity SSRF Vulnerability via Next.js",postiz,0,,2.0.12,HIGH,CWE-1395;CWE-918,
+GHSA-vjc7-jrh9-9j86,2026-07-06T21:22:10Z,"9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats",9router,0,,0.4.41,CRITICAL,CWE-200;CWE-306;CWE-862,
 GHSA-vjf3-2gpj-233v,2026-02-26T22:45:13Z,"n8n has an SSO Enforcement Bypass in its Self-Service Settings API",n8n,0,2.8.0,,MODERATE,CWE-269;CWE-284;CWE-287,
 GHSA-vjh7-7g9h-fjfh,2025-02-12T19:47:52Z,"Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)",elliptic,0,6.6.1,,CRITICAL,CWE-200,
 GHSA-vjqw-w5jr-g9w5,2026-03-29T15:30:19Z,"Duplicate Advisory: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured",openclaw,0,2026.3.12,,HIGH,CWE-347,
@@ -8513,6 +8647,8 @@ GHSA-vrhm-gvg7-fpcf,2026-02-19T20:29:42Z," Memory exhaustion in SvelteKit remote
 GHSA-vrqm-gvq7-rrwh,2026-03-20T20:44:52Z,"PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS",@pdfme/pdf-lib,0,5.5.10,,MODERATE,CWE-409,
 GHSA-vrxj-4qhw-5vwq,2020-09-03T17:03:41Z,"Malicious Package in scryptys",scryptys,0.0.0,,,CRITICAL,CWE-506,
 GHSA-vv52-3mrp-455m,2020-09-03T15:53:36Z,"Malicious Package in m-backdoor",m-backdoor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-vv65-f55v-xm6g,2026-07-02T19:16:57Z,"Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)",@grackle-ai/powerline,0,,0.132.1,HIGH,CWE-78;CWE-88,
+GHSA-vv65-f55v-xm6g,2026-07-02T19:16:57Z,"Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)",@grackle-ai/runtime-sdk,0,,0.132.1,HIGH,CWE-78;CWE-88,
 GHSA-vv7g-pjw9-4qj9,2020-09-03T17:03:56Z,"Malicious Package in scrytsy",scrytsy,0.0.0,,,CRITICAL,CWE-506,
 GHSA-vvfh-mvjv-w38q,2020-09-04T15:28:19Z,"Malicious Package in babel-loadre",babel-loadre,0.0.0,,,CRITICAL,CWE-506,
 GHSA-vvjh-f6p9-5vcf,2026-03-04T19:17:36Z,"OpenClaw Canvas Authentication Bypass Vulnerability",openclaw,0,2026.2.19,,HIGH,CWE-291,
@@ -8557,10 +8693,12 @@ GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in
 GHSA-w48f-fwg7-ww6p,2026-04-04T04:24:27Z,"@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding",@stablelib/cbor,0,2.0.3,,HIGH,CWE-1321,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/core,0,,0.1.142,HIGH,,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/server,0,,0.56.0,HIGH,,
+GHSA-w4v6-g3wm-w36c,2026-07-02T16:48:45Z,"OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy",openclaw,0,2026.4.29,,CRITICAL,CWE-863,
 GHSA-w4vp-3mq7-7v82,2020-09-03T15:49:48Z,"Cross-Site Scripting in lazysizes",lazysizes,0,5.2.1-rc1,,HIGH,CWE-79,
 GHSA-w5c7-9qqw-6645,2026-02-18T00:56:51Z,"OpenClaw inter-session prompts could be treated as direct user instructions",openclaw,0,2026.2.13,,HIGH,CWE-345,
 GHSA-w5cr-2qhr-jqc5,2026-02-13T21:04:00Z,"Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site",agents,0,0.3.10,,MODERATE,CWE-79,
 GHSA-w5q7-3pr9-x44w,2020-09-02T15:59:19Z,"Denial of Service in serialize-to-js",serialize-to-js,0,2.0.0,,HIGH,,
+GHSA-w5ww-7chg-mxcq,2026-07-02T17:18:51Z,"OpenClaw: Telegram interactive callbacks could skip commands.allowFrom",openclaw,0,2026.5.6,,HIGH,CWE-863,
 GHSA-w626-296m-8f85,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints",openclaw,0,2026.4.22,,LOW,CWE-266,
 GHSA-w65v-hx54-xrqx,2020-09-03T17:41:23Z,"Malicious Package in midway-xtpl",midway-xtpl,0.0.0,,,CRITICAL,CWE-506,
 GHSA-w673-8fjw-457c,2026-03-27T18:06:28Z,"n8n: Authenticated XSS and Open Redirect via Form Node",n8n,0,1.123.24,,MODERATE,CWE-601;CWE-79,
@@ -8633,6 +8771,7 @@ GHSA-wrr4-782v-jhwh,2026-06-25T17:46:49Z,"neotoma has tenant isolation gap in re
 GHSA-wrr6-p5r6-474m,2026-06-16T21:31:58Z,"Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers",openclaw,0,,2026.5.22,LOW,CWE-184,
 GHSA-wrw9-m778-g6mc,2019-06-03T17:27:57Z,"Memory Exposure in bl",bl,0,0.9.5,,MODERATE,CWE-200,
 GHSA-wrw9-m778-g6mc,2019-06-03T17:27:57Z,"Memory Exposure in bl",bl,1.0.0,1.0.1,,MODERATE,CWE-200,
+GHSA-wv26-j37q-2g7p,2026-07-02T16:18:24Z,"OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions",openclaw,0,2026.5.12,,MODERATE,CWE-863,
 GHSA-wv39-cgmm-cq29,2020-09-03T22:23:00Z,"Malicious Package in buffmr-xor",buffmr-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wvh7-5p38-2qfc,2020-07-23T18:20:10Z,"Storing Password in Local Storage",parse,0,2.10.0,,MODERATE,CWE-256,
 GHSA-wvr4-3wq4-gpc5,2026-03-19T12:51:28Z,"MCP Connect has unauthenticated remote OS command execution via /bridge endpoint",mcp-bridge,0,,2.0.0,CRITICAL,CWE-306,
@@ -8658,6 +8797,7 @@ GHSA-x3w4-mrmv-cw2x,2020-09-03T22:19:44Z,"Malicious Package in buffev-xor",buffe
 GHSA-x45v-pvpg-hcrh,2020-09-03T19:54:36Z,"Malicious Package in mysql-koa",mysql-koa,0.0.0,,,CRITICAL,CWE-506,
 GHSA-x48m-gp6r-gp4v,2020-09-03T18:21:26Z,"Malicious Package in rate-map",rate-map,1.0.3,1.0.5,,CRITICAL,CWE-506,
 GHSA-x49q-fhhm-r9jf,2026-03-20T15:31:14Z,"Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes",openclaw,0,2026.3.12,,CRITICAL,CWE-862,
+GHSA-x4hg-hfwf-p9mw,2026-07-02T20:20:04Z,"@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation","@asymmetric-effort/nogginlessdom",0,0.0.22,,MODERATE,CWE-1333,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,0,2.2.2,,MODERATE,,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,3.0.0,3.3.2,,MODERATE,,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,4.0.0,4.1.2,,MODERATE,,
@@ -8707,9 +8847,11 @@ GHSA-xpr6-2hgm-4wwp,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw vulnerabl
 GHSA-xq3g-m3j8-2vmm,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels",openclaw,0,,,HIGH,CWE-770,
 GHSA-xq7h-vwjp-5vrh,2026-03-25T17:30:46Z,"@grackle-ai/powerline Runs Without Authentication by Default",@grackle-ai/powerline,0,0.70.1,,MODERATE,CWE-306,
 GHSA-xr3g-4gg5-w3wq,2020-09-03T17:06:14Z,"Malicious Package in degbu",degbu,0.0.0,,,CRITICAL,CWE-506,
+GHSA-xr4f-mjxj-w6w5,2026-07-02T16:55:09Z,"OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes",openclaw,0,2026.5.4,,HIGH,CWE-863,
 GHSA-xr53-m937-jr9c,2020-09-03T15:49:14Z,"Cross-Site Scripting in ngx-md",ngx-md,0,6.0.3,,HIGH,CWE-79,
 GHSA-xrgf-r9gr-jjjf,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables",openclaw,0,2026.4.10,,HIGH,CWE-184,
 GHSA-xrgv-34cc-q765,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution",openclaw,0,,,MODERATE,CWE-78,
+GHSA-xrmc-c5cg-rv7x,2026-07-10T19:34:14Z,"SafeInstall agent guard shell parsing can miss raw package execution",safeinstall-cli,0,0.10.2,,HIGH,CWE-178;CWE-693,
 GHSA-xrmp-99wj-p6jc,2019-05-31T23:43:09Z,"Prototype Pollution in deap",deap,0,1.0.1,,HIGH,CWE-400,
 GHSA-xrq9-jm7v-g9h7,2026-04-25T23:49:00Z,"OpenClaw: Paired-device pairing actions were not limited to the caller device",openclaw,0,2026.4.20,,LOW,CWE-284;CWE-863,
 GHSA-xrr6-6ww3-f3qm,2020-09-02T21:25:58Z,"Sandbox Breakout / Arbitrary Code Execution in value-censorship",value-censorship,0,,,MODERATE,,
@@ -8717,8 +8859,10 @@ GHSA-xrrg-wfwc-c7r3,2020-09-04T15:33:52Z,"Malicious Package in bictoin-ops",bict
 GHSA-xv3q-jrmm-4fxv,2023-04-18T22:28:02Z,"Authentication Bypass in @strapi/plugin-users-permissions","@strapi/plugin-users-permissions",3.2.1,4.6.0,,HIGH,,
 GHSA-xv56-3wq5-9997,2026-01-13T19:57:06Z,"Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository",renovate,39.218.0,40.33.0,,MODERATE,CWE-77,
 GHSA-xvp7-8vm8-xfxx,2025-10-20T17:55:59Z,"Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers",@actual-app/sync-server,0,25.11.0,,MODERATE,CWE-209;CWE-215;CWE-219,
+GHSA-xw57-23p8-9wc5,2026-07-02T19:07:22Z,"@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-918,
 GHSA-xw79-hhv6-578c,2020-09-11T21:16:59Z,"Cross-Site Scripting in serve",serve,0,10.0.2,,HIGH,CWE-79,
 GHSA-xwcj-hwhf-h378,2026-03-16T20:40:13Z,"OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs",openclaw,0,2026.3.13,,MODERATE,CWE-532,
 GHSA-xwqw-rf2q-xmhf,2020-09-01T21:23:38Z,"Cross-Site Scripting in buefy",buefy,0,0.7.2,,HIGH,CWE-79,
+GHSA-xww8-gqvh-92x9,2026-07-02T15:40:36Z,"OpenClaw: Exec approval display truncation could hide the command being approved",openclaw,0,2026.5.18,,HIGH,CWE-284;CWE-863,
 GHSA-xx4c-jj58-r7x6,2021-11-19T20:14:23Z,"Inefficient Regular Expression Complexity in Validator.js",validator,11.1.0,13.7.0,,MODERATE,CWE-1333,
 GHSA-xxj4-96ph-g6j6,2026-03-31T12:31:36Z,"Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path",openclaw,0,2026.3.11,,MODERATE,CWE-367,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrewrite/recipes-nodejs",
-  "version": "0.47.0-20260630-173749",
+  "version": "0.47.2",
   "license": "Moderne Proprietary",
   "description": "OpenRewrite recipes for Node.js library migrations.",
   "homepage": "https://github.com/moderneinc/rewrite-node",
@@ -17,15 +17,15 @@
     "access": "public"
   },
   "scripts": {
-    "prebuild": "bun -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
+    "prebuild": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
     "build": "tsc --build tsconfig.build.json",
-    "postbuild": "bun -e \"const fse=require('fs-extra'); fse.existsSync('resources') && fse.copySync('resources','dist/resources',{dereference:true})\"",
+    "postbuild": "node -e \"const fse=require('fs-extra'); fse.existsSync('resources') && fse.copySync('resources','dist/resources',{dereference:true})\"",
     "dev": "tsc --watch -p tsconfig.json",
     "test": "npm run build && jest",
     "ci:test": "jest"
   },
   "dependencies": {
-    "@openrewrite/rewrite": "^8.86.0-20260630-140726",
+    "@openrewrite/rewrite": "^8.88.0-20260720-123712",
     "mutative": "^1.1.0",
     "semver": "^7.7.3"
   },
@@ -33,7 +33,6 @@
     "@types/jest": "^29.5.13",
     "@types/node": "^22.5.4",
     "@types/semver": "^7.7.1",
-    "bun": "^1.3.5",
     "fs-extra": "^11.3.3",
     "jest": "^29.7.0",
     "jest-junit": "^17.0.0",

package/src/migrate/increase-node-engine-version.ts

@@ -11,7 +11,10 @@ import * as semver from "semver";
 export class IncreaseNodeEngineVersion extends Recipe {
     readonly name = "org.openrewrite.node.migrate.increase-node-engine-version";
     readonly displayName = "Increase Node.js engine version";
-    readonly description = "Increases the upper bound of the `engines.node` version range in package.json to allow the specified Node.js version.";
+    readonly description = "Raises the lower bound of the `engines.node` version range in package.json to the specified " +
+        "Node.js version, performing a hard cutover that drops support for older, end-of-life versions " +
+        "(`22.x` → `24.x`, `>= 22` → `>= 24`). The original constraint style is preserved where possible and the " +
+        "version is never lowered.";
 
     @Option({
         displayName: "Version",
@@ -48,13 +51,18 @@ export class IncreaseNodeEngineVersion extends Recipe {
                     return doc;
                 }
 
-                const updatedRange = increaseUpperBound(nodeRange, targetVersion);
+                const updatedRange = raiseMinimumVersion(nodeRange, targetVersion);
                 if (updatedRange === nodeRange) {
                     return doc;
                 }
 
-                packageJson.engines.node = updatedRange;
-                const modifiedContent = JSON.stringify(packageJson, null, 2);
+                // Targeted replacement preserves the file's original formatting (indentation,
+                // trailing newline, key order) instead of round-tripping through JSON.stringify.
+                const nodeMemberRegex = /("engines"\s*:\s*\{[\s\S]*?"node"\s*:\s*)"([^"]+)"/;
+                const modifiedContent = content.replace(nodeMemberRegex, `$1${JSON.stringify(updatedRange)}`);
+                if (modifiedContent === content) {
+                    return doc;
+                }
 
                 const parsed = await new JsonParser({}).parseOne({
                     text: modifiedContent,
@@ -71,67 +79,64 @@ export class IncreaseNodeEngineVersion extends Recipe {
     }
 }
 
-export function increaseUpperBound(range: string, targetVersion: number): string {
+export function raiseMinimumVersion(range: string, targetVersion: number): string {
+    const trimmed = range.trim();
+
+    let minVersion: semver.SemVer | null = null;
     try {
-        if (semver.satisfies(`${targetVersion}.0.0`, range)) {
-            return range;
-        }
+        minVersion = semver.minVersion(trimmed);
     } catch {
-        // fall through to string manipulation
+        // unparseable range: fall through to string manipulation
     }
-
-    // Hyphen range: "14 - 18" or "14.0.0 - 18.0.0"
-    const hyphenMatch = range.match(/^(.+\s+-\s+)(\d+)(\.0\.0)?$/);
-    if (hyphenMatch) {
-        return `${hyphenMatch[1]}${targetVersion}${hyphenMatch[3] || ''}`;
+    if (minVersion && minVersion.major >= targetVersion) {
+        return range;
     }
 
-    // Simple OR ranges (no < or > comparators): "14 || 16 || 18", "^14 || ^16", "14.x || 16.x"
-    if (range.includes('||') && !/[<>]/.test(range)) {
-        const separatorMatch = range.match(/(\s*\|\|\s*)/);
-        const separator = separatorMatch ? separatorMatch[1] : ' || ';
-        const lastPart = range.split(/\s*\|\|\s*/).pop()!.trim();
-
-        let newPart: string;
-        if (lastPart.startsWith('^')) {
-            newPart = `^${targetVersion}`;
-        } else if (lastPart.startsWith('~')) {
-            newPart = `~${targetVersion}`;
-        } else if (lastPart.endsWith('.x')) {
-            newPart = `${targetVersion}.x`;
-        } else {
-            newPart = `${targetVersion}`;
+    // OR union with no comparators: drop terms below the target, floor the rest.
+    // "20.x || 22.x" -> "24.x"; "^26 || ^22" -> "^26" (preserves out-of-order terms already ≥ target).
+    if (trimmed.includes('||') && !/[<>]/.test(trimmed)) {
+        const parts = trimmed.split(/\s*\|\|\s*/).map(p => p.trim());
+        const kept = parts.filter(p => {
+            try {
+                const m = semver.minVersion(p);
+                return m !== null && m.major >= targetVersion;
+            } catch {
+                return false;
+            }
+        });
+        if (kept.length > 0) {
+            return kept.join(' || ');
         }
-
-        return `${range}${separator}${newPart}`;
+        return floorTerm(parts[parts.length - 1], targetVersion);
     }
 
-    // Upper bound with < or <= (not preceded by >, to avoid matching >=)
-    const upperBoundRegex = /(?<!>)(<=?)(\d+)(\.0\.0)?(?=[^<]*$)/;
-    const upperMatch = range.match(upperBoundRegex);
-    if (upperMatch) {
-        const op = upperMatch[1];
-        const suffix = upperMatch[3] || '';
-        const newMajor = op === '<' ? targetVersion + 1 : targetVersion;
-        return range.replace(upperBoundRegex, `${op}${newMajor}${suffix}`);
-    }
-
-    // Single caret: "^18" or "^18.0.0"
-    const caretMatch = range.match(/^\^(\d+)(\.0\.0)?$/);
-    if (caretMatch) {
-        return `${range} || ^${targetVersion}${caretMatch[2] || ''}`;
+    // Hyphen range: "18 - 20" or "18.0.0 - 20.0.0".
+    const hyphenMatch = trimmed.match(/^(.+?)\s+-\s+(.+)$/);
+    if (hyphenMatch) {
+        const upper = hyphenMatch[2].trim();
+        const upperMajor = parseInt(upper, 10);
+        if (!Number.isNaN(upperMajor) && upperMajor < targetVersion) {
+            return `>=${targetVersion}`;
+        }
+        return `${targetVersion} - ${upper}`;
     }
 
-    // Single tilde: "~18" or "~18.0.0"
-    const tildeMatch = range.match(/^~(\d+)(\.0\.0)?$/);
-    if (tildeMatch) {
-        return `${range} || ~${targetVersion}${tildeMatch[2] || ''}`;
+    // Two-sided comparator range: raise the lower bound, keep the upper bound only if it still admits the target.
+    if (/</.test(trimmed)) {
+        const upperMatch = trimmed.match(/(<=?)\s*(\d+)(?:\.\d+)*/);
+        let upper = '';
+        if (upperMatch) {
+            const op = upperMatch[1];
+            const upperMajor = parseInt(upperMatch[2], 10);
+            const admitsTarget = op === '<=' ? upperMajor >= targetVersion : upperMajor > targetVersion;
+            upper = admitsTarget ? ` ${op}${upperMatch[2]}` : '';
+        }
+        return `>=${targetVersion}${upper}`;
     }
 
-    // Single x-range: "18.x"
-    if (/^\d+\.x$/.test(range)) {
-        return `${range} || ${targetVersion}.x`;
-    }
+    return floorTerm(trimmed, targetVersion);
+}
 
-    return range;
+function floorTerm(part: string, targetVersion: number): string {
+    return part.replace(/\d+/, String(targetVersion));
 }