@openrewrite/recipes-nodejs 0.47.0 → 0.47.3

package/dist/resources/advisories-npm.csv

@@ -910,7 +910,7 @@ CVE-2019-15602,2020-04-01T16:36:15Z,"Cross-Site Scripting in fileview",fileview,
 CVE-2019-15603,2020-04-01T16:36:31Z,"Cross-Site Scripting in seeftl",seeftl,0,,0.1.1,HIGH,CWE-79,
 CVE-2019-15607,2020-01-30T21:00:21Z,"Cross-Site Scripting in node-red",node-red,0,0.20.8,,MODERATE,CWE-79,
 CVE-2019-15608,2022-02-09T22:49:38Z,"TOCTOU Race Condition in Yarn",yarn,0,1.19.0,,MODERATE,CWE-367,
-CVE-2019-15609,2022-02-10T20:20:31Z,"OS Command Injection and Command Injection in kill-port-process",kill-port-process,0,2.2.0,,CRITICAL,CWE-78;CWE-77,
+CVE-2019-15609,2022-02-10T20:20:31Z,"OS Command Injection and Command Injection in kill-port-process",kill-port-process,0,2.2.0,,CRITICAL,CWE-77;CWE-78,
 CVE-2019-15657,2019-08-26T16:59:56Z,"Arbitrary Code Execution in eslint-utils",eslint-utils,1.2.0,1.4.1,,CRITICAL,CWE-20,
 CVE-2019-15658,2019-08-26T16:59:45Z,"SQL Injection in connect-pg-simple",connect-pg-simple,0,6.0.1,,HIGH,CWE-89,
 CVE-2019-15782,2019-09-04T10:02:50Z,"Cross-Site Scripting in webtorrent",webtorrent,0,0.107.6,,MODERATE,CWE-79,
@@ -1953,9 +1953,9 @@ CVE-2021-41720,2021-12-03T20:37:32Z,"Withdrawn: Arbitrary code execution in loda
 CVE-2021-42057,2022-05-24T19:19:42Z,"Obsidian Dataview vulnerable to code injection due to unsafe eval",obsidian-dataview,0,0.4.13,,HIGH,CWE-94,
 CVE-2021-42227,2021-10-18T19:44:32Z,"Cross site scripting in kindeditor",kindeditor,0,,4.1.12,MODERATE,CWE-79,
 CVE-2021-42228,2021-10-18T19:44:06Z,"Cross Site Request Forgery in kindeditor",kindeditor,0,,4.1.12,HIGH,CWE-352,
-CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,0.7.29,0.7.30,,HIGH,CWE-829;CWE-912,
-CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,0.8.0,0.8.1,,HIGH,CWE-829;CWE-912,
-CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,1.0.0,1.0.1,,HIGH,CWE-829;CWE-912,
+CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,0.7.29,0.7.30,,HIGH,CWE-506;CWE-912,
+CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,0.8.0,0.8.1,,HIGH,CWE-506;CWE-912,
+CVE-2021-4229,2021-10-22T20:38:14Z,"Embedded malware in ua-parser-js",ua-parser-js,1.0.0,1.0.1,,HIGH,CWE-506;CWE-912,
 CVE-2021-4231,2022-05-27T00:01:08Z,"Angular vulnerable to Cross-site Scripting",@angular/core,0,10.2.5,,MODERATE,CWE-79,
 CVE-2021-4231,2022-05-27T00:01:08Z,"Angular vulnerable to Cross-site Scripting",@angular/core,11.0.0,11.0.5,,MODERATE,CWE-79,
 CVE-2021-4231,2022-05-27T00:01:08Z,"Angular vulnerable to Cross-site Scripting",@angular/core,11.1.0-next.0,11.1.0-next.3,,MODERATE,CWE-79,
@@ -3664,7 +3664,7 @@ CVE-2025-1398,2025-03-17T15:31:50Z,"Mattermost Desktop App allows the bypass of
 CVE-2025-14284,2025-12-09T18:30:35Z,"@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)",@tiptap/extension-link,0,2.10.4,,LOW,CWE-79,
 CVE-2025-14505,2026-01-08T21:30:34Z,"Elliptic Uses a Cryptographic Primitive with a Risky Implementation",elliptic,0,,6.6.1,LOW,CWE-1240,
 CVE-2025-1467,2025-02-23T18:30:24Z,"tarteaucitron Cross-site Scripting (XSS)",tarteaucitronjs,0,1.17.0,,LOW,CWE-79,
-CVE-2025-14874,2025-12-01T20:44:25Z,"Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls",nodemailer,0,7.0.11,,HIGH,CWE-703,
+CVE-2025-14874,2025-12-01T20:44:25Z,"Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls",nodemailer,3.0.0,7.0.11,,HIGH,CWE-703,
 CVE-2025-15104,2026-01-16T15:31:25Z,"Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability",vnu-jar,0,,26.1.11,MODERATE,CWE-918,
 CVE-2025-1520,2025-04-23T18:30:58Z,"PostHog Plugin Server SQL Injection Vulnerability",@posthog/plugin-server,0,,1.10.7,HIGH,CWE-89,
 CVE-2025-15265,2026-01-15T20:13:33Z,"svelte vulnerable to Cross-site Scripting",svelte,5.46.0,5.46.4,,MODERATE,CWE-79,
@@ -4524,17 +4524,24 @@ CVE-2025-9862,2025-09-15T20:31:14Z,"Ghost vulnerable to Server Side Request Forg
 CVE-2025-9910,2025-09-11T06:30:23Z,"jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin",jsondiffpatch,0,0.7.2,,MODERATE,CWE-79,
 CVE-2026-0540,2026-03-03T18:31:33Z,"DOMPurify contains a Cross-site Scripting vulnerability",dompurify,2.5.3,2.5.9,,MODERATE,CWE-79,
 CVE-2026-0540,2026-03-03T18:31:33Z,"DOMPurify contains a Cross-site Scripting vulnerability",dompurify,3.1.3,3.3.2,,MODERATE,CWE-79,
-CVE-2026-0621,2026-01-05T21:30:33Z,"Anthropic's MCP TypeScript SDK has a ReDoS vulnerability","@modelcontextprotocol/sdk",0,1.25.2,,HIGH,CWE-1333,
+CVE-2026-0621,2026-01-05T21:30:33Z,"Anthropic's MCP TypeScript SDK has a ReDoS vulnerability","@modelcontextprotocol/sdk",1.3.0,1.25.2,,HIGH,CWE-1333,
 CVE-2026-0755,2026-06-18T20:44:58Z,"gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)",gemini-mcp-tool,1.1.2,1.1.6,,CRITICAL,CWE-78,
 CVE-2026-0775,2026-01-23T06:31:24Z,"Duplicate Advisory: npm cli Uncontrolled Search Path Element Local Privilege Escalation Vulnerability",npm,0,,11.8.0,HIGH,CWE-732,
 CVE-2026-0824,2026-01-10T15:31:22Z,"QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting",@questdb/web-console,0,1.1.10,,LOW,CWE-79,
 CVE-2026-0933,2026-01-21T23:00:35Z,"Wrangler affected by OS Command Injection in `wrangler pages deploy`",wrangler,2.0.15,3.114.17,,HIGH,CWE-78,
 CVE-2026-0933,2026-01-21T23:00:35Z,"Wrangler affected by OS Command Injection in `wrangler pages deploy`",wrangler,4.0.0,4.59.1,,HIGH,CWE-78,
 CVE-2026-0969,2026-02-12T03:31:01Z,"next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content",next-mdx-remote,4.3.0,6.0.0,,HIGH,CWE-94,
+CVE-2026-10281,2026-06-01T21:30:42Z,"Claw Orchestrator is missing authentication for the component API Endpoint","@enderfga/claw-orchestrator",0,3.5.6,,MODERATE,CWE-287,
+CVE-2026-10291,2026-06-02T00:31:57Z,"Claw Orchestrator has inefficient regular expression complexity via validateRegex()","@enderfga/claw-orchestrator",0,3.7.1,,MODERATE,CWE-1333;CWE-400,
+CVE-2026-10690,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to SSRF","@wonderwhy-er/desktop-commander",0,,0.2.37,LOW,CWE-918,
+CVE-2026-10691,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption","@wonderwhy-er/desktop-commander",0,0.2.39,,LOW,CWE-400,
+CVE-2026-10802,2026-06-04T12:30:26Z,"Keystone: GraphQL API Endpoint Lacks Query Depth Limits",@keystone-6/core,0,,6.5.3,LOW,CWE-400,
+CVE-2026-11330,2026-06-05T15:32:23Z,"claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision",claude-mem,0,12.0.0,,LOW,CWE-327,
 CVE-2026-11417,2026-06-15T20:47:36Z,"aws-cdk-lib: OS Command Injection in NodejsFunction Bundling",aws-cdk-lib,0,2.246.0,,HIGH,CWE-78,
 CVE-2026-11525,2026-06-19T14:34:46Z,"undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",undici,0,6.27.0,,LOW,CWE-183,
 CVE-2026-11525,2026-06-19T14:34:46Z,"undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",undici,7.0.0,7.28.0,,LOW,CWE-183,
 CVE-2026-11525,2026-06-19T14:34:46Z,"undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",undici,8.0.0,8.5.0,,LOW,CWE-183,
+CVE-2026-11998,2026-06-24T21:30:44Z,"Angular's deprecated package has a Cross-Site Scripting issue",angular,1.2.0-rc.3,,1.8.3,HIGH,CWE-79;CWE-791,
 CVE-2026-12143,2026-06-15T17:26:26Z,"form-data: CRLF injection in form-data via unescaped multipart field names and filenames",form-data,0,2.5.6,,HIGH,CWE-93,
 CVE-2026-12143,2026-06-15T17:26:26Z,"form-data: CRLF injection in form-data via unescaped multipart field names and filenames",form-data,3.0.0,3.0.5,,HIGH,CWE-93,
 CVE-2026-12143,2026-06-15T17:26:26Z,"form-data: CRLF injection in form-data via unescaped multipart field names and filenames",form-data,4.0.0,4.0.6,,HIGH,CWE-93,
@@ -4542,10 +4549,24 @@ CVE-2026-12151,2026-06-19T14:22:01Z,"undici WebSocket client vulnerable to denia
 CVE-2026-12151,2026-06-19T14:22:01Z,"undici WebSocket client vulnerable to denial of service via fragment count bypass",undici,7.0.0,7.28.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-12151,2026-06-19T14:22:01Z,"undici WebSocket client vulnerable to denial of service via fragment count bypass",undici,8.0.0,8.5.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-1245,2026-01-20T21:31:34Z,"binary-parser library has a code injection vulnerability",binary-parser,0,2.3.0,,MODERATE,CWE-94,
+CVE-2026-12590,2026-07-20T23:23:26Z,"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",body-parser,0,1.20.6,,LOW,CWE-770,
+CVE-2026-12590,2026-07-20T23:23:26Z,"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",body-parser,2.0.0,2.3.0,,LOW,CWE-770,
 CVE-2026-12644,2026-06-19T06:31:56Z,"ts-deepmerge: Prototype Method Override leads to DoS",ts-deepmerge,0,8.0.0,,MODERATE,CWE-248,
+CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,0,1.1.16,,HIGH,CWE-400;CWE-407,
+CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,2.0.0,2.1.2,,HIGH,CWE-400;CWE-407,
+CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,3.0.0,5.0.7,,HIGH,CWE-400;CWE-407,
+CVE-2026-13311,2026-07-20T21:49:34Z,"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)",shell-quote,0,1.9.0,,HIGH,CWE-407,
+CVE-2026-13676,2026-07-21T19:03:11Z,"fast-uri vulnerable to host confusion via failed IDN canonicalization",fast-uri,2.3.1,2.4.2,,HIGH,CWE-436;CWE-551,
+CVE-2026-13676,2026-07-21T19:03:11Z,"fast-uri vulnerable to host confusion via failed IDN canonicalization",fast-uri,3.0.0,3.1.3,,HIGH,CWE-436;CWE-551,
+CVE-2026-13676,2026-07-21T19:03:11Z,"fast-uri vulnerable to host confusion via failed IDN canonicalization",fast-uri,4.0.0,4.0.1,,HIGH,CWE-436;CWE-551,
+CVE-2026-13760,2026-07-21T19:04:50Z,"aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling",aws-cdk-lib,0,2.260.0,,HIGH,CWE-78,
+CVE-2026-14257,2026-07-24T21:53:14Z,"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",brace-expansion,0,5.0.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-14620,2026-07-20T22:01:56Z,"webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints",webpack-dev-server,0,5.2.6,,MODERATE,CWE-352;CWE-749,
+CVE-2026-14631,2026-07-20T22:02:31Z,"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header",webpack-dev-server,0,5.2.6,,MODERATE,CWE-20;CWE-248,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,0,1.123.17,,CRITICAL,CWE-95,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,2.0.0,2.4.5,,CRITICAL,CWE-95,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,2.5.0,2.5.1,,CRITICAL,CWE-95,
+CVE-2026-15074,2026-07-24T16:43:21Z,"@fastify/static vulnerable to route guard bypass via path traversal",@fastify/static,0,10.1.1,,HIGH,CWE-22,
 CVE-2026-1513,2026-01-28T03:30:30Z,"billboard.js is vulnerable to XSS during chart option binding",billboard.js,0,3.18.0,,HIGH,CWE-79,
 CVE-2026-1525,2026-03-13T20:07:03Z,"Undici has an HTTP Request/Response Smuggling issue",undici,0,6.24.0,,MODERATE,CWE-444,
 CVE-2026-1525,2026-03-13T20:07:03Z,"Undici has an HTTP Request/Response Smuggling issue",undici,7.0.0,7.24.0,,MODERATE,CWE-444,
@@ -4556,6 +4577,9 @@ CVE-2026-1527,2026-03-13T20:41:26Z,"Undici has CRLF Injection in undici via `upg
 CVE-2026-1528,2026-03-13T20:07:26Z,"Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",undici,6.0.0,6.24.0,,HIGH,CWE-1284;CWE-248,
 CVE-2026-1528,2026-03-13T20:07:26Z,"Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",undici,7.0.0,7.24.0,,HIGH,CWE-1284;CWE-248,
 CVE-2026-1615,2026-02-09T06:30:28Z,"jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions",jsonpath,0,1.3.0,,HIGH,CWE-94,
+CVE-2026-16221,2026-07-21T22:08:28Z,"fast-uri vulnerable to host confusion via literal backslash authority delimiter",fast-uri,2.3.1,2.4.3,,HIGH,CWE-436,
+CVE-2026-16221,2026-07-21T22:08:28Z,"fast-uri vulnerable to host confusion via literal backslash authority delimiter",fast-uri,3.0.0,3.1.4,,HIGH,CWE-436,
+CVE-2026-16221,2026-07-21T22:08:28Z,"fast-uri vulnerable to host confusion via literal backslash authority delimiter",fast-uri,4.0.0,4.1.1,,HIGH,CWE-436,
 CVE-2026-1664,2026-02-03T18:42:01Z,"Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing",agents,0,0.3.7,,MODERATE,CWE-639,
 CVE-2026-1721,2026-02-13T03:31:23Z,"Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler",agents,0,0.3.10,,MODERATE,CWE-79,
 CVE-2026-1774,2026-02-10T18:30:38Z,"CASL Ability is Vulnerable to Prototype Pollution",@casl/ability,2.4.0,6.7.5,,CRITICAL,CWE-1321,
@@ -5762,6 +5786,7 @@ CVE-2026-35626,2026-03-26T19:50:41Z,"OpenClaw is vulnerable to unauthenticated r
 CVE-2026-35627,2026-03-26T19:08:34Z,"OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement",openclaw,0,2026.3.22,,HIGH,CWE-863,
 CVE-2026-35628,2026-03-27T22:37:35Z,"OpenClaw: Telegram Webhook Missing Guess Rate Limiting Enables Brute-Force Guessing of Weak Webhook Secret",openclaw,0,,2026.3.24,MODERATE,CWE-307;CWE-521,
 CVE-2026-35629,2026-03-29T15:48:42Z,"OpenClaw: SSRF via Unguarded Configured Base URLs in Multiple Channel Extensions (Incomplete Fix for CVE-2026-28476)",openclaw,0,2026.3.28,,HIGH,CWE-918,
+CVE-2026-35630,2026-07-02T16:05:20Z,"OpenClaw: QQBot native approval buttons did not enforce configured approver identity",openclaw,0,2026.5.18,,HIGH,CWE-862,
 CVE-2026-35632,2026-03-26T21:49:25Z,"OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)",openclaw,0,,2026.2.22,MODERATE,CWE-61,
 CVE-2026-35633,2026-03-26T19:50:06Z,"OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure",openclaw,0,2026.3.22,,HIGH,CWE-400;CWE-770,
 CVE-2026-35634,2026-03-26T18:59:00Z,"OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication",openclaw,0,2026.3.23,,MODERATE,CWE-287,
@@ -5798,6 +5823,8 @@ CVE-2026-35668,2026-03-30T18:31:02Z,"OpenClaw has Sandbox Media Root Bypass via
 CVE-2026-35669,2026-03-27T22:30:57Z,"OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers",openclaw,0,,2026.3.24,HIGH,CWE-266;CWE-863,
 CVE-2026-35670,2026-03-26T19:08:16Z,"OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.",openclaw,0,2026.3.22,,MODERATE,CWE-639;CWE-706;CWE-807,
 CVE-2026-3635,2026-03-25T19:32:28Z,"fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",fastify,0,5.8.3,,MODERATE,CWE-348,
+CVE-2026-38728,2026-05-15T15:30:45Z,"smtp-server's command parser memory exhaustion denial-of-service",smtp-server,0,3.18.3,,HIGH,CWE-400,
+CVE-2026-39244,2026-07-10T18:32:19Z,"adm-zip: Crafted ZIP file triggers 4GB memory allocation",adm-zip,0,0.6.0,,HIGH,CWE-400;CWE-789,
 CVE-2026-39313,2026-04-16T20:44:32Z,"MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport",mcp-framework,0,0.2.22,,HIGH,CWE-770,
 CVE-2026-39315,2026-04-09T20:28:05Z,"Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()",unhead,0,2.1.13,,MODERATE,CWE-184,
 CVE-2026-39320,2026-04-21T17:17:00Z,"Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths",signalk-server,0,2.25.0,,HIGH,CWE-1333;CWE-400,
@@ -6336,8 +6363,8 @@ CVE-2026-44488,2026-06-04T14:21:37Z,"Allocation of Resources Without Limits or T
 CVE-2026-44489,2026-05-29T15:51:02Z,"Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix",axios,1.15.2,1.16.0,,LOW,CWE-113;CWE-1321,
 CVE-2026-44490,2026-05-29T15:54:57Z,"axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions",axios,0,0.32.0,,MODERATE,CWE-1321,
 CVE-2026-44490,2026-05-29T15:54:57Z,"axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions",axios,1.0.0,1.16.0,,MODERATE,CWE-1321,
-CVE-2026-44492,2026-05-29T15:59:30Z,"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)",axios,0,0.32.0,,HIGH,CWE-918,
-CVE-2026-44492,2026-05-29T15:59:30Z,"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)",axios,1.0.0,1.16.0,,HIGH,CWE-918,
+CVE-2026-44492,2026-05-29T15:59:30Z,"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)",axios,0,0.32.0,,HIGH,CWE-289;CWE-918,
+CVE-2026-44492,2026-05-29T15:59:30Z,"axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)",axios,1.15.0,1.16.0,,HIGH,CWE-289;CWE-918,
 CVE-2026-44494,2026-05-29T16:04:00Z,"axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`",axios,1.0.0,1.16.0,,HIGH,CWE-1321;CWE-441,
 CVE-2026-44495,2026-05-29T16:07:31Z,"axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge",axios,0.19.0,0.31.1,,HIGH,CWE-1321;CWE-94,
 CVE-2026-44495,2026-05-29T16:07:31Z,"axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge",axios,1.0.0,1.15.2,,HIGH,CWE-1321;CWE-94,
@@ -6414,6 +6441,14 @@ CVE-2026-44895,2026-05-09T00:10:28Z,"@yoda.digital/gitlab-mcp-server's SSE trans
 CVE-2026-44902,2026-05-11T14:42:10Z,"Prometheus exporter process crash via malformed HTTP request","@opentelemetry/auto-instrumentations-node",0,0.75.0,,HIGH,CWE-755,
 CVE-2026-44902,2026-05-11T14:42:10Z,"Prometheus exporter process crash via malformed HTTP request","@opentelemetry/exporter-prometheus",0,0.217.0,,HIGH,CWE-755,
 CVE-2026-44902,2026-05-11T14:42:10Z,"Prometheus exporter process crash via malformed HTTP request",@opentelemetry/sdk-node,0,0.217.0,,HIGH,CWE-755,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions","react-server-dom-turbopack",19.0.0,19.0.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions","react-server-dom-turbopack",19.1.0,19.1.9,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions","react-server-dom-turbopack",19.2.0,19.2.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-parcel,19.1.0,19.1.9,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-parcel,19.2.0,19.2.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-webpack,19.0.0,19.0.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-webpack,19.1.0,19.1.9,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-webpack,19.2.0,19.2.8,,HIGH,CWE-400;CWE-770,
 CVE-2026-44966,2026-05-09T00:40:16Z,"Velocity.js has a Prototype Pollution vulnerability through #set path assignment",velocityjs,0,,2.1.5,HIGH,CWE-1321,
 CVE-2026-44974,2026-05-27T00:37:20Z,"@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters",@hapi/content,0,6.0.2,,HIGH,CWE-436,
 CVE-2026-44979,2026-05-27T00:38:09Z,"@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects",@hapi/wreck,0,18.1.1,,MODERATE,CWE-200;CWE-522,
@@ -6444,6 +6479,7 @@ CVE-2026-45242,2026-05-18T21:31:50Z,"Summarize contains a path traversal vulnera
 CVE-2026-45243,2026-05-18T21:31:50Z,"Summarize contains a missing authorization vulnerability",@steipete/summarize,0,0.15.0,,MODERATE,CWE-862,
 CVE-2026-45244,2026-05-18T21:31:51Z,"Summarize contains a missing authorization vulnerability",@steipete/summarize,0,0.15.0,,LOW,CWE-862,
 CVE-2026-45245,2026-05-18T21:31:51Z,"Summarize's hover summary feature allows malicious pages to dispatch synthetic mouseover events over attacker-controlled links",@steipete/summarize,0,0.15.1,,MODERATE,CWE-918,
+CVE-2026-45249,2026-05-26T13:30:40Z,"Apache ECharts has a cross-site scripting (XSS) vulnerability",echarts,0,6.1.0,,MODERATE,CWE-79,
 CVE-2026-45302,2026-05-18T16:43:12Z,"parse-nested-form-data has Prototype Pollution via `__proto__` in FormData field names",parse-nested-form-data,0,1.0.1,,HIGH,CWE-1321,
 CVE-2026-45310,2026-05-14T20:29:26Z,"DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool",deepseek-tui,0,0.8.22,,HIGH,CWE-918,
 CVE-2026-45311,2026-05-14T20:29:33Z,"DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval",deepseek-tui,0.3.0,0.8.23,,CRITICAL,CWE-94,
@@ -6546,6 +6582,7 @@ CVE-2026-45577,2026-05-18T14:20:06Z,"Neotoma: Unauthenticated Inspector/API acce
 CVE-2026-45582,2026-05-18T13:26:51Z,"n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters",n8n-mcp,0,2.51.3,,MODERATE,CWE-201,
 CVE-2026-45617,2026-05-27T18:08:19Z,"LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex",liquidjs,0,10.26.0,,HIGH,CWE-1333,
 CVE-2026-45618,2026-05-27T18:24:14Z,"LiquidJS is Vulnerable to Remote Code Execution",liquidjs,0,10.26.0,,CRITICAL,CWE-94,
+CVE-2026-45623,2026-07-23T15:06:16Z,"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments",postcss,0,8.5.12,,HIGH,CWE-200;CWE-22,
 CVE-2026-45665,2026-05-14T20:27:45Z,"Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order",open-webui,0,0.8.0,,HIGH,CWE-79,
 CVE-2026-45669,2026-05-19T15:49:25Z,"Nuxt: Reflected XSS in `navigateTo()` external redirect",nuxt,3.4.3,3.21.6,,MODERATE,CWE-83,
 CVE-2026-45669,2026-05-19T15:49:25Z,"Nuxt: Reflected XSS in `navigateTo()` external redirect",nuxt,4.0.0-alpha.1,4.4.6,,MODERATE,CWE-83,
@@ -6568,12 +6605,12 @@ CVE-2026-45740,2026-05-19T16:21:33Z,"protobufjs: Denial of Service via unbounded
 CVE-2026-45772,2026-05-19T19:46:44Z,"Turbo: Unexpected local code execution during Yarn Berry detection",@turbo/codemod,2.3.4,2.9.14,,LOW,CWE-426,
 CVE-2026-45772,2026-05-19T19:46:44Z,"Turbo: Unexpected local code execution during Yarn Berry detection",@turbo/workspaces,2.3.4,2.9.14,,LOW,CWE-426,
 CVE-2026-45772,2026-05-19T19:46:44Z,"Turbo: Unexpected local code execution during Yarn Berry detection",turbo,1.1.0,2.9.14,,LOW,CWE-426,
-CVE-2026-45773,2026-05-19T19:49:52Z,"Trubo: Login callback CSRF/session fixation",turbo,0,2.9.14,,MODERATE,CWE-352,
+CVE-2026-45773,2026-05-19T19:49:52Z,"Turbo: Login callback CSRF/session fixation",turbo,0,2.9.14,,MODERATE,CWE-352,
 CVE-2026-45783,2026-05-19T20:07:52Z,"@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes",@libp2p/kad-dht,0,16.2.6,,HIGH,CWE-20;CWE-400,
 CVE-2026-45787,2026-05-14T20:30:04Z,"electerm's encrypt method not safe enough",electerm,0,3.9.5,,MODERATE,"CWE-326;CWE-329;CWE-353;CWE-759;CWE-916",
 CVE-2026-45805,2026-05-19T19:57:36Z,"PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE",@penpot/mcp,0,2.15.0,,HIGH,CWE-749,
-CVE-2026-4598,2026-03-23T06:30:29Z,"jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs",jsrsasign,0,11.1.1,,HIGH,CWE-835,
-CVE-2026-4599,2026-03-23T06:30:29Z,"jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation",jsrsasign,7.0.0,11.1.1,,CRITICAL,CWE-1023,
+CVE-2026-4598,2026-03-23T06:30:29Z,"jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs",jsrsasign,0,11.1.1,,HIGH,CWE-1287;CWE-835,
+CVE-2026-4599,2026-03-23T06:30:29Z,"jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation",jsrsasign,7.0.0,11.1.1,,CRITICAL,CWE-1023;CWE-338,
 CVE-2026-4600,2026-03-23T06:30:29Z,"jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic",jsrsasign,0,11.1.1,,HIGH,CWE-347,
 CVE-2026-4601,2026-03-23T06:30:29Z,"jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction",jsrsasign,0,11.1.1,,HIGH,CWE-325,
 CVE-2026-4602,2026-03-23T06:30:29Z,"jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass",jsrsasign,0,11.1.1,,HIGH,CWE-681,
@@ -6592,7 +6629,7 @@ CVE-2026-46395,2026-05-19T14:44:55Z,"HAXcms: Private Key Disclosure via Broken H
 CVE-2026-46396,2026-05-19T14:46:47Z,"Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover",@haxtheweb/haxcms-nodejs,0,26.0.0,,HIGH,CWE-79,
 CVE-2026-46396,2026-05-19T14:46:47Z,"Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover",@haxtheweb/iframe-loader,0,26.0.0,,HIGH,CWE-79,
 CVE-2026-46396,2026-05-19T14:46:47Z,"Stored XSS via <iframe> in HAX CMS allows access to sensitive client-side data and account takeover",@haxtheweb/video-player,0,26.0.0,,HIGH,CWE-79,
-CVE-2026-46406,2026-06-25T16:53:00Z,"@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write","@anthropic-ai/claude-code",2.1.59,2.1.128,,MODERATE,CWE-59;CWE-200;CWE-377,
+CVE-2026-46406,2026-06-25T16:53:00Z,"@anthropic-ai/claude-code has an Insecure Temporary File in /copy Command that Enables Response Disclosure and Symlink-Based File Write","@anthropic-ai/claude-code",2.1.59,2.1.128,,MODERATE,CWE-200;CWE-377;CWE-59,
 CVE-2026-46412,2026-05-19T20:28:07Z,"Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm",@beproduct/nestjs-auth,0.1.2,,0.1.19,CRITICAL,CWE-506,
 CVE-2026-46417,2026-05-19T20:29:49Z,"@angular/platform-server: SSRF via Hostname Hijacking",@angular/platform-server,0,,18.2.14,HIGH,CWE-918,
 CVE-2026-46417,2026-05-19T20:29:49Z,"@angular/platform-server: SSRF via Hostname Hijacking",@angular/platform-server,19.0.0-next.0,19.2.22,,HIGH,CWE-918,
@@ -6662,6 +6699,7 @@ CVE-2026-47200,2026-05-29T17:15:11Z,"Nuxt's route middleware is not enforced whe
 CVE-2026-47208,2026-05-29T17:40:15Z,"vm2 is Vulnerable to Sandbox Breakout Through Promise Species",vm2,0,3.11.4,,CRITICAL,CWE-913,
 CVE-2026-47209,2026-05-29T17:49:18Z,"vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain",vm2,0,3.11.4,,HIGH,CWE-693,
 CVE-2026-47210,2026-05-29T17:51:05Z,"vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass",vm2,0,3.11.4,,CRITICAL,CWE-913,
+CVE-2026-47219,2026-07-23T19:33:15Z,"find-my-way: DDoS with HTTP2",find-my-way,0,9.7.0,,HIGH,CWE-1321,
 CVE-2026-47248,2026-05-29T19:18:01Z,"Parse Server's GraphQL ""Did you mean ...?"" validation suggestions disclose schema to unauthenticated callers",parse-server,0,8.6.78,,MODERATE,CWE-209,
 CVE-2026-47248,2026-05-29T19:18:01Z,"Parse Server's GraphQL ""Did you mean ...?"" validation suggestions disclose schema to unauthenticated callers",parse-server,9.0.0,9.9.1-alpha.2,,MODERATE,CWE-209,
 CVE-2026-47250,2026-06-05T15:40:00Z,"MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration",mcp-server-kubernetes,0,3.7.0,,MODERATE,CWE-88,
@@ -6673,7 +6711,7 @@ CVE-2026-47376,2026-06-05T15:59:53Z,"NocoDB: Reflected Cross-Site Scripting via
 CVE-2026-47377,2026-06-05T16:00:15Z,"NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin",nocodb,0,2026.04.1,,MODERATE,CWE-601,
 CVE-2026-47378,2026-06-05T16:03:11Z,"NocoDB: Hidden Column Exposure in Public Shared View Endpoints",nocodb,0,2026.04.1,,MODERATE,CWE-639,
 CVE-2026-47379,2026-06-05T16:03:33Z,"NocoDB: Plaintext Password Comparison in Shared Views",nocodb,0,2026.05.1,,MODERATE,CWE-200;CWE-203,
-CVE-2026-47380,2026-06-05T16:03:55Z,"NocoDB: User Enumeration via Sign-In Timing",nocodb,0,2026.04.1,,LOW,CWE-208;CWE-307,
+CVE-2026-47380,2026-06-05T16:03:55Z,"NocoDB: User Enumeration via Sign-In Timing",nocodb,0,2026.04.1,,MODERATE,CWE-208;CWE-307,
 CVE-2026-47381,2026-06-05T16:04:32Z,"NocoDB: Cross-Workspace Integration Use in Connection Test",nocodb,0,2026.05.1,,MODERATE,CWE-290,
 CVE-2026-47382,2026-06-05T16:19:01Z,"NocoDB: Server-Side Request Forgery via Database Connection Host",nocodb,0,2026.05.1,,MODERATE,CWE-918,
 CVE-2026-47383,2026-06-05T16:19:22Z,"NocoDB: Stored Cross-Site Scripting via Row Comments",nocodb,0,2026.05.1,,HIGH,CWE-79,
@@ -6701,14 +6739,14 @@ CVE-2026-47718,2026-05-28T20:33:11Z,"FUXA provides guest and invalid-token acces
 CVE-2026-47719,2026-06-08T23:06:40Z,"FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading",fuxa-server,0,,1.1.14-1243,HIGH,CWE-918,
 CVE-2026-47720,2026-06-08T23:06:43Z,"FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of escapeTdString",fuxa-server,0,,1.1.14-1243,MODERATE,CWE-89,
 CVE-2026-47721,2026-06-08T23:07:02Z,"FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions",fuxa-server,0,,1.1.14-1243,MODERATE,CWE-862,
-CVE-2026-47759,2026-06-05T20:27:50Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes",tinymce,0,,,HIGH,CWE-79,
+CVE-2026-47759,2026-06-05T20:27:50Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes",tinymce,0,,5.10.9,HIGH,CWE-79,
 CVE-2026-47759,2026-06-05T20:27:50Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes",tinymce,6.0.0,7.9.3,,HIGH,CWE-79,
 CVE-2026-47759,2026-06-05T20:27:50Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes",tinymce,8.0.0,8.5.1,,HIGH,CWE-79,
 CVE-2026-47760,2026-06-05T20:09:38Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs",tinymce,6.8.0,7.1.0,,HIGH,CWE-79,
-CVE-2026-47761,2026-06-05T20:29:43Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection",tinymce,0,,,HIGH,CWE-79,
+CVE-2026-47761,2026-06-05T20:29:43Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection",tinymce,0,,5.10.9,HIGH,CWE-79,
 CVE-2026-47761,2026-06-05T20:29:43Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection",tinymce,6.0.0,7.9.3,,HIGH,CWE-79,
 CVE-2026-47761,2026-06-05T20:29:43Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection",tinymce,8.0.0,8.5.1,,HIGH,CWE-79,
-CVE-2026-47762,2026-06-05T20:29:07Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",tinymce,0,,,HIGH,CWE-79,
+CVE-2026-47762,2026-06-05T20:29:07Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",tinymce,0,,5.10.9,HIGH,CWE-79,
 CVE-2026-47762,2026-06-05T20:29:07Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",tinymce,6.0.0,7.9.3,,HIGH,CWE-79,
 CVE-2026-47762,2026-06-05T20:29:07Z,"TinyMCE Cross-Site Scripting (XSS) vulnerability through `mce:protected` comments",tinymce,8.0.0,8.5.1,,HIGH,CWE-79,
 CVE-2026-4800,2026-04-01T23:51:12Z,"lodash vulnerable to Code Injection via `_.template` imports key names",lodash,4.0.0,4.18.0,,HIGH,CWE-94,
@@ -6763,13 +6801,18 @@ CVE-2026-48712,2026-06-15T17:30:15Z,"protobufjs: Denial of service through unbou
 CVE-2026-48713,2026-06-25T17:28:46Z,"i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string",i18next-fs-backend,0,2.6.6,,CRITICAL,CWE-1321,
 CVE-2026-48714,2026-06-25T17:28:12Z,"i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names",i18next-http-middleware,0,3.9.7,,CRITICAL,CWE-1321,
 CVE-2026-48758,2026-06-26T19:11:19Z,"@sigstore/core has DSSE payloadType type-binding failure",@sigstore/core,0,3.2.1,,MODERATE,CWE-347,
-CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,1.1.0,5.2.5,,HIGH,CWE-400;CWE-770,
-CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,6.0.0,6.2.4,,HIGH,CWE-400;CWE-770,
-CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,7.0.0,7.5.11,,HIGH,CWE-400;CWE-770,
-CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,8.0.0,8.21.0,,HIGH,CWE-400;CWE-770,
+CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,1.1.0,5.2.5,,HIGH,CWE-1050;CWE-400;CWE-770,
+CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,6.0.0,6.2.4,,HIGH,CWE-1050;CWE-400;CWE-770,
+CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,7.0.0,7.5.11,,HIGH,CWE-1050;CWE-400;CWE-770,
+CVE-2026-48779,2026-06-15T16:34:23Z,"ws: Memory exhaustion DoS from tiny fragments and data chunks",ws,8.0.0,8.21.0,,HIGH,CWE-1050;CWE-400;CWE-770,
+CVE-2026-48795,2026-06-30T18:34:32Z,"@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754",@adonisjs/bodyparser,10.1.3,10.1.5,,HIGH,CWE-1321,
+CVE-2026-48795,2026-06-30T18:34:32Z,"@adonisjs/bodyparser has an incomplete fix for CVE-2026-25754",@adonisjs/bodyparser,11.0.0-next.9,11.0.3,,HIGH,CWE-1321,
 CVE-2026-48797,2026-06-26T20:34:29Z,"Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication","@mcptoolshop/backpropagate",1.1.0,1.2.0,,CRITICAL,CWE-1295;CWE-358;CWE-862,
 CVE-2026-48801,2026-06-26T20:47:58Z,"LinkifyIt#match scan loop has quadratic algorithmic complexity",linkify-it,0,5.0.1,,HIGH,CWE-1333,
 CVE-2026-48814,2026-06-19T13:34:24Z,"Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests",network-ai,0,5.7.2,,CRITICAL,CWE-306,
+CVE-2026-48815,2026-07-01T19:58:28Z,"sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced",sigstore,0,4.1.1,,HIGH,CWE-347,
+CVE-2026-48816,2026-07-01T19:57:45Z,"sigstore-js has Insufficient Verification of Data Authenticity",@sigstore/verify,3.1.0,3.1.1,,MODERATE,CWE-345,
+CVE-2026-48819,2026-07-01T20:55:17Z,"@hey-api/openapi-ts's `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key",@hey-api/openapi-ts,0,0.97.3,,MODERATE,CWE-1321,
 CVE-2026-48988,2026-06-15T20:41:06Z,"markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations",markdown-it,0,14.2.0,,MODERATE,CWE-400;CWE-407,
 CVE-2026-48995,2026-06-26T21:49:22Z,"pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile",pnpm,0,10.33.4,,MODERATE,CWE-353,
 CVE-2026-48995,2026-06-26T21:49:22Z,"pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile",pnpm,11.0.0,11.0.7,,MODERATE,CWE-353,
@@ -6777,23 +6820,38 @@ CVE-2026-49143,2026-06-03T21:39:32Z,"browserstack-runner vulnerable to Remote Co
 CVE-2026-49144,2026-06-03T21:38:40Z,"browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server",browserstack-runner,0,,0.9.5,HIGH,CWE-22,
 CVE-2026-49229,2026-06-22T23:19:56Z,"@actual-app/sync-server: Disabled OpenID users keep access through existing session tokens",@actual-app/sync-server,0,26.6.0,,HIGH,CWE-613,
 CVE-2026-4923,2026-03-27T22:23:52Z,"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards",path-to-regexp,8.0.0,8.4.0,,MODERATE,CWE-1333,
+CVE-2026-49250,2026-07-02T19:18:41Z,"@conform-to/dom parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields",@conform-to/dom,1.8.0,1.19.4,,HIGH,CWE-407,
 CVE-2026-49252,2026-06-26T21:03:59Z,"deepstream is vulnerable to prototype pollution",@deepstream/server,0,10.0.5,,CRITICAL,CWE-1321,
+CVE-2026-49253,2026-07-02T19:20:20Z,"electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling",electerm,0,3.11.11,,HIGH,CWE-22,
+CVE-2026-49255,2026-07-02T19:22:31Z,"electerm has Command Injection in File System Operations (rmrf, mv, cp)",electerm,0,3.11.11,,HIGH,CWE-78,
 CVE-2026-4926,2026-03-27T22:23:27Z,"path-to-regexp vulnerable to Denial of Service via sequential optional groups",path-to-regexp,8.0.0,8.4.0,,HIGH,CWE-1333;CWE-400,
 CVE-2026-49293,2026-06-26T22:21:43Z,"js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals",js-toml,0,1.1.1,,HIGH,CWE-1333;CWE-400;CWE-407,
 CVE-2026-49336,2026-06-26T22:23:11Z,"@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter","@microsoft/kiota-http-fetchlibrary",1.0.0-preview.97,1.0.0-preview.102,,MODERATE,CWE-178;CWE-200,
+CVE-2026-49352,2026-07-02T20:56:55Z,"9router's Hardcoded Default fallback JWT Secret  Allows Authentication Bypass",9router,0.2.21,0.4.45,,CRITICAL,CWE-798,
+CVE-2026-49353,2026-07-02T21:13:19Z,"9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING",9router,0,,0.4.55,HIGH,CWE-290,
 CVE-2026-49356,2026-06-15T17:14:14Z,"@babel/core: Arbitrary File Read via sourceMappingURL Comment",@babel/core,0,7.29.6,,LOW,CWE-200;CWE-22,
 CVE-2026-49356,2026-06-15T17:14:14Z,"@babel/core: Arbitrary File Read via sourceMappingURL Comment",@babel/core,8.0.0-alpha.0,8.0.0-rc.6,,LOW,CWE-200;CWE-22,
 CVE-2026-49357,2026-06-26T21:50:49Z,"Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication",line-desktop-mcp,0,1.1.2,,HIGH,CWE-306;CWE-862,
 CVE-2026-49444,2026-06-16T17:37:21Z,"n8n: Python sandbox escape",n8n,0,1.123.48,,HIGH,CWE-20,
 CVE-2026-49444,2026-06-16T17:37:21Z,"n8n: Python sandbox escape",n8n,2.0.0-rc.0,2.21.8,,HIGH,CWE-20,
 CVE-2026-49444,2026-06-16T17:37:21Z,"n8n: Python sandbox escape",n8n,2.22.0,2.22.4,,HIGH,CWE-20,
+CVE-2026-49455,2026-07-08T20:27:11Z,"Waku: Cross-Origin CSRF on RSC Server Action Dispatch",waku,0,1.0.0-beta.1,,MODERATE,CWE-352,
+CVE-2026-49456,2026-07-08T20:30:21Z,"Waku has an Open Redirect via `unstable_redirect` Helper",waku,0,1.0.0-beta.1,,LOW,CWE-601,
 CVE-2026-49458,2026-06-15T19:56:35Z,"DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks",dompurify,0,3.4.6,,MODERATE,CWE-501;CWE-693;CWE-79,
 CVE-2026-49459,2026-06-15T19:53:05Z,"DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM",dompurify,0,3.4.6,,MODERATE,CWE-1321;CWE-693;CWE-79,
 CVE-2026-49465,2026-06-16T17:37:54Z,"n8n: Git Node Clone and Push Operations Bypass File Sandbox",n8n,0,1.123.48,,MODERATE,CWE-22,
 CVE-2026-49465,2026-06-16T17:37:54Z,"n8n: Git Node Clone and Push Operations Bypass File Sandbox",n8n,2.0.0-rc.0,2.21.8,,MODERATE,CWE-22,
 CVE-2026-49465,2026-06-16T17:37:54Z,"n8n: Git Node Clone and Push Operations Bypass File Sandbox",n8n,2.22.0,2.22.4,,MODERATE,CWE-22,
+CVE-2026-49473,2026-06-30T18:09:13Z,"@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation","@cedar-policy/authorization-for-expressjs",0,0.3.0,,HIGH,CWE-436;CWE-863,
+CVE-2026-49856,2026-07-01T18:14:57Z,"@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization",@jshookmcp/jshook,0.3.1,0.3.2,,MODERATE,CWE-918,
+CVE-2026-49857,2026-07-01T18:16:22Z,"auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback",auth-fetch-mcp,0,3.0.2,,HIGH,CWE-918,
+CVE-2026-49864,2026-07-01T18:19:39Z,"wetty vulnerable to DOM XSS via file-download filename",wetty,0,3.0.4,,HIGH,CWE-79,
+CVE-2026-49866,2026-07-10T16:04:49Z,"libp2p: CPU DoS via oversized IHAVE and IWANT control message arrays",@libp2p/gossipsub,0,16.0.0,,HIGH,CWE-20;CWE-400;CWE-770,
+CVE-2026-49977,2026-07-10T16:05:00Z,"tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies",tarteaucitronjs,0,1.33.0,,MODERATE,CWE-285,
 CVE-2026-49978,2026-06-15T20:01:45Z,"DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content",dompurify,0,3.4.7,,MODERATE,CWE-79,
 CVE-2026-49982,2026-06-15T16:36:46Z,"tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template",tmp,0.2.6,0.2.7,,HIGH,CWE-20;CWE-22,
+CVE-2026-49987,2026-07-01T19:00:50Z,"repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection",repomix,0,1.14.1,,HIGH,CWE-88,
+CVE-2026-49988,2026-07-01T19:01:41Z,"repomix: attach_packed_output can bypass file-read secret scanning for supported local files",repomix,0,1.14.1,,MODERATE,CWE-200,
 CVE-2026-49993,2026-06-16T23:39:16Z,"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)",@nuxt/rspack-builder,3.15.4,3.21.7,,MODERATE,CWE-749,
 CVE-2026-49993,2026-06-16T23:39:16Z,"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)",@nuxt/rspack-builder,4.0.0,4.4.7,,MODERATE,CWE-749,
 CVE-2026-49993,2026-06-16T23:39:16Z,"@nuxt/webpack-builder and @nuxt/rspack-builder dev server same-origin check bypassed when Sec-Fetch-Site, Origin, and Referer are all absent (incomplete fix for GHSA-6m52-m754-pw2g)",@nuxt/webpack-builder,3.15.4,3.21.7,,MODERATE,CWE-749,
@@ -6810,9 +6868,18 @@ CVE-2026-50017,2026-06-26T22:59:25Z,"pnpm binds unscoped user-level npm auth cre
 CVE-2026-50021,2026-06-26T22:53:01Z,"pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field",pnpm,0,10.34.1,,MODERATE,CWE-354,
 CVE-2026-50021,2026-06-26T22:53:01Z,"pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field",pnpm,11.0.0,11.4.0,,MODERATE,CWE-354,
 CVE-2026-50029,2026-06-26T22:49:28Z,"js-toml has silent type confusion via falsy-primitive duplicate-key bypass",js-toml,0,1.1.2,,MODERATE,CWE-697,
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,0.11.2,1.9.12,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,1.10.0,1.10.11,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,2.0.0,2.0.19,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,2.1.0,2.1.15,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/fedify,2.2.0,2.2.4,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/vocab-runtime,0,2.0.19,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/vocab-runtime,2.1.0,2.1.15,,HIGH,"CWE-918;CWE-1286;CWE-1389",
+CVE-2026-50131,2026-07-14T18:15:25Z,"Fedify has an incomplete SSRF mitigation after GHSA-p9cg-vqcc-grcx: validatePublicUrl allows special-use IPv4 ranges",@fedify/vocab-runtime,2.2.0,2.2.4,,HIGH,"CWE-918;CWE-1286;CWE-1389",
 CVE-2026-50132,2026-06-22T23:08:23Z,"Budibase has an Account Impersonation Issue — Chat Identity Link Hijacking via Missing Consent & CSRF",@budibase/server,0,3.39.0,,HIGH,CWE-284;CWE-352,
-CVE-2026-50136,2026-06-22T23:15:10Z,"Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials",@budibase/server,0,3.39.2,,HIGH,,
+CVE-2026-50136,2026-06-22T23:15:10Z,"Budibase: Unauthenticated S3 signed upload URL generation allows arbitrary writes with stored datasource credentials",@budibase/server,0,3.39.2,,HIGH,CWE-306,
 CVE-2026-50137,2026-06-22T23:19:26Z,"Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials",@budibase/server,0,3.39.0,,HIGH,CWE-862,
+CVE-2026-50143,2026-07-01T22:02:15Z,"Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token",@apify/actors-mcp-server,0,0.10.11,,HIGH,CWE-918,
 CVE-2026-50146,2026-06-16T14:05:06Z,"Astro: Reflected XSS via unescaped slot name",astro,0,6.3.3,,HIGH,CWE-79;CWE-80,
 CVE-2026-50168,2026-06-15T16:39:20Z,"@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass",@angular/platform-server,0,,18.2.14,HIGH,CWE-346;CWE-918,
 CVE-2026-50168,2026-06-15T16:39:20Z,"@angular/platform-server: URL Parser Differential leading to SSRF Allowlist Bypass",@angular/platform-server,19.0.0-next.0,19.2.23,,HIGH,CWE-346;CWE-918,
@@ -6840,7 +6907,11 @@ CVE-2026-50184,2026-06-15T17:13:05Z,"@angular/service-worker: Request Credential
 CVE-2026-50184,2026-06-15T17:13:05Z,"@angular/service-worker: Request Credential & Cache Policy Stripping",@angular/service-worker,20.0.0-next.0,20.3.22,,MODERATE,CWE-200;CWE-524,
 CVE-2026-50184,2026-06-15T17:13:05Z,"@angular/service-worker: Request Credential & Cache Policy Stripping",@angular/service-worker,21.0.0-next.0,21.2.15,,MODERATE,CWE-200;CWE-524,
 CVE-2026-50184,2026-06-15T17:13:05Z,"@angular/service-worker: Request Credential & Cache Policy Stripping",@angular/service-worker,22.0.0-next.0,22.0.0-rc.2,,MODERATE,CWE-200;CWE-524,
+CVE-2026-50272,2026-07-15T22:58:52Z,"dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS",dd-trace,0,5.100.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-50287,2026-06-01T13:58:33Z,"@agenticmail/mcp Missing Authentication for Critical Function",@agenticmail/mcp,0,0.9.27,,HIGH,CWE-306,
+CVE-2026-50288,2026-07-02T18:59:33Z,"@asymmetric-effort/specifyjs: URL parse failure silently allows request","@asymmetric-effort/specifyjs",0,0.2.136,,HIGH,CWE-918,
+CVE-2026-50289,2026-07-15T23:09:28Z,"systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux",systeminformation,0,5.31.7,,HIGH,CWE-78,
+CVE-2026-50290,2026-07-02T19:08:45Z,"@asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-79,
 CVE-2026-5038,2026-06-17T18:11:48Z,"Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",multer,2.0.0-alpha.1,2.2.0,,MODERATE,CWE-459,
 CVE-2026-5038,2026-06-17T18:11:48Z,"Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",multer,3.0.0-alpha.1,3.0.0-alpha.2,,MODERATE,CWE-459,
 CVE-2026-50555,2026-06-15T17:20:30Z,"@angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",@angular/platform-server,0,,18.2.14,HIGH,CWE-79,
@@ -6865,6 +6936,7 @@ CVE-2026-50557,2026-06-15T17:21:58Z,"Angular: Template and Attribute Namespace S
 CVE-2026-50557,2026-06-15T17:21:58Z,"Angular: Template and Attribute Namespace Sanitization Bypass (XSS)",@angular/core,22.0.0-next.0,22.0.0-rc.2,,MODERATE,CWE-79,
 CVE-2026-50573,2026-06-26T22:52:33Z,"pnpm: Unsafe default behavior breaks integrity check",pnpm,0,10.34.0,,MODERATE,CWE-345,
 CVE-2026-50573,2026-06-26T22:52:33Z,"pnpm: Unsafe default behavior breaks integrity check",pnpm,11.0.0,11.4.0,,MODERATE,CWE-345,
+CVE-2026-5078,2026-07-10T14:32:15Z,"morgan vulnerable to Log Forging via unneutralized control characters in :remote-user",morgan,1.2.0,1.11.0,,MODERATE,CWE-117,
 CVE-2026-5079,2026-06-17T18:12:27Z,"Multer vulnerable to Denial of Service via deeply nested field names",multer,1.0.0,2.2.0,,HIGH,CWE-400,
 CVE-2026-5079,2026-06-17T18:12:27Z,"Multer vulnerable to Denial of Service via deeply nested field names",multer,3.0.0-alpha.1,3.0.0-alpha.2,,HIGH,CWE-400,
 CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",@angular/core,0,,18.2.14,MODERATE,CWE-79,
@@ -6872,13 +6944,31 @@ CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic
 CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",@angular/core,20.0.0-next.0,20.3.22,,MODERATE,CWE-79,
 CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",@angular/core,21.0.0-next.0,21.2.15,,MODERATE,CWE-79,
 CVE-2026-52725,2026-06-15T16:51:35Z,"@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",@angular/core,22.0.0-next.0,22.0.0-rc.2,,MODERATE,CWE-79,
+CVE-2026-52746,2026-07-02T20:13:55Z,"jsonata: Malicious inputs to ""$toMillis"" function can cause resource exhaustion",jsonata,0,2.2.0,,HIGH,CWE-1333,
 CVE-2026-5323,2026-04-02T09:30:24Z,"a11y-mcp: Server-Side Request Forgery (SSRF) vulnerability in A11yServer function",a11y-mcp,0,1.0.5,,LOW,CWE-918,
 CVE-2026-5327,2026-04-02T12:31:05Z,"fast-filesystem-mcp is vulnerable to command injection through handleGetDiskUsage function",fast-filesystem-mcp,0,,3.5.0,LOW,CWE-74,
-CVE-2026-53550,2026-06-15T17:15:07Z,"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",js-yaml,0,4.2.0,,MODERATE,CWE-407,
+CVE-2026-53486,2026-07-06T20:27:38Z,"Decompress: Archive extraction can create files and links outside of the target directory",@xhmikosr/decompress,0,10.2.1,,CRITICAL,CWE-22;CWE-59;CWE-732,
+CVE-2026-53486,2026-07-06T20:27:38Z,"Decompress: Archive extraction can create files and links outside of the target directory",@xhmikosr/decompress,11.0.0,11.1.3,,CRITICAL,CWE-22;CWE-59;CWE-732,
+CVE-2026-53486,2026-07-06T20:27:38Z,"Decompress: Archive extraction can create files and links outside of the target directory",decompress,0,,4.2.1,CRITICAL,CWE-22;CWE-59;CWE-732,
+CVE-2026-53496,2026-07-17T20:19:39Z,"ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes",exifreader,0,4.40.1,,MODERATE,CWE-248;CWE-755,
+CVE-2026-53509,2026-07-07T19:35:57Z,"@aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)","@aborruso/ckan-mcp-server",0,0.4.106,,MODERATE,CWE-918,
+CVE-2026-53512,2026-07-07T20:11:50Z,"Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins",better-auth,0,1.6.11,,CRITICAL,"CWE-287;CWE-306;CWE-345;CWE-863",
+CVE-2026-53513,2026-07-07T20:56:19Z,"@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints",@better-auth/sso,0.1.0,1.6.11,,CRITICAL,"CWE-20;CWE-345;CWE-441;CWE-918",
+CVE-2026-53514,2026-07-07T20:54:51Z,"Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin",better-auth,0,1.6.11,,HIGH,"CWE-287;CWE-345;CWE-441;CWE-862",
+CVE-2026-53515,2026-07-20T21:06:17Z,"@better-auth/sso: SSO provider may allow registration for any org member without a checking their role",@better-auth/sso,1.2.10,1.6.11,,HIGH,CWE-269;CWE-285;CWE-863,
+CVE-2026-53516,2026-07-07T20:55:13Z,"Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email",better-auth,0,1.6.11,,HIGH,CWE-287;CWE-345,
+CVE-2026-53517,2026-07-07T20:55:48Z,"Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption","@better-auth/oauth-provider",1.6.0,1.6.11,,HIGH,"CWE-294;CWE-362;CWE-367;CWE-613",
+CVE-2026-53517,2026-07-07T20:55:48Z,"Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption",better-auth,1.4.8-beta.7,1.6.0,,HIGH,"CWE-294;CWE-362;CWE-367;CWE-613",
+CVE-2026-53518,2026-07-07T20:56:35Z,"@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive","@better-auth/oauth-provider",1.6.0,1.6.11,,HIGH,CWE-294;CWE-362;CWE-367,
+CVE-2026-53518,2026-07-07T20:56:35Z,"@better-auth/oauth-provider's OAuth authorization-code grant allows concurrent redemption when two token requests race the find-then-delete primitive",better-auth,0,1.6.11,,HIGH,CWE-294;CWE-362;CWE-367,
+CVE-2026-53550,2026-06-15T17:15:07Z,"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",js-yaml,0,3.15.0,,MODERATE,CWE-407,
+CVE-2026-53550,2026-06-15T17:15:07Z,"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases",js-yaml,4.0.0,4.2.0,,MODERATE,CWE-407,
 CVE-2026-53571,2026-06-15T17:17:45Z,"vite: `server.fs.deny` bypass on Windows alternate paths",vite,0,6.4.3,,HIGH,CWE-200;CWE-22,
 CVE-2026-53571,2026-06-15T17:17:45Z,"vite: `server.fs.deny` bypass on Windows alternate paths",vite,7.0.0,7.3.5,,HIGH,CWE-200;CWE-22,
 CVE-2026-53571,2026-06-15T17:17:45Z,"vite: `server.fs.deny` bypass on Windows alternate paths",vite,8.0.0,8.0.16,,HIGH,CWE-200;CWE-22,
 CVE-2026-53571,2026-06-15T17:17:45Z,"vite: `server.fs.deny` bypass on Windows alternate paths",vite-plus,0,0.1.24,,HIGH,CWE-200;CWE-22,
+CVE-2026-53597,2026-07-17T19:53:34Z,"Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader",@prompty/core,2.0.0-alpha.1,2.0.0-beta.3,,HIGH,CWE-94,
+CVE-2026-53598,2026-07-17T19:46:05Z,"Prompty: Arbitrary file read via file reference expansion",@prompty/core,0,2.0.0-beta.2,,HIGH,CWE-22;CWE-200,
 CVE-2026-53632,2026-06-15T17:18:31Z,"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",launch-editor,0,2.14.1,,MODERATE,CWE-522;CWE-73,
 CVE-2026-53632,2026-06-15T17:18:31Z,"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",vite,0,6.4.3,,MODERATE,CWE-522;CWE-73,
 CVE-2026-53632,2026-06-15T17:18:31Z,"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",vite,7.0.0,7.3.5,,MODERATE,CWE-522;CWE-73,
@@ -6891,6 +6981,11 @@ CVE-2026-53633,2026-06-15T20:05:15Z,"Vitest Browser: Exposed Browser Mode API Ca
 CVE-2026-53655,2026-06-15T17:19:42Z,"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",tar,0,7.5.16,,MODERATE,CWE-436,
 CVE-2026-53663,2026-06-15T20:06:15Z,"React Router: Potential CSRF via PUT/PATCH/DELETE document requests","@remix-run/server-runtime",2.17.3,2.17.5,,LOW,CWE-352,
 CVE-2026-53663,2026-06-15T20:06:15Z,"React Router: Potential CSRF via PUT/PATCH/DELETE document requests",react-router,7.12.0,7.15.1,,LOW,CWE-352,
+CVE-2026-53666,2026-07-23T19:34:14Z,"React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration",react-router,6.4.0,7.18.0,,MODERATE,CWE-470,
+CVE-2026-53667,2026-07-23T19:35:57Z,"React Router: RSCErrorHandler Missing Protocol Validation (XSS)",react-router,7.11.0,7.18.0,,MODERATE,CWE-79,
+CVE-2026-53668,2026-07-23T19:36:31Z,"React Router: Open redirect leading to XSS",react-router,7.9.6,7.13.0,,MODERATE,CWE-601,
+CVE-2026-53668,2026-07-23T19:36:31Z,"React Router: Open redirect leading to XSS",react-router-dom,6.30.2,,6.30.4,MODERATE,CWE-601,
+CVE-2026-53669,2026-07-23T19:38:28Z,"React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)",react-router,6.0.0,7.18.0,,MODERATE,CWE-601,
 CVE-2026-53721,2026-06-16T13:48:31Z,"Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher",nuxt,3.11.0,3.21.7,,HIGH,CWE-178;CWE-863,
 CVE-2026-53721,2026-06-16T13:48:31Z,"Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher",nuxt,4.0.0,4.4.7,,HIGH,CWE-178;CWE-863,
 CVE-2026-53722,2026-06-16T13:49:36Z,"Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL",nuxt,0,3.21.7,,MODERATE,CWE-79;CWE-83,
@@ -6901,6 +6996,18 @@ CVE-2026-53725,2026-06-19T19:35:15Z,"parse-server: Endpoints `/login` and `/veri
 CVE-2026-53726,2026-06-19T19:35:19Z,"parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL",parse-server,0,8.6.80,,MODERATE,CWE-639,
 CVE-2026-53726,2026-06-19T19:35:19Z,"parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL",parse-server,9.0.0,9.9.1-alpha.6,,MODERATE,CWE-639,
 CVE-2026-53765,2026-06-17T14:01:04Z,"Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory",chrome-devtools-mcp,0.20.0,1.1.0,,MODERATE,CWE-59,
+CVE-2026-53806,2026-07-02T17:11:43Z,"OpenClaw: Combined POSIX shell options could confuse exec revalidation",openclaw,0,2026.5.12,,HIGH,CWE-367,
+CVE-2026-53809,2026-07-02T16:58:51Z,"OpenClaw: Embedded runner policy could be confused by provider aliases",openclaw,0,2026.4.25,,MODERATE,CWE-863,
+CVE-2026-53810,2026-07-02T16:00:42Z,"OpenClaw's marketplace runtime extension metadata could point at unscanned payloads",openclaw,0,2026.5.18,,HIGH,"CWE-284;CWE-78;CWE-829;CWE-94",
+CVE-2026-53811,2026-07-02T17:13:58Z,"OpenClaw: Matrix allowFrom could bind to mutable display names",openclaw,0,2026.5.7,,HIGH,CWE-290,
+CVE-2026-53812,2026-07-02T16:00:03Z,"OpenClaw's browser act interactions could bypass private-network navigation checks",openclaw,0,2026.5.18,,MODERATE,CWE-284;CWE-918,
+CVE-2026-53813,2026-07-02T16:57:56Z,"OpenClaw: Fake package roots could influence memory-core artifact loading",openclaw,0,2026.4.25,,HIGH,CWE-427,
+CVE-2026-53814,2026-07-02T16:05:03Z,"OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority",openclaw,0,2026.5.20,,HIGH,CWE-200;CWE-266;CWE-284,
+CVE-2026-53815,2026-07-02T15:40:01Z,"OpenClaw: Message read actions could skip channel allowlist checks",openclaw,0,2026.5.19,,HIGH,CWE-200;CWE-862,
+CVE-2026-53816,2026-07-02T17:12:03Z,"OpenClaw: Paired nodes could forge exec lifecycle events without system.run provenance",openclaw,0,2026.5.18,,HIGH,CWE-284;CWE-862;CWE-863,
+CVE-2026-53817,2026-07-02T16:04:35Z,"OpenClaw: Control UI locality spoofing could mint a durable admin device token",openclaw,0,2026.5.22,,HIGH,"CWE-284;CWE-287;CWE-290;CWE-863",
+CVE-2026-53818,2026-07-02T17:11:35Z,"OpenClaw: MCP loopback could skip owner-only tool policy for non-owner callers",openclaw,0,2026.4.24,,MODERATE,CWE-862,
+CVE-2026-53819,2026-07-02T16:57:30Z,"OpenClaw: Workspace .env could override Homebrew executable selection for skill install flows",openclaw,0,2026.5.27,,HIGH,CWE-426,
 CVE-2026-53840,2026-06-17T17:55:06Z,"OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin",openclaw,0,2026.5.12,,HIGH,CWE-200,
 CVE-2026-53841,2026-06-18T20:14:40Z,"OpenClaw: Exported session HTML could keep unsafe markdown links",openclaw,0,2026.5.12,,MODERATE,CWE-79,
 CVE-2026-53842,2026-06-18T13:04:09Z,"OpenClaw: Workspace .env CLOUDSDK_PYTHON could influence Gmail setup gcloud execution",openclaw,0,2026.5.2,,HIGH,CWE-426,
@@ -6934,7 +7041,9 @@ CVE-2026-53928,2026-06-17T14:07:33Z,"NocoDB: Refresh Tokens Persist Through Pass
 CVE-2026-53929,2026-06-17T14:07:52Z,"NocoDB: Stored Cross-Site Scripting via Secure Attachment",nocodb,0,,0.301.3,MODERATE,CWE-79,
 CVE-2026-53930,2026-06-17T14:08:04Z,"NocoDB: Server-Side Request Forgery via Base Migration URL",nocodb,0,,0.301.3,MODERATE,CWE-918,
 CVE-2026-53931,2026-06-17T14:08:26Z,"NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint",nocodb,0,,0.301.3,MODERATE,CWE-441;CWE-918,
+CVE-2026-53943,2026-07-01T21:58:32Z,"Ghost: Cache-poisoning XSS in Ghost frontend via x-ghost-preview header",ghost,4.0.0,6.37.0,,CRITICAL,CWE-524,
 CVE-2026-54051,2026-06-19T13:35:05Z,"Network-AI: Improper Neutralization of Special Elements used in an OS Command ",network-ai,0,5.9.1,,CRITICAL,CWE-78,
+CVE-2026-54052,2026-07-14T19:07:14Z,"n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments",n8n-mcp,0,2.56.1,,CRITICAL,CWE-639;CWE-862,
 CVE-2026-54074,2026-06-19T21:15:16Z,"@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels",@tinacms/cli,0,2.4.3,,HIGH,CWE-94,
 CVE-2026-54157,2026-06-16T20:15:57Z,"LobeHub: Unauthenticated SSRF in `/webapi/proxy`",@lobehub/lobehub,0,2.1.57,,CRITICAL,CWE-918,
 CVE-2026-54257,2026-06-15T20:20:24Z,"Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow",electron,42.3.1,42.3.3,,CRITICAL,CWE-120,
@@ -7012,12 +7121,21 @@ CVE-2026-54327,2026-06-17T13:54:37Z,"Pi Agent: Race condition in Pi auth.json wr
 CVE-2026-54327,2026-06-17T13:54:37Z,"Pi Agent: Race condition in Pi auth.json writes could expose stored credentials","@mariozechner/pi-coding-agent",0.28.0,,0.73.1,LOW,CWE-367;CWE-732,
 CVE-2026-54328,2026-06-17T13:55:13Z,"Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts","@earendil-works/pi-coding-agent",0.74.0,0.78.1,,HIGH,CWE-379,
 CVE-2026-54328,2026-06-17T13:55:13Z,"Pi Agent: Predictable temporary extension install paths allow local privilege escalation on shared Linux hosts","@mariozechner/pi-coding-agent",0.50.0,,0.73.1,HIGH,CWE-379,
+CVE-2026-54335,2026-07-14T19:40:05Z,"Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__",@feathersjs/commons,0,5.0.45,,LOW,CWE-1321,
 CVE-2026-54350,2026-06-23T17:43:10Z,"Budibase has nonymous NoSQL operator injection via published-app query templates",@budibase/server,0,3.39.12,,CRITICAL,CWE-89;CWE-943,
 CVE-2026-54351,2026-06-22T23:20:20Z,"Budibase: Mass Assignment in Webhook Trigger Allows Cross-Workspace Automation Execution via appId Override",@budibase/server,0,3.39.9,,HIGH,CWE-915,
 CVE-2026-54352,2026-06-22T23:33:35Z,"Budibase has arbitrary file read by workspace-builder via PWA-zip symlink upload",@budibase/server,0,3.39.9,,CRITICAL,CWE-22;CWE-59,
 CVE-2026-54353,2026-06-22T23:39:24Z,"@budibase/backend-core has potential SSRF DNS rebinding bypass in outbound fetch validation",@budibase/backend-core,0,3.39.9,,HIGH,CWE-367;CWE-918,
+CVE-2026-54466,2026-07-15T22:07:24Z,"websocket-driver: Message corruption via abuse of protocol length headers",websocket-driver,0,0.7.5,,CRITICAL,CWE-130,
+CVE-2026-54490,2026-07-15T22:08:17Z,"websocket-driver: Resource limit bypass via message compression",websocket-driver,0,0.7.5,,MODERATE,CWE-770,
+CVE-2026-54504,2026-07-15T23:26:57Z,"@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default","@andrea9293/mcp-documentation-server",1.13.0,1.13.1,,HIGH,CWE-306;CWE-668,
 CVE-2026-54527,2026-06-19T19:36:04Z,"jupyterlab-git extension: Stored XSS leading to RCE",@jupyterlab/git,0.30.0b3,0.54.0,,HIGH,CWE-79,
+CVE-2026-54546,2026-07-17T19:02:37Z,"TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard",@tak-ps/cloudtak,0,,13.5.0,MODERATE,CWE-918,
+CVE-2026-54561,2026-07-17T19:23:07Z,"mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath",mcp-memory-keeper,0,0.13.0,,MODERATE,CWE-22;CWE-209,
+CVE-2026-54672,2026-07-24T14:00:59Z,"electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`",app-builder-lib,0,26.15.0,,HIGH,CWE-427,
+CVE-2026-54673,2026-07-24T14:03:19Z,"electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`",builder-util-runtime,0,9.7.0,,HIGH,CWE-200,
 CVE-2026-55091,2026-06-19T20:47:52Z,"flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key",flat-to-nested,0,1.1.2,,HIGH,CWE-1321;CWE-915,
+CVE-2026-55177,2026-07-17T21:35:10Z,"CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard",@tak-ps/cloudtak,0,13.10.0,,HIGH,CWE-918,
 CVE-2026-55180,2026-06-26T23:12:25Z,"pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",pnpm,0,10.34.2,,MODERATE,CWE-200;CWE-201;CWE-522,
 CVE-2026-55180,2026-06-26T23:12:25Z,"pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",pnpm,11.0.0,11.5.3,,MODERATE,CWE-200;CWE-201;CWE-522,
 CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE via inherited options.filename",piscina,0,4.9.3,,HIGH,CWE-1321;CWE-94,
@@ -7025,18 +7143,24 @@ CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE
 CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE via inherited options.filename",piscina,6.0.0-rc.1,6.0.0-rc.2,,HIGH,CWE-1321;CWE-94,
 CVE-2026-55487,2026-06-26T23:18:13Z,"pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",pnpm,0,10.34.2,,HIGH,CWE-346;CWE-693;CWE-829,
 CVE-2026-55487,2026-06-26T23:18:13Z,"pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",pnpm,11.0.0,11.5.3,,HIGH,CWE-346;CWE-693;CWE-829,
+CVE-2026-55500,2026-07-06T21:37:49Z,"9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover",9router,0,,0.4.71,CRITICAL,CWE-200,
+CVE-2026-55501,2026-07-06T21:46:20Z,"9router: Login brute-force protection bypass via spoofed X-Forwarded-For header",9router,0,0.4.77,,HIGH,CWE-290;CWE-307,
+CVE-2026-55575,2026-07-24T14:05:20Z,"LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce",liquidjs,0,10.27.1,,HIGH,CWE-770,
 CVE-2026-55591,2026-06-18T21:13:36Z,"Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints",signalk-server,0,2.28.0,,MODERATE,CWE-918,
-CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,0.16.0,2.0.10,,MODERATE,CWE-20;CWE-187,
-CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,3.0.0,3.0.6,,MODERATE,CWE-20;CWE-187,
-CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,4.0.0,4.1.0,,MODERATE,CWE-20;CWE-187,
+CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,0.16.0,2.0.10,,MODERATE,CWE-187;CWE-20,
+CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,3.0.0,3.0.6,,MODERATE,CWE-187;CWE-20,
+CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,4.0.0,4.1.0,,MODERATE,CWE-187;CWE-20,
 CVE-2026-55603,2026-06-18T13:06:21Z,"http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`",http-proxy-middleware,3.0.4,3.0.7,,HIGH,CWE-93,
 CVE-2026-55603,2026-06-18T13:06:21Z,"http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`",http-proxy-middleware,4.0.0,4.1.1,,HIGH,CWE-93,
+CVE-2026-55607,2026-07-24T16:54:09Z,"Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution","@anthropic-ai/claude-code",2.1.38,2.1.163,,HIGH,CWE-22;CWE-59;CWE-78,
+CVE-2026-55608,2026-07-14T20:26:39Z,"n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode",n8n-mcp,0,2.57.4,,MODERATE,CWE-200;CWE-863,
 CVE-2026-55617,2026-06-18T13:06:35Z,"Hydro: Insufficient session expiration when recreating sessions",hydrooj,4.10.4,5.0.2,,MODERATE,CWE-613,
 CVE-2026-55650,2026-06-19T21:18:44Z,"Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure",@outerbase/studio,0,,0.10.2,MODERATE,CWE-79,
 CVE-2026-55660,2026-06-19T21:15:29Z,"TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover",@tinacms/app,0,2.5.6,,HIGH,"CWE-346;CWE-601;CWE-79;CWE-940",
 CVE-2026-55660,2026-06-19T21:15:29Z,"TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover",tinacms,0,3.9.3,,HIGH,"CWE-346;CWE-601;CWE-79;CWE-940",
 CVE-2026-55661,2026-06-18T13:07:05Z,"TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes",@tinacms/mdx,0,2.1.7,,MODERATE,CWE-79;CWE-87,
 CVE-2026-55661,2026-06-18T13:07:05Z,"TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes",tinacms,0,3.9.3,,MODERATE,CWE-79;CWE-87,
+CVE-2026-55685,2026-07-24T14:06:57Z,"React Router: Unauthenticated Denial of Service via Inefficient Route Matching",react-router,7.0.0,7.18.0,,HIGH,CWE-400;CWE-407,
 CVE-2026-55697,2026-06-26T23:20:47Z,"pnpm: Repository-controlled configDependencies can select a pacquet native install engine",pnpm,0,11.5.3,,HIGH,CWE-494;CWE-78;CWE-829,
 CVE-2026-55697,2026-06-26T23:20:47Z,"pnpm: Repository-controlled configDependencies can select a pacquet native install engine",pnpm,11.0.0,11.5.3,,HIGH,CWE-494;CWE-78;CWE-829,
 CVE-2026-55698,2026-06-26T23:34:06Z,"pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes",pnpm,0,10.34.2,,HIGH,CWE-345;CWE-494;CWE-829,
@@ -7063,13 +7187,83 @@ CVE-2026-56357,2026-02-26T15:58:34Z,"n8n: Webhook Forgery on Github Webhook Trig
 CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,0,1.123.25,,MODERATE,CWE-79,
 CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,2.0.0-rc.0,2.11.2,,MODERATE,CWE-79,
 CVE-2026-56761,2026-04-16T01:02:24Z,"hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR",hono,0,4.12.14,,MODERATE,CWE-79,
+CVE-2026-57133,2026-06-18T14:26:54Z,"npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining",praisonai,1.5.1,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
+CVE-2026-57134,2026-06-18T14:25:17Z,"npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation",praisonai,1.5.1,1.7.2,,HIGH,CWE-287;CWE-288;CWE-863,
+CVE-2026-57135,2026-06-18T14:26:28Z,"npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients",praisonai,1.2.3,1.7.2,,HIGH,CWE-653;CWE-693,
+CVE-2026-57136,2026-06-18T14:26:34Z,"npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining",praisonai,1.2.3,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
+CVE-2026-57137,2026-06-18T14:26:51Z,"npm PraisonAI AgentLoop onToolCall approval runs after tool execution",praisonai,1.4.0,1.7.2,,HIGH,CWE-693;CWE-862;CWE-863,
+CVE-2026-57138,2026-06-18T14:26:32Z,"npm PraisonAI codeMode sandbox escape via Function constructor",praisonai,1.4.0,1.7.2,,CRITICAL,CWE-184;CWE-693,
+CVE-2026-57139,2026-06-18T14:26:48Z,"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call",praisonai,1.5.0,1.7.2,,CRITICAL,CWE-1188;CWE-306;CWE-862,
+CVE-2026-57140,2026-06-18T14:26:42Z,"npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation",praisonai,1.6.0,1.7.2,,CRITICAL,CWE-306,
+CVE-2026-57141,2026-06-18T14:26:37Z,"PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool",praisonai,0,1.7.2,,CRITICAL,CWE-94,
+CVE-2026-57441,2026-06-18T14:30:43Z,"MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence",@bitbonsai/mcpvault,0,0.11.4,,MODERATE,CWE-178;CWE-41,
+CVE-2026-57442,2026-06-19T21:42:24Z,"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested",@bitbonsai/mcpvault,0,0.11.5,,MODERATE,CWE-22;CWE-538,
+CVE-2026-57494,2026-06-18T17:20:55Z,"AgenticMail: Cross-agent task authorization bypass in AgenticMail API",@agenticmail/api,0,0.9.64,,HIGH,CWE-639;CWE-862,
+CVE-2026-57495,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/claudecode,0,0.2.39,,HIGH,CWE-306,
+CVE-2026-57495,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/codex,0,0.1.33,,HIGH,CWE-306,
+CVE-2026-57495,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/core,0,0.9.43,,HIGH,CWE-306,
+CVE-2026-57495,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/openclaw,0,0.5.71,,HIGH,CWE-306,
 CVE-2026-5758,2026-04-15T18:31:58Z,"Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution",protocol-buffers-schema,0,3.6.1,,MODERATE,CWE-1321,
 CVE-2026-5831,2026-04-09T03:31:14Z,"Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts",taskflow-ai,0,2.1.9,,MODERATE,CWE-77,
 CVE-2026-5832,2026-04-09T03:31:15Z,"api-lab-mcp vulnerable to SSRF",api-lab-mcp,0,,0.2.1,MODERATE,CWE-918,
 CVE-2026-5833,2026-04-09T06:30:27Z,"awwaiid mcp-server-taskwarrior vulnerable to command injection",mcp-server-taskwarrior,0,,1.0.1,LOW,CWE-74,
+CVE-2026-58399,2026-06-18T17:22:47Z,"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()",@acastellon/auth,0,2.3.0,,CRITICAL,CWE-290,
 CVE-2026-5842,2026-04-09T06:30:28Z,"decolua 9router vulnerable to authorization bypass",9router,0,0.3.75,,MODERATE,CWE-285,
+CVE-2026-58661,2026-07-22T22:25:45Z,"n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads",n8n,0,1.123.58,,MODERATE,CWE-770,
+CVE-2026-58661,2026-07-22T22:25:45Z,"n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads",n8n,2.0.0,2.28.0,,MODERATE,CWE-770,
+CVE-2026-59206,2026-07-22T21:57:21Z,"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration",n8n,0,1.123.61,,HIGH,CWE-1321,
+CVE-2026-59206,2026-07-22T21:57:21Z,"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration",n8n,2.0.0-rc.0,2.27.4,,HIGH,CWE-1321,
+CVE-2026-59206,2026-07-22T21:57:21Z,"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration",n8n,2.28.0,2.28.1,,HIGH,CWE-1321,
+CVE-2026-59207,2026-07-22T21:58:31Z,"n8n: ""Allowed HTTP Request Domains"" Restriction Bypass via AI Agents MCP Connector",n8n,0,2.27.4,,HIGH,CWE-693,
+CVE-2026-59207,2026-07-22T21:58:31Z,"n8n: ""Allowed HTTP Request Domains"" Restriction Bypass via AI Agents MCP Connector",n8n,2.28.0,2.28.1,,HIGH,CWE-693,
+CVE-2026-59208,2026-07-22T21:59:15Z,"n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution",n8n,0,2.27.4,,HIGH,CWE-287;CWE-346,
+CVE-2026-59208,2026-07-22T21:59:15Z,"n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution",n8n,2.28.0,2.28.1,,HIGH,CWE-287;CWE-346,
+CVE-2026-59209,2026-07-22T21:54:53Z,"n8n: Shared Credential Header Leak via HTTP Request Pagination Expression",n8n,0,1.123.61,,HIGH,CWE-200,
+CVE-2026-59209,2026-07-22T21:54:53Z,"n8n: Shared Credential Header Leak via HTTP Request Pagination Expression",n8n,2.0.0-rc.0,2.27.4,,HIGH,CWE-200,
+CVE-2026-59209,2026-07-22T21:54:53Z,"n8n: Shared Credential Header Leak via HTTP Request Pagination Expression",n8n,2.28.0,2.28.1,,HIGH,CWE-200,
+CVE-2026-59253,2026-07-22T22:24:43Z,"n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects",n8n,0,2.28.0,,MODERATE,CWE-639,
+CVE-2026-59254,2026-07-22T22:23:29Z,"n8n: External Secrets Accessible via Workflow Expressions Outside Credentials",n8n,0,2.27.4,,MODERATE,CWE-639,
+CVE-2026-59254,2026-07-22T22:23:29Z,"n8n: External Secrets Accessible via Workflow Expressions Outside Credentials",n8n,2.28.0,2.28.1,,MODERATE,CWE-639,
+CVE-2026-59257,2026-07-22T22:22:22Z,"n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,0,1.123.61,,MODERATE,CWE-89,
+CVE-2026-59257,2026-07-22T22:22:22Z,"n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,2.0.0-rc.0,2.27.4,,MODERATE,CWE-89,
+CVE-2026-59257,2026-07-22T22:22:22Z,"n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,2.28.0,2.28.1,,MODERATE,CWE-89,
+CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,0,1.123.61,,MODERATE,CWE-639,
+CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,2.0.0-rc.0,2.27.4,,MODERATE,CWE-639,
+CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,2.28.0,2.28.1,,MODERATE,CWE-639,
+CVE-2026-59725,2026-07-20T21:49:54Z,"Socket.IO: Engine.IO Polling Transport Connection Exhaustion",engine.io,4.1.0,6.6.7,,HIGH,CWE-404,
+CVE-2026-59727,2026-07-20T23:21:02Z,"Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands",astro,3.10.0,7.0.4,,LOW,CWE-116;CWE-79;CWE-83,
+CVE-2026-59728,2026-07-20T23:21:47Z,"@astrojs/rss: XML Injection via Unescaped RSS Feed Fields",@astrojs/rss,1.0.0,4.0.19,,MODERATE,CWE-91,
+CVE-2026-59729,2026-07-20T23:21:58Z,"Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)",astro,0,7.0.6,,MODERATE,CWE-79,
+CVE-2026-59730,2026-07-20T23:22:22Z,"@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect",@astrojs/node,8.1.0,11.0.2,,LOW,CWE-601,
+CVE-2026-59731,2026-07-20T21:58:27Z,"Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch",astro,6.4.7,6.4.8,,HIGH,CWE-647,
+CVE-2026-59800,2026-07-02T20:17:56Z,"9router: Missing Authorization and OS Command Injection",9router,0,0.4.44,,CRITICAL,CWE-78;CWE-862,
 CVE-2026-5986,2026-04-10T00:30:31Z,"Zod jsVideoUrlParser vulnerable to ReDoS in util.js",js-video-url-parser,0,,0.5.1,MODERATE,CWE-400,
+CVE-2026-59868,2026-07-20T21:19:27Z,"js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml",js-yaml,5.0.0,5.2.0,,MODERATE,CWE-400;CWE-407;CWE-770,
+CVE-2026-59869,2026-07-20T21:19:09Z,"js-yaml: YAML merge-key chains can force quadratic CPU consumption",js-yaml,3.0.0,3.15.0,,HIGH,CWE-400;CWE-407,
+CVE-2026-59869,2026-07-20T21:19:09Z,"js-yaml: YAML merge-key chains can force quadratic CPU consumption",js-yaml,4.0.0,4.3.0,,HIGH,CWE-400;CWE-407,
+CVE-2026-59870,2026-07-20T21:18:51Z,"js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA",js-yaml,5.0.0,5.2.1,,MODERATE,CWE-407;CWE-770,
+CVE-2026-59871,2026-07-20T21:53:14Z,"node-tar: Process crash via PAX numeric path type confusion",tar,0,7.5.18,,MODERATE,CWE-704,
+CVE-2026-59873,2026-07-20T21:52:03Z,"node-tar: Decompression/parse DoS via unlimited input",tar,0,7.5.19,,CRITICAL,CWE-770,
+CVE-2026-59874,2026-07-20T21:51:39Z,"node-tar: Negative tar entry size causes infinite loop in archive replace",tar,0,7.5.18,,HIGH,CWE-835,
+CVE-2026-59875,2026-07-20T21:51:12Z,"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records",tar,0,7.5.17,,MODERATE,CWE-248,
+CVE-2026-59876,2026-07-20T22:04:07Z,"protobufjs: Text Format string map parsing can mutate returned map object prototype",protobufjs,8.2.0,8.6.5,,MODERATE,CWE-1321,
+CVE-2026-59877,2026-07-20T22:03:00Z,"protobufjs: Denial of Service via infinite loop in .proto option parsing",protobufjs,7.5.0,7.6.5,,MODERATE,CWE-835,
+CVE-2026-59877,2026-07-20T22:03:00Z,"protobufjs: Denial of Service via infinite loop in .proto option parsing",protobufjs,8.0.0,8.6.6,,MODERATE,CWE-835,
+CVE-2026-59879,2026-07-21T18:36:27Z,"Immutable.js `List` 32-bit trie overflow → unrecoverable DoS",immutable,0,4.3.9,,HIGH,"CWE-1284;CWE-190;CWE-400;CWE-835",
+CVE-2026-59879,2026-07-21T18:36:27Z,"Immutable.js `List` 32-bit trie overflow → unrecoverable DoS",immutable,5.0.0-beta.1,5.1.8,,HIGH,"CWE-1284;CWE-190;CWE-400;CWE-835",
+CVE-2026-59880,2026-07-21T19:02:33Z,"Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set",immutable,0,4.3.9,,HIGH,CWE-400;CWE-407,
+CVE-2026-59880,2026-07-21T19:02:33Z,"Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set",immutable,5.0.0-beta.1,5.1.8,,HIGH,CWE-400;CWE-407,
+CVE-2026-59887,2026-07-21T19:06:09Z,"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text",linkify-it,0,5.0.2,,HIGH,CWE-407,
+CVE-2026-59891,2026-07-21T19:34:05Z,"Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry",@sigstore/oci,0,0.7.1,,CRITICAL,CWE-522,
+CVE-2026-59892,2026-07-21T19:07:28Z,"OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header","@opentelemetry/propagator-jaeger",0,2.9.0,,HIGH,CWE-248,
+CVE-2026-59895,2026-07-21T18:33:50Z,"Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility",hono,4.0.0,4.12.27,,MODERATE,CWE-116;CWE-79,
+CVE-2026-59896,2026-07-21T18:34:19Z,"hono/jsx does not isolate context per request, leading to cross-request data disclosure",hono,4.11.8,4.12.27,,MODERATE,CWE-362,
+CVE-2026-59897,2026-07-21T18:18:13Z,"Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication",hono,4.3.3,4.12.27,,MODERATE,CWE-348,
+CVE-2026-59940,2026-07-24T16:14:05Z,"seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization",seroval,0,1.5.3,,CRITICAL,CWE-502;CWE-843,
+CVE-2026-59952,2026-07-24T16:14:31Z,"Valibot: record() issue paths can make flatten() throw for inherited Object property names",valibot,0,1.4.2,,MODERATE,CWE-755,
 CVE-2026-6011,2026-04-10T06:31:38Z,"OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts",openclaw,0,2026.1.29,,LOW,CWE-918,
+CVE-2026-61835,2026-07-20T21:47:17Z,"Directus: SSRF Protection Bypass via 0.0.0.0 in File Import",directus,0,12.0.0,,HIGH,CWE-918,
+CVE-2026-61836,2026-07-20T21:48:15Z,"Directus: Authorization-dependent response served from unsegmented cache key",directus,0,12.0.0,,HIGH,CWE-524;CWE-639,
 CVE-2026-6216,2026-04-13T21:30:45Z,"DbGate has cross site scripting via the  SVG Icon String Handler component",dbgate-web,0,7.1.5,,LOW,CWE-79,
 CVE-2026-6270,2026-04-16T22:29:04Z,"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes",@fastify/middie,0,9.3.2,,CRITICAL,CWE-436,
 CVE-2026-6321,2026-05-08T17:15:09Z,"fast-uri vulnerable to path traversal via percent-encoded dot segments",fast-uri,0,3.1.1,,HIGH,CWE-22,
@@ -7077,6 +7271,68 @@ CVE-2026-6322,2026-05-08T19:13:01Z,"fast-uri vulnerable to host confusion via pe
 CVE-2026-6402,2026-05-18T13:31:42Z,"webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins",webpack-dev-server,0,5.2.4,,MODERATE,CWE-749,
 CVE-2026-6410,2026-04-16T22:34:30Z,"@fastify/static vulnerable to path traversal in directory listing",@fastify/static,8.0.0,9.1.1,,MODERATE,CWE-22,
 CVE-2026-6414,2026-04-16T22:34:03Z,"@fastify/static vulnerable to route guard bypass via encoded path separators",@fastify/static,8.0.0,9.1.1,,MODERATE,CWE-177,
+CVE-2026-64641,2026-07-22T22:59:01Z,"Next.js: Denial of Service in App Router using Server Actions",next,13.0.0,15.5.21,,HIGH,CWE-834,
+CVE-2026-64641,2026-07-22T22:59:01Z,"Next.js: Denial of Service in App Router using Server Actions",next,16.0.0,16.2.11,,HIGH,CWE-834,
+CVE-2026-64642,2026-07-22T22:59:38Z,"Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale",next,16.0.0,16.2.11,,HIGH,CWE-285,
+CVE-2026-64643,2026-07-22T23:00:34Z,"Next.js: Unauthenticated disclosure of internal Server Function endpoints",next,13.0.0,15.5.21,,MODERATE,CWE-201,
+CVE-2026-64643,2026-07-22T23:00:34Z,"Next.js: Unauthenticated disclosure of internal Server Function endpoints",next,16.0.0,16.2.11,,MODERATE,CWE-201,
+CVE-2026-64644,2026-07-22T23:02:05Z,"Next.js: Denial of Service in the Image Optimization API using SVGs",next,15.5.0,15.5.21,,MODERATE,CWE-407,
+CVE-2026-64644,2026-07-22T23:02:05Z,"Next.js: Denial of Service in the Image Optimization API using SVGs",next,16.0.0,16.2.11,,MODERATE,CWE-407,
+CVE-2026-64645,2026-07-22T23:02:23Z,"Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname",next,12.0.0,15.5.21,,HIGH,CWE-918,
+CVE-2026-64645,2026-07-22T23:02:23Z,"Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname",next,16.0.0,16.2.11,,HIGH,CWE-918,
+CVE-2026-64646,2026-07-22T23:02:43Z,"Next.js: Unbounded Server Action payload in Edge runtime",next,13.0.0,15.5.21,,MODERATE,CWE-770,
+CVE-2026-64646,2026-07-22T23:02:43Z,"Next.js: Unbounded Server Action payload in Edge runtime",next,16.0.0,16.2.11,,MODERATE,CWE-770,
+CVE-2026-64647,2026-07-22T23:06:12Z,"Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences",next,13.0.0,15.5.21,,MODERATE,CWE-116,
+CVE-2026-64647,2026-07-22T23:06:12Z,"Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences",next,16.0.0,16.2.11,,MODERATE,CWE-116,
+CVE-2026-64648,2026-07-22T23:08:17Z,"Next.js: Cache confusion of response bodies for requests with bodies",next,13.0.0,15.5.21,,MODERATE,CWE-524,
+CVE-2026-64648,2026-07-22T23:08:17Z,"Next.js: Cache confusion of response bodies for requests with bodies",next,16.0.0,16.2.11,,MODERATE,CWE-524,
+CVE-2026-64649,2026-07-22T23:09:48Z,"Next.js: Server-Side Request Forgery in Server Actions on custom servers",next,14.1.1,15.5.21,,HIGH,CWE-918,
+CVE-2026-64649,2026-07-22T23:09:48Z,"Next.js: Server-Side Request Forgery in Server Actions on custom servers",next,16.0.0,16.2.11,,HIGH,CWE-918,
+CVE-2026-65014,2026-07-22T22:36:10Z,"n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook",n8n,0,2.27.4,,MODERATE,CWE-306,
+CVE-2026-65015,2026-07-22T17:55:55Z,"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool",n8n,0,2.29.8,,HIGH,CWE-863,
+CVE-2026-65015,2026-07-22T17:55:55Z,"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool",n8n,2.30.0,2.30.1,,HIGH,CWE-863,
+CVE-2026-65016,2026-07-22T22:04:04Z,"n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",n8n,0,1.123.64,,HIGH,CWE-639,
+CVE-2026-65016,2026-07-22T22:04:04Z,"n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-639,
+CVE-2026-65016,2026-07-22T22:04:04Z,"n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",n8n,2.30.0,2.30.1,,HIGH,CWE-639,
+CVE-2026-65589,2026-07-22T22:54:01Z,"n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data",n8n,0,1.123.64,,MODERATE,CWE-532,
+CVE-2026-65589,2026-07-22T22:54:01Z,"n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data",n8n,2.0.0-rc.0,2.29.8,,MODERATE,CWE-532,
+CVE-2026-65589,2026-07-22T22:54:01Z,"n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data",n8n,2.30.0,2.30.1,,MODERATE,CWE-532,
+CVE-2026-65590,2026-07-22T22:28:24Z,"n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows",n8n,0,2.29.8,,MODERATE,CWE-78,
+CVE-2026-65590,2026-07-22T22:28:24Z,"n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows",n8n,2.30.0,2.30.1,,MODERATE,CWE-78,
+CVE-2026-65591,2026-07-22T22:02:04Z,"n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,0,1.123.64,,HIGH,CWE-917,
+CVE-2026-65591,2026-07-22T22:02:04Z,"n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-917,
+CVE-2026-65591,2026-07-22T22:02:04Z,"n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,2.30.0,2.30.1,,HIGH,CWE-917,
+CVE-2026-65592,2026-07-22T17:59:07Z,"n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`",n8n,0,1.123.64,,HIGH,CWE-79,
+CVE-2026-65592,2026-07-22T17:59:07Z,"n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-79,
+CVE-2026-65592,2026-07-22T17:59:07Z,"n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`",n8n,2.30.0,2.30.1,,HIGH,CWE-79,
+CVE-2026-65593,2026-07-22T22:01:10Z,"n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,0,1.123.64,,MODERATE,CWE-918,
+CVE-2026-65593,2026-07-22T22:01:10Z,"n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,2.0.0-rc.0,2.29.8,,MODERATE,CWE-918,
+CVE-2026-65593,2026-07-22T22:01:10Z,"n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,2.30.0,2.30.1,,MODERATE,CWE-918,
+CVE-2026-65594,2026-07-22T22:31:01Z,"n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check",n8n,0,2.29.8,,MODERATE,CWE-863,
+CVE-2026-65594,2026-07-22T22:31:01Z,"n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check",n8n,2.30.0,2.30.1,,MODERATE,CWE-863,
+CVE-2026-65595,2026-07-22T22:00:07Z,"n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",n8n,0,2.29.8,,HIGH,CWE-269,
+CVE-2026-65595,2026-07-22T22:00:07Z,"n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",n8n,2.30.0,2.30.1,,HIGH,CWE-269,
+CVE-2026-65596,2026-07-22T22:32:23Z,"n8n: GraphQL Node Bypasses ""Allowed HTTP Request Domains"" Restriction",n8n,0,1.123.64,,MODERATE,CWE-863,
+CVE-2026-65596,2026-07-22T22:32:23Z,"n8n: GraphQL Node Bypasses ""Allowed HTTP Request Domains"" Restriction",n8n,2.0.0,2.29.8,,MODERATE,CWE-863,
+CVE-2026-65596,2026-07-22T22:32:23Z,"n8n: GraphQL Node Bypasses ""Allowed HTTP Request Domains"" Restriction",n8n,2.30.0,2.30.1,,MODERATE,CWE-863,
+CVE-2026-65597,2026-07-22T17:57:14Z,"n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview",n8n,0,1.123.64,,HIGH,CWE-79,
+CVE-2026-65597,2026-07-22T17:57:14Z,"n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-79,
+CVE-2026-65597,2026-07-22T17:57:14Z,"n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview",n8n,2.30.0,2.30.1,,HIGH,CWE-79,
+CVE-2026-65598,2026-07-22T17:56:35Z,"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution",n8n,0,1.123.64,,HIGH,CWE-367,
+CVE-2026-65598,2026-07-22T17:56:35Z,"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-367,
+CVE-2026-65598,2026-07-22T17:56:35Z,"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution",n8n,2.30.0,2.30.1,,HIGH,CWE-367,
+CVE-2026-65599,2026-07-22T18:00:09Z,"n8n: Google Service Account Private Key Exposed in JWT Header",n8n,0,1.123.64,,MODERATE,CWE-312,
+CVE-2026-65599,2026-07-22T18:00:09Z,"n8n: Google Service Account Private Key Exposed in JWT Header",n8n,2.0.0-rc.0,2.29.8,,MODERATE,CWE-312,
+CVE-2026-65599,2026-07-22T18:00:09Z,"n8n: Google Service Account Private Key Exposed in JWT Header",n8n,2.30.0,2.30.1,,MODERATE,CWE-312,
+CVE-2026-65898,2026-06-18T14:27:37Z,"DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",dompurify,0,3.4.11,,MODERATE,CWE-471;CWE-665;CWE-79,
+CVE-2026-65899,2026-06-15T20:12:53Z,"DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",dompurify,0,3.4.9,,LOW,CWE-693,
+CVE-2026-65900,2026-06-15T20:02:40Z,"DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",dompurify,3.0.0,3.4.8,,LOW,CWE-79,
+CVE-2026-65901,2026-06-15T20:00:02Z,"DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",dompurify,0,,3.4.6,LOW,CWE-79,
+CVE-2026-65902,2026-06-15T19:59:09Z,"DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",dompurify,0,3.4.7,,MODERATE,CWE-501;CWE-693,
+CVE-2026-65903,2026-04-16T00:46:35Z,"DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",dompurify,0,3.4.0,,MODERATE,CWE-783,
+CVE-2026-65912,2026-04-03T03:46:07Z,"DOMPurify ADD_ATTR predicate skips URI validation",dompurify,0,3.3.2,,MODERATE,CWE-183,
+CVE-2026-65913,2026-04-03T03:45:08Z,"DOMPurify USE_PROFILES prototype pollution allows event handlers",dompurify,0,3.3.2,,MODERATE,CWE-1321,
+CVE-2026-65914,2026-03-27T20:41:29Z,"DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",dompurify,0,3.3.2,,MODERATE,CWE-79,
 CVE-2026-6594,2026-04-20T03:34:41Z,"Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization",@brikcss/merge,0,,1.3.1,MODERATE,CWE-1321;CWE-94,
 CVE-2026-6733,2026-06-19T14:19:13Z,"undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse",undici,0,6.27.0,,LOW,CWE-367,
 CVE-2026-6733,2026-06-19T14:19:13Z,"undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse",undici,7.0.0,7.28.0,,LOW,CWE-367,
@@ -7085,6 +7341,7 @@ CVE-2026-6734,2026-06-19T14:20:20Z,"undici vulnerable to cross-origin request ro
 CVE-2026-6734,2026-06-19T14:20:20Z,"undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse",undici,8.0.0,8.2.0,,HIGH,CWE-346,
 CVE-2026-6874,2026-04-23T00:31:20Z,"copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action",copilot-api,0,,0.7.0,LOW,CWE-350,
 CVE-2026-6951,2026-04-25T06:30:23Z,"simple-git is vulnerable to Remote Code Execution",simple-git,0,3.36.0,,HIGH,CWE-94,
+CVE-2026-7120,2026-07-24T16:43:44Z,"@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths",@fastify/static,0,10.1.2,,MODERATE,CWE-180,
 CVE-2026-7223,2026-04-28T06:30:29Z,"BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue",@dadigua/hyperchat,0,,2.0.0-alpha.63,MODERATE,CWE-918,
 CVE-2026-7446,2026-04-30T00:31:22Z,"mcp-server-semgrep has a Command Injection issue",mcp-server-semgrep,0,1.0.1,,MODERATE,CWE-77,
 CVE-2026-7600,2026-05-02T03:31:13Z,"yii2-mcp-server has a Command Injection Issue",yii2-mcp-server,0,,1.0.2,LOW,CWE-77,
@@ -7102,7 +7359,10 @@ CVE-2026-8769,2026-05-18T00:31:37Z,"@ai-sdk/provider-utils has an Uncontrolled R
 CVE-2026-8813,2026-05-29T17:58:37Z,"ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag",exifreader,2.10.0,4.39.0,,HIGH,CWE-1284,
 CVE-2026-8814,2026-05-29T17:52:26Z,"ExifReader is vulnerable to denial of service via unbounded decompression of image metadata",exifreader,4.20.0,4.39.0,,MODERATE,CWE-409,
 CVE-2026-9277,2026-06-09T14:27:15Z,"shell-quote quote() does not escape newlines in object .op values",shell-quote,1.1.0,1.8.4,,CRITICAL,CWE-77;CWE-78,
+CVE-2026-9495,2026-05-26T13:30:54Z,"@koa/router has an Access Control Bypass",@koa/router,14.0.0,15.0.0,,MODERATE,CWE-284,
+CVE-2026-9520,2026-05-26T13:30:53Z,"Blitz has a Cross-site Scripting issue",blitz,0,,3.0.2,LOW,CWE-79,
 CVE-2026-9595,2026-06-17T18:13:31Z,"webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies",webpack-dev-server,0,5.2.5,,MODERATE,CWE-346;CWE-441,
+CVE-2026-9673,2026-05-28T06:31:09Z,"json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio",json-2-csv,3.15.0,5.5.11,,MODERATE,CWE-1236,
 CVE-2026-9675,2026-06-18T14:28:10Z,"undici WebSocket client vulnerable to denial of service via cumulative fragment bypass",undici,8.0.0,8.5.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-9678,2026-06-18T14:28:13Z,"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",undici,7.0.0,7.28.0,,MODERATE,CWE-524,
 CVE-2026-9678,2026-06-18T14:28:13Z,"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",undici,8.0.0,8.5.0,,MODERATE,CWE-524,
@@ -7132,6 +7392,7 @@ GHSA-268h-hp4c-crq3,2026-06-15T17:36:06Z,"Nodemailer: CRLF injection in Nodemail
 GHSA-26hg-crh6-mjrw,2021-02-23T21:28:28Z,"Directory Traversal",list-n-stream,0,0.0.11,,HIGH,,
 GHSA-26pp-8wgv-hjvm,2026-04-08T00:17:02Z,"Hono missing validation of cookie name on write path in setCookie()",hono,0,4.12.12,,MODERATE,CWE-113,
 GHSA-26wg-9xf2-q495,2026-04-14T23:23:01Z,"Novu has a XSS sanitization bypass",novu/api,0,3.15.0,,HIGH,CWE-79,
+GHSA-275c-xpvc-jgfw,2026-07-02T17:11:03Z,"OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload",openclaw,0,2026.4.22,,MODERATE,CWE-613,
 GHSA-277h-px4m-62q8,2024-10-03T19:46:12Z,"@saltcorn/server arbitrary file zip read and download when downloading auto backups",@saltcorn/server,0,1.0.0-beta.14,,MODERATE,CWE-22,
 GHSA-277p-xwpp-3jf7,2020-09-02T15:49:22Z,"Malicious Package in rrgod",rrgod,0.0.0,,,CRITICAL,CWE-506,
 GHSA-27pq-2ph8-8x25,2026-06-16T21:31:59Z,"Duplicate Advisory: Shell positional parameters could weaken strict inline-eval checks",openclaw,0,,,HIGH,CWE-184,
@@ -7142,6 +7403,7 @@ GHSA-28hp-fgcr-2r4h,2019-06-27T17:25:42Z,"Cross-Site Scripting via JSONP",angula
 GHSA-28qq-5f47-r5x2,2026-01-23T06:31:23Z,"Duplicate Advisory: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)",gemini-mcp-tool,1.1.2,1.1.6,,CRITICAL,CWE-78,
 GHSA-28xh-wpgr-7fm8,2019-06-20T15:35:49Z,"Command Injection in open",open,0,6.0.0,,CRITICAL,CWE-77,
 GHSA-28xx-8j99-m32j,2020-09-01T20:37:25Z,"Malicious Package in nginxbeautifier",nginxbeautifier,1.0.14,1.0.15,,CRITICAL,CWE-506,
+GHSA-2944-57xv-2682,2026-07-02T19:07:44Z,"@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-918,
 GHSA-29fh-xcjr-p7rx,2020-09-03T17:02:22Z,"Malicious Package in web3-eht",web3-eht,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2c83-wfv3-q25f,2021-09-07T23:07:56Z,"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown",rebber,0,5.2.1,,CRITICAL,CWE-78,
 GHSA-2cf5-4w76-r9qv,2020-09-04T14:57:38Z,"Arbitrary Code Execution in handlebars",handlebars,0,3.0.8,,HIGH,CWE-94,
@@ -7161,6 +7423,7 @@ GHSA-2hqf-qqmq-pgpp,2020-09-02T15:48:16Z,"Malicious Package in commander-js",com
 GHSA-2hv5-4h3g-4hjv,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: LINE webhook handler lacks shared pre-auth concurrency budget before signature verification",openclaw,0,2026.3.31,,MODERATE,CWE-799,
 GHSA-2hwp-g4g7-mwwj,2019-05-29T20:25:35Z,"Reflected Cross-Site Scripting in jquery.terminal",jquery.terminal,0,1.21.0,,MODERATE,CWE-79,
 GHSA-2j53-2c28-g9v2,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Nostr inbound DMs could trigger unauthenticated crypto work before sender policy enforcement",openclaw,0,2026.3.22,,MODERATE,CWE-696,
+GHSA-2j8v-hwgc-x698,2026-07-02T15:57:49Z,"OpenClaw: Shell wrapper argv could change between approval and execution",Openclaw,0,2026.5.18,,HIGH,CWE-284,
 GHSA-2jm5-2cqf-6vw9,2020-09-04T15:30:32Z,"Malicious Package in baes-x",baes-x,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2m96-9w4j-wgv7,2020-09-03T18:06:00Z,"Prototype Pollution in lodash.merge",lodash.merge,0,4.6.1,,HIGH,CWE-1321,
 GHSA-2mc2-g238-722j,2026-03-03T21:35:21Z,"OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)",openclaw,0,2026.2.19,,MODERATE,CWE-295;CWE-78,
@@ -7168,23 +7431,37 @@ GHSA-2mj8-pj3j-h362,2020-09-04T17:17:39Z,"Symlink reference outside of node_modu
 GHSA-2mvq-xp48-4c77,2020-09-03T20:35:29Z,"Denial of Service in subtext",subtext,0.0.0,,,HIGH,CWE-400,
 GHSA-2mxc-m4c3-wqhq,2020-09-03T22:50:46Z,"Malicious Package in ruffer-xor",ruffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2p3c-p3qw-69r4,2022-10-12T14:15:48Z,"The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations",apollo-server,2.0.0,2.25.4,,MODERATE,CWE-352,
+GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,1.0.0,2.8.3,,HIGH,CWE-184;CWE-79,
+GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,3.0.0,3.3.4,,HIGH,CWE-184;CWE-79,
+GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,4.0.0,4.0.2,,HIGH,CWE-184;CWE-79,
 GHSA-2p62-c4rm-mr72,2020-09-01T19:44:57Z,"Malicious Package in another-date-picker",another-date-picker,2.0.43,2.0.45,,CRITICAL,CWE-506,
 GHSA-2p99-6f47-8x9j,2020-09-02T18:38:39Z,"Malicious Package in asnc",asnc,0,,,CRITICAL,CWE-506,
 GHSA-2pr6-76vf-7546,2019-06-05T14:35:29Z,"Denial of Service in js-yaml",js-yaml,0,3.13.0,,MODERATE,CWE-400,
+GHSA-2qp2-6frj-p9pq,2026-07-08T15:32:02Z,"Duplicate Advisory: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,0,,,MODERATE,CWE-89,
 GHSA-2qqc-p94c-hxwh,2026-04-16T21:22:00Z,"Flowise: Weak Default Express Session Secret",flowise,0,3.1.0,,MODERATE,CWE-798,
 GHSA-2r2p-4cgf-hv7h,2026-04-22T14:52:03Z,"engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection",engramx,0,2.0.2,,HIGH,"CWE-1188;CWE-306;CWE-352;CWE-942",
 GHSA-2r8f-2665-3gxq,2020-09-02T21:36:36Z,"Malicious Package in froever",froever,0,,,CRITICAL,CWE-506,
 GHSA-2r8f-cf6w-x5vq,2026-02-03T18:30:47Z,"Duplicate Advisory: FUXA contains a hard-coded credential vulnerability",fuxa-server,0,,1.2.7,HIGH,CWE-798,
+GHSA-2rp8-mm9q-fp49,2026-07-21T21:59:23Z," TypeORM: migration:generate template-literal code injection",typeorm,0,0.3.31,,MODERATE,CWE-94,
+GHSA-2rp8-mm9q-fp49,2026-07-21T21:59:23Z," TypeORM: migration:generate template-literal code injection",typeorm,1.0.0,1.1.0,,MODERATE,CWE-94,
 GHSA-2rqg-gjgv-84jm,2026-03-13T20:55:30Z,"OpenClaw: Gateway `agent` calls could override the workspace boundary",openclaw,0,2026.3.11,,HIGH,CWE-668,
+GHSA-2vg6-77g8-24mp,2026-07-07T20:56:45Z,"Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows",@better-auth/scim,1.6.0,1.6.11,,LOW,CWE-459;CWE-613;CWE-672,
+GHSA-2vg6-77g8-24mp,2026-07-07T20:56:45Z,"Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows",better-auth,0.3.4,1.6.11,,LOW,CWE-459;CWE-613;CWE-672,
 GHSA-2vqq-jgxx-fxjc,2020-09-11T21:24:33Z,"Malicious Package in motiv.scss",motiv.scss,0.4.20,0.4.21,,CRITICAL,CWE-506,
+GHSA-2vww-6p9h-5g8j,2026-07-10T15:31:41Z,"Duplicate Advisory: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads",n8n,0,,,MODERATE,CWE-770,
 GHSA-2vx9-7wpg-88jq,2026-05-19T15:55:43Z,"n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions",n8n,0,2.19.3,,MODERATE,CWE-22,
 GHSA-2w22-3f6x-3hf4,2026-06-16T21:32:00Z,"Duplicate Advisory: Workspace-derived service PATH could influence trash command selection",openclaw,0,,,HIGH,CWE-426,
 GHSA-2w8g-m5j8-7m87,2022-01-12T21:45:59Z,"Zalgo-like output that crashes the server",@soketi/soketi,0,0.26.1,,CRITICAL,,
 GHSA-2w8q-69fh-9gq6,2020-09-03T22:25:09Z,"Malicious Package in bufger-xor",bufger-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2w9p-xf5h-qwj3,2023-03-27T03:30:16Z,"Duplicate Advisory: pullit Command Injection vulnerability",pullit,0,,,HIGH,,
+GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,0,1.123.67,,HIGH,CWE-200;CWE-843;CWE-918,
+GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-200;CWE-843;CWE-918,
+GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,2.32.0,2.32.1,,HIGH,CWE-200;CWE-843;CWE-918,
+GHSA-2xgg-r2wc-c5r2,2026-07-24T21:26:19Z,"Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector",@budibase/server,0,,3.38.1,HIGH,CWE-89,
 GHSA-2xp4-qhr4-xqm2,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode",openclaw,0,2026.3.31,,LOW,CWE-352,
 GHSA-2xv3-h762-ccxv,2019-05-29T19:18:02Z,"Out-of-bounds Read in concat-with-sourcemaps",concat-with-sourcemaps,1.0.0,1.0.6,,MODERATE,CWE-125,
 GHSA-2xw5-3767-qxvm,2020-09-11T21:21:20Z,"Malicious Package in ng-ui-library",ng-ui-library,1.0.987,1.0.990,,CRITICAL,CWE-506,
+GHSA-322x-v876-g883,2026-07-02T20:19:20Z,"@asymmetric-effort/nogginlessdom's Path Traversal in matchFileSnapshot allows arbitrary file write","@asymmetric-effort/nogginlessdom",0,0.0.22,,HIGH,CWE-22,
 GHSA-3233-rgx3-c2wh,2018-10-09T00:38:09Z,"Moderate severity vulnerability that affects mustache",mustache,0,2.2.1,,MODERATE,,
 GHSA-32vw-r77c-gm67,2020-08-03T17:57:05Z,"Withdrawn Advisory: marked cross-site scripting vulnerability",marked,0,0.3.3,,MODERATE,,
 GHSA-33gc-f8v9-v8hm,2020-09-01T20:41:40Z,"Malicious Package in ladder-text-js",ladder-text-js,0,,,CRITICAL,CWE-506,
@@ -7204,18 +7481,20 @@ GHSA-36r8-9qq7-mh43,2020-09-03T17:02:40Z,"Malicious Package in we3b",we3b,0.0.0,
 GHSA-36rh-ggpr-j3gj,2020-09-14T16:38:40Z,"Renovate vulnerable to Azure DevOps token leakage in logs",renovate,19.180.0,23.25.1,,MODERATE,,
 GHSA-377f-vvrc-9wgg,2020-09-03T19:09:07Z,"Malicious Package in zemen",zemen,0.0.5,0.0.6,,CRITICAL,CWE-506,
 GHSA-37vc-gwvp-6cgv,2020-09-04T15:42:49Z,"Malicious Package in bitcoijns-lib",bitcoijns-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-382c-vx95-w3p5,2026-07-09T13:44:51Z,"Gittensory: Missing contributor-scoped access control on profile endpoint and MCP tool leaks miner financial data","@jsonbored/gittensory-mcp",0,,0.1.0,MODERATE,CWE-284,
 GHSA-3846-mfvc-xwpf,2026-03-19T03:30:57Z,"Duplicate Advisory: Exec allowlist wrapper analysis did not unwrap env/shell dispatch chains",openclaw,0,,,HIGH,CWE-78,
 GHSA-388g-jwpg-x6j4,2020-09-11T21:20:14Z,"Cross-Site Scripting in swagger-ui",swagger-ui,0,3.0.13,,MODERATE,CWE-79,
 GHSA-38c7-23hj-2wgq,2026-02-26T22:47:06Z,"n8n has Webhook Forgery on Zendesk Trigger Node",n8n,0,1.123.18,,MODERATE,CWE-290,
 GHSA-38c7-23hj-2wgq,2026-02-26T22:47:06Z,"n8n has Webhook Forgery on Zendesk Trigger Node",n8n,2.0.0,2.6.2,,MODERATE,CWE-290,
 GHSA-38cw-85xc-xr9x,2026-01-16T21:04:12Z,"Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM",@veramo/data-store,0,6.0.2,,MODERATE,CWE-89,
+GHSA-38fj-36m5-783c,2026-07-22T12:32:17Z,"Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,0,,,MODERATE,CWE-918,
+GHSA-38hq-7x33-php4,2026-07-24T16:20:59Z,"@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass","@backstage/plugin-auth-backend",0,0.29.2,,MODERATE,CWE-601,
 GHSA-38hx-3542-8fh3,2020-10-01T17:09:56Z,"Malicious code in `electorn`",electorn,0,,10.0.0,CRITICAL,CWE-506,
 GHSA-38vq-cjh5-vw7x,2020-09-03T18:13:41Z,"Malicious Package in nodes.js",nodes.js,0.0.0,,,CRITICAL,CWE-506,
 GHSA-392f-ggf5-fp3c,2026-03-02T21:49:33Z,"OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists",openclaw,0,2026.3.1,,MODERATE,CWE-176;CWE-436,
 GHSA-394x-274p-mqc6,2026-04-24T00:31:52Z,"Duplicate Advisory: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send",openclaw,0,2026.3.28,,HIGH,CWE-269,
 GHSA-39h7-pwv7-rc3x,2026-04-24T20:41:51Z,"Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)","@excalidraw/mermaid-to-excalidraw",0.3.0,1.1.3,,MODERATE,CWE-1395;CWE-79,
 GHSA-39h7-pwv7-rc3x,2026-04-24T20:41:51Z,"Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)",@excalidraw/excalidraw,0.18.0,0.18.1,,MODERATE,CWE-1395;CWE-79,
-GHSA-39q2-94rc-95cp,2026-04-16T00:46:35Z,"DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",dompurify,0,3.4.0,,MODERATE,CWE-783,
 GHSA-3c7f-5hgj-h279,2026-03-27T18:06:49Z,"n8n has XSS in Chat Trigger Node through Custom CSS",n8n,0,1.123.27,,MODERATE,CWE-79,
 GHSA-3c7f-5hgj-h279,2026-03-27T18:06:49Z,"n8n has XSS in Chat Trigger Node through Custom CSS",n8n,2.0.0-rc.0,2.13.3,,MODERATE,CWE-79,
 GHSA-3c7f-5hgj-h279,2026-03-27T18:06:49Z,"n8n has XSS in Chat Trigger Node through Custom CSS",n8n,2.14.0,2.14.1,,MODERATE,CWE-79,
@@ -7236,6 +7515,7 @@ GHSA-3j63-5h8p-gf7c,2025-08-20T20:51:55Z,"x402 SDK vulnerable in outdated versio
 GHSA-3j63-5h8p-gf7c,2025-08-20T20:51:55Z,"x402 SDK vulnerable in outdated versions in resource servers for builders",x402-express,0,0.5.2,,HIGH,,
 GHSA-3j63-5h8p-gf7c,2025-08-20T20:51:55Z,"x402 SDK vulnerable in outdated versions in resource servers for builders",x402-hono,0,0.5.2,,HIGH,,
 GHSA-3j63-5h8p-gf7c,2025-08-20T20:51:55Z,"x402 SDK vulnerable in outdated versions in resource servers for builders",x402-next,0,0.5.2,,HIGH,,
+GHSA-3j7v-fhjg-6rh2,2026-07-15T12:32:03Z,"Duplicate Advisory: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials",n8n,0,,,MODERATE,CWE-639,
 GHSA-3jx4-q2m7-r496,2026-03-04T19:21:04Z,"OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations",openclaw,0,2026.2.25,,HIGH,CWE-59;CWE-668,
 GHSA-3mhm-jvqj-fvhg,2020-09-03T23:09:37Z,"Malicious Package in js-sia3",js-sia3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-3mjm-x6gw-2x42,2026-03-25T17:32:04Z,"@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers",@grackle-ai/server,0,0.70.4,,MODERATE,CWE-693;CWE-79,
@@ -7246,14 +7526,18 @@ GHSA-3p92-886g-qxpq,2019-06-04T15:42:32Z,"Remote Memory Exposure in floody",floo
 GHSA-3pw3-v88x-xj24,2026-04-16T22:45:14Z,"Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath",@paperclipai/shared,0,2026.416.0,,MODERATE,CWE-73,
 GHSA-3qmc-2r76-4rqp,2022-11-10T15:51:01Z,"Redwood is vulnerable to account takeover via dbAuth ""forgot-password"" ",@redwoodjs/api,0.38.0,2.2.5,,HIGH,,
 GHSA-3qmc-2r76-4rqp,2022-11-10T15:51:01Z,"Redwood is vulnerable to account takeover via dbAuth ""forgot-password"" ",@redwoodjs/api,3.0.0,3.3.1,,HIGH,,
+GHSA-3r53-75j5-3g7j,2026-07-24T22:36:45Z,"Quasar: Prototype pollution in the extend() utility",quasar,0,2.22.0,,MODERATE,CWE-1321,
 GHSA-3r56-7hhr-vfg9,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets",openclaw,0,2026.4.5,,MODERATE,CWE-601,
 GHSA-3r78-rqg8-95gg,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse",openclaw,0,,,MODERATE,CWE-294,
 GHSA-3rw8-4xrq-3f7p,2025-03-17T21:30:34Z,"Duplicate Advisory: Uptime Kuma ReDoS vulnerability",uptime-kuma,1.23.0,,2.0.0-dev.0,MODERATE,CWE-1333,
 GHSA-3v3j-737j-7g74,2026-06-16T21:31:59Z,"Duplicate Advisory: Linux and macOS exec allowlists skipped configured argument patterns",openclaw,0,,,HIGH,CWE-693,
 GHSA-3w6x-gv34-mqpf,2026-03-26T21:24:34Z,"OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement",openclaw,0,2026.3.22,,HIGH,CWE-862,
 GHSA-3wqh-h42r-x8fq,2020-09-03T15:46:22Z,"Denial of Service in @hapi/content",@hapi/content,0,5.0.2,,HIGH,,
+GHSA-3wqp-prf6-2m72,2026-07-02T17:08:08Z,"OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement",openclaw,0,2026.5.6,,LOW,CWE-862,
 GHSA-3xc7-xg67-pw99,2019-06-05T20:43:10Z,"Sensitive Data Exposure in sequelize-cli",sequelize-cli,0,,5.4.0,LOW,CWE-532,
 GHSA-3xx2-mqjm-hg9x,2026-04-16T22:49:46Z,"Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise",@paperclipai/server,0,2026.416.0,,CRITICAL,CWE-639,
+GHSA-42h9-826w-cgv3,2026-07-20T17:58:59Z,"Axios: Excessive recursion in formDataToJSON can cause denial of service",axios,0.28.0,0.33.0,,MODERATE,CWE-400;CWE-674,
+GHSA-42h9-826w-cgv3,2026-07-20T17:58:59Z,"Axios: Excessive recursion in formDataToJSON can cause denial of service",axios,1.0.0,1.18.0,,MODERATE,CWE-400;CWE-674,
 GHSA-435c-qcpm-wjw5,2020-09-03T17:05:43Z,"Malicious Package in fs-extar",fs-extar,0.0.0,,,CRITICAL,CWE-506,
 GHSA-4363-x42f-xph6,2020-09-03T17:05:14Z,"Malicious Package in hw-trnasport-u2f",hw-trnasport-u2f,0.0.0,,,CRITICAL,CWE-506,
 GHSA-43vf-2x6g-p2m5,2020-09-02T21:33:26Z,"Malicious Package in browserift",browserift,0,,,CRITICAL,CWE-506,
@@ -7262,6 +7546,8 @@ GHSA-44c9-4rg5-qjgq,2026-03-19T03:30:57Z,"Duplicate Advisory: web_search citatio
 GHSA-44vf-8ffm-v2qh,2020-09-02T15:42:47Z,"Sensitive Data Exposure in rails-session-decoder",rails-session-decoder,0.0.0,,,HIGH,,
 GHSA-457r-cqc8-9vj9,2022-11-23T15:39:50Z,"sweetalert2 v10.16.10 and above contains hidden functionality",sweetalert2,10.16.10,11.22.4,,LOW,CWE-912,
 GHSA-4627-w373-375v,2020-09-11T21:22:24Z,"Malicious Package in grunt-radical",grunt-radical,0.0.14,0.0.13,,CRITICAL,,
+GHSA-464c-974j-9xm6,2026-07-24T16:44:20Z,"AWS CDK CodeBuild S3 Log Encryption Boolean Inversion",@aws-cdk/aws-codebuild,1.75.0,,1.204.0,LOW,CWE-311;CWE-682,
+GHSA-464c-974j-9xm6,2026-07-24T16:44:20Z,"AWS CDK CodeBuild S3 Log Encryption Boolean Inversion",aws-cdk-lib,0,2.253.0,,LOW,CWE-311;CWE-682,
 GHSA-46fh-8fc5-xcwx,2020-09-03T18:09:16Z,"Prototype Pollution in lodash.defaultsdeep",lodash.defaultsdeep,0,4.6.1,,HIGH,CWE-1321,
 GHSA-46j5-6fg5-4gv3,2025-12-18T09:30:30Z,"Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion",nodemailer,0,7.0.11,,MODERATE,CWE-674;CWE-703,
 GHSA-474h-prjg-mmw3,2026-03-03T21:31:57Z,"OpenClaw: Sandboxed sessions_spawn(runtime=""acp"") bypassed sandbox inheritance and allowed host ACP initialization",openclaw,0,2026.3.2,,HIGH,CWE-269,
@@ -7281,6 +7567,7 @@ GHSA-4f9m-pxwh-68hg,2020-09-11T21:20:14Z,"Cross-Site Scripting in swagger-ui",sw
 GHSA-4fqg-89cc-5pv5,2020-09-04T14:58:44Z,"Malicious Package in sj-labc",sj-labc,0.0.0,,,CRITICAL,CWE-506,
 GHSA-4fr9-3x69-36wv,2025-10-03T19:27:06Z,"Flowise vulnerable to XSS",flowise,0,3.0.8,,MODERATE,CWE-79,
 GHSA-4g2x-vq5p-5vj6,2024-03-01T20:09:00Z,"Budibase affected by VM2 Constructor Escape Vulnerability",@budibase/server,0,2.20.0,,CRITICAL,CWE-94,
+GHSA-4g3v-8h47-v7g6,2026-07-20T21:08:16Z,"Astro: Reflected XSS via unescaped View Transition animation properties",astro,2.9.0,7.1.0,,MODERATE,CWE-79,
 GHSA-4g53-vp7q-gfjv,2021-05-28T19:18:28Z,"constructEvent does not verify header","@worker-tools/stripe-webhook",0,1.1.4,,HIGH,,
 GHSA-4gpv-cvmq-6526,2020-08-19T22:23:09Z,"Denial of Service in protobufjs",protobufjs,0,5.0.3,,MODERATE,,
 GHSA-4gpv-cvmq-6526,2020-08-19T22:23:09Z,"Denial of Service in protobufjs",protobufjs,6.0.0,6.8.6,,MODERATE,,
@@ -7297,16 +7584,18 @@ GHSA-4jqc-jvh2-pxg9,2022-06-17T01:11:10Z,"Path traversal for local publishers in
 GHSA-4jqc-jvh2-pxg9,2022-06-17T01:11:10Z,"Path traversal for local publishers in TechDocs backend","@backstage/techdocs-common",0,0.11.16,,MODERATE,,
 GHSA-4m3j-h8f2-4xh4,2020-09-03T19:41:31Z,"Malicious Package in coinstrig",coinstrig,0.0.0,,,CRITICAL,CWE-506,
 GHSA-4m3p-x2hp-2pgx,2020-09-04T16:45:23Z,"Malicious Package in bitcroe-lib",bitcroe-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-4m3v-q747-pc6h,2026-07-02T17:13:01Z,"OpenClaw: Mattermost slash token revocation could lag until monitor refresh",openclaw,0,2026.4.24,,MODERATE,CWE-613,
 GHSA-4mhr-cxr4-2prm,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests",openclaw,2026.4.5,2026.4.20,,MODERATE,CWE-441,
 GHSA-4pmg-jgm5-3jg6,2020-09-02T21:16:26Z,"Malicious Package in erquest",erquest,0,,,CRITICAL,CWE-506,
 GHSA-4q2f-8g74-qm56,2020-09-03T17:18:05Z,"Cross-Site Scripting in takeapeek",takeapeek,0.0.0,,,HIGH,CWE-79,
 GHSA-4q8f-5xxj-946r,2020-09-03T02:40:51Z,"Command Injection in addax",addax,0,1.1.0,,HIGH,CWE-77,
+GHSA-4qcj-m5wp-jmf4,2026-07-24T21:13:07Z," Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings",@budibase/server,0,,3.38.1,MODERATE,CWE-862,
 GHSA-4qgr-57jq-93vh,2026-06-16T21:31:59Z,"Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots",openclaw,0,,,HIGH,CWE-426,
 GHSA-4qhx-g9wp-g9m6,2019-06-14T16:09:01Z,"Failure to sanitize quotes which can lead to sql injection in squel",squel,0,,5.13.0,CRITICAL,CWE-74;CWE-89,
-GHSA-4qq2-2j2x-x62c,2026-06-18T14:25:17Z,"npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation",praisonai,1.5.1,1.7.2,,HIGH,CWE-287;CWE-288;CWE-863,
 GHSA-4qqc-mp5f-ccv4,2020-09-02T15:05:51Z,"Command Injection in bestzip",bestzip,0,2.1.7,,CRITICAL,CWE-77,
 GHSA-4r97-78gf-q24v,2020-09-04T17:53:27Z,"Duplicate Advisory: Prototype Pollution in klona",klona,0,1.1.1,,HIGH,CWE-1321,
 GHSA-4rgj-8mq3-hggj,2020-09-03T20:32:11Z,"Denial of Service in @hapi/subtext",@hapi/subtext,0,6.1.2,,HIGH,CWE-400,
+GHSA-4v35-78jc-648r,2026-07-22T12:32:17Z,"Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows",@n8n/computer-use,0,,,MODERATE,CWE-78,
 GHSA-4vcf-q4xf-f48m,2025-11-25T21:42:53Z,"Better Auth Passkey Plugin allows passkey deletion through IDOR",@better-auth/passkey,0,1.4.0,,HIGH,CWE-284;CWE-639,
 GHSA-4vjr-crvh-383h,2023-09-27T20:17:00Z,"@napi-rs/image affected by libwebp CVE",@napi-rs/image,0,1.7.0,,HIGH,,
 GHSA-4vmm-mhcq-4x9j,2019-06-14T16:15:14Z,"Sandbox Bypass Leading to Arbitrary Code Execution in constantinople",constantinople,0,3.1.1,,CRITICAL,,
@@ -7335,6 +7624,7 @@ GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket i
 GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
 GHSA-534w-2vm4-89xr,2026-03-03T23:18:26Z,"OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch",openclaw,0,2026.2.24,,MODERATE,CWE-284;CWE-863,
 GHSA-536f-268f-6gxc,2020-09-03T22:17:36Z,"Malicious Package in buffermxor",buffermxor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-53g2-mvcc-q9x3,2026-07-24T16:18:01Z,"Trix: Stored XSS via HTMLParser attribute injection on paste",trix,0,2.1.18,,MODERATE,CWE-79,
 GHSA-53mj-mc38-q894,2020-09-01T19:40:41Z,"Remote Memory Exposure in openwhisk",openwhisk,0,3.3.1,,MODERATE,,
 GHSA-53p3-c7vp-4mcc,2026-03-29T15:22:17Z,"Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)",trix,0,2.1.18,,LOW,CWE-79,
 GHSA-53rv-hcvm-rpp9,2025-01-14T22:03:59Z,"Lodestar snappy decompression issue",@lodestar/reqresp,0,1.25.0,,LOW,CWE-703,
@@ -7371,6 +7661,7 @@ GHSA-59xv-588h-2vmm,2026-04-10T19:30:32Z,"@saltcorn/data vulnerable to SQL Injec
 GHSA-59xv-588h-2vmm,2026-04-10T19:30:32Z,"@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler",@saltcorn/data,1.5.0,1.5.5,,LOW,CWE-89,
 GHSA-59xv-588h-2vmm,2026-04-10T19:30:32Z,"@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler",@saltcorn/data,1.6.0-alpha.0,1.6.0-beta.4,,LOW,CWE-89,
 GHSA-5c6j-r48x-rmvq,2026-02-28T02:50:45Z,"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",serialize-javascript,0,7.0.3,,HIGH,CWE-96,
+GHSA-5c7w-4wm3-85vw,2026-07-02T19:00:12Z,"@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-943,
 GHSA-5ccf-884p-4jjq,2025-03-20T12:32:51Z,"Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability",open-webui,0,,0.3.21,HIGH,CWE-400,
 GHSA-5cp4-xmrw-59wf,2020-08-05T21:47:02Z,"XSS via JQLite DOM manipulation functions in AngularJS",angular,0,1.8.0,,MODERATE,CWE-79,
 GHSA-5cph-wvm9-45gj,2024-11-21T22:21:03Z,"Flowise OverrideConfig security vulnerability",flowise,0,2.1.4,,HIGH,CWE-15,
@@ -7402,7 +7693,6 @@ GHSA-5jgm-f9wr-9qm7,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw: Workspac
 GHSA-5jgp-pg4f-q8vj,2020-09-03T19:55:42Z,"Malicious Package in node-ftp",node-ftp,0.0.0,,,CRITICAL,CWE-506,
 GHSA-5jpx-9hw9-2fx4,2025-10-29T10:43:57Z,"NextAuthjs Email misdelivery Vulnerability",next-auth,0,4.24.12,,MODERATE,CWE-200,
 GHSA-5jpx-9hw9-2fx4,2025-10-29T10:43:57Z,"NextAuthjs Email misdelivery Vulnerability",next-auth,5.0.0-beta.0,5.0.0-beta.30,,MODERATE,CWE-200,
-GHSA-5jv7-2mjm-h6qj,2026-06-18T14:26:54Z,"npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining",praisonai,1.5.1,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
 GHSA-5mh4-3rv3-fpcf,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables",openclaw,0,2026.3.31,,HIGH,CWE-668,
 GHSA-5mm9-55c9-p5r7,2020-09-03T19:53:31Z,"Malicious Package in mogoose",mogoose,0.0.0,,,CRITICAL,CWE-506,
 GHSA-5mrr-rgp6-x4gr,2020-09-03T19:39:05Z,"Command Injection in marsdb",marsdb,0.0.0,,,CRITICAL,CWE-77,
@@ -7413,9 +7703,10 @@ GHSA-5r8f-96gm-5j6g,2026-04-01T00:00:34Z,"OpenClaw Gateway `operator.write` can
 GHSA-5rp4-cwgh-gvwq,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes",openclaw,0,2026.3.12,,MODERATE,CWE-78,
 GHSA-5rqg-jm4f-cqx7,2022-01-10T17:29:53Z,"Infinite loop causing Denial of Service in colors",colors,1.4.1,,1.4.2,HIGH,CWE-835,
 GHSA-5rrq-pxf6-6jx5,2022-01-08T00:22:42Z,"Prototype Pollution in node-forge debug API.",node-forge,0,1.0.0,,LOW,CWE-1321,
-GHSA-5v72-xg48-5rpm,2019-06-04T19:37:52Z,"Denial of Service in ws",ws,0.2.6,1.1.5,,HIGH,CWE-400,
+GHSA-5v72-xg48-5rpm,2019-06-04T19:37:52Z,"Denial of Service in ws",ws,0.6.0,1.1.5,,HIGH,CWE-400,
 GHSA-5v72-xg48-5rpm,2019-06-04T19:37:52Z,"Denial of Service in ws",ws,2.0.0,3.3.1,,HIGH,CWE-400,
 GHSA-5v7r-jg9r-vq44,2020-09-03T21:19:46Z,"Insecure Cryptography Algorithm in simple-crypto-js",simple-crypto-js,0,2.3.0,,MODERATE,CWE-327,
+GHSA-5vfw-jc4p-fj39,2026-07-22T12:32:17Z,"Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check",n8n,0,,,MODERATE,CWE-863,
 GHSA-5vj8-3v2h-h38v,2020-09-04T18:04:08Z,"Remote Code Execution in next",next,0.9.9,5.1.0,,HIGH,CWE-20,
 GHSA-5vjq-5jmg-39xq,2026-04-16T01:34:39Z,"Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance",renovate,43.65.0,43.102.11,,MODERATE,CWE-94,
 GHSA-5vm8-hhgr-jcjp,2021-05-28T19:18:53Z,"Cross-site scripting vulnerability in TinyMCE",tinymce,0,5.7.1,,MODERATE,CWE-79,
@@ -7427,6 +7718,7 @@ GHSA-5wrg-8fxp-cx9r,2023-06-21T22:06:22Z,"passport-wsfed-saml2 Signature Bypass
 GHSA-5x7p-gm79-383m,2020-09-01T21:11:57Z,"Malicious Package in regenraotr",regenraotr,0,,,CRITICAL,CWE-506,
 GHSA-5x8q-gj67-rhf2,2020-09-02T21:18:33Z,"Malicious Package in discord_debug_log",discord_debug_log,0,,,CRITICAL,CWE-506,
 GHSA-629c-j867-3v45,2020-09-04T16:41:04Z,"Malicious Package in bitcoisnj-lib",bitcoisnj-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-62gx-5q78-wrvx,2026-07-15T21:56:45Z,"obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete",obsidian-local-rest-api,0,,,HIGH,CWE-22,
 GHSA-6343-m2qr-66gf,2020-09-03T23:10:41Z,"Malicious Package in js-sja3",js-sja3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6394-6h9h-cfjg,2019-06-07T21:12:35Z,"Regular Expression Denial of Service",nwmatcher,0,1.4.4,,MODERATE,CWE-400,
 GHSA-63f5-hhc7-cx6p,2026-03-16T20:40:23Z,"OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approval",openclaw,0,2026.3.13,,HIGH,CWE-269,
@@ -7435,6 +7727,11 @@ GHSA-6475-r3vj-m8vf,2026-01-08T21:52:45Z,"AWS SDK for JavaScript v3 adopted defe
 GHSA-6477-wvjj-47v6,2026-04-24T00:31:52Z,"Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders",openclaw,0,2026.4.2,,MODERATE,CWE-706,
 GHSA-647h-p824-99w7,2026-03-25T17:23:11Z,"@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool",@grackle-ai/mcp,0,0.70.2,,HIGH,CWE-284,
 GHSA-64g7-mvw6-v9qj,2022-01-14T21:09:50Z,"Improper Privilege Management in shelljs",shelljs,0,0.8.5,,MODERATE,CWE-269,
+GHSA-64xh-79j6-r5v8,2026-07-22T22:06:06Z,"n8n: Bypass ""Allowed HTTP Request Domains"" Credential Restriction in Multiple AI and LLM Nodes",n8n,0,2.31.5,,HIGH,CWE-863,
+GHSA-64xh-79j6-r5v8,2026-07-22T22:06:06Z,"n8n: Bypass ""Allowed HTTP Request Domains"" Credential Restriction in Multiple AI and LLM Nodes",n8n,2.32.0,2.32.1,,HIGH,CWE-863,
+GHSA-652q-gvq3-74qv,2026-07-22T23:20:24Z,"n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,0,1.123.67,,MODERATE,CWE-89,
+GHSA-652q-gvq3-74qv,2026-07-22T23:20:24Z,"n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-89,
+GHSA-652q-gvq3-74qv,2026-07-22T23:20:24Z,"n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,2.32.0,2.32.1,,MODERATE,CWE-89,
 GHSA-657v-jjf8-83gh,2020-09-03T23:14:55Z,"Malicious Package in jsmsha3",jsmsha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6584-gfwm-3vc3,2020-09-03T21:43:01Z,"Malicious Package in budfer-xor",budfer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-659f-22xc-98f2,2026-03-03T23:00:53Z,"OpenClaw hook transform path containment missed symlink-resolved escapes",openclaw,0,2026.2.22,,HIGH,CWE-94,
@@ -7447,6 +7744,10 @@ GHSA-65xx-c85x-wg76,2020-09-04T17:20:52Z,"Command Injection in plotter",plotter,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,0,1.123.55,,MODERATE,CWE-863,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.0.0-rc.0,2.25.7,,MODERATE,CWE-863,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.26.0,2.26.2,,MODERATE,CWE-863,
+GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,0,6.13.10,,MODERATE,CWE-1321,
+GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,7.0.0,7.8.10,,MODERATE,CWE-1321,
+GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,8.0.0,8.24.1,,MODERATE,CWE-1321,
+GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,9.0.0,9.7.2,,MODERATE,CWE-1321,
 GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,0,16.8.2,,HIGH,,
 GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,17.0.0,17.9.2,,HIGH,,
 GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,18.0.0,18.4.1,,HIGH,,
@@ -7465,6 +7766,7 @@ GHSA-69mf-2cw2-38m8,2020-09-03T23:04:40Z,"Malicious Package in js-shc3",js-shc3,
 GHSA-69p9-9qm9-h447,2020-08-19T22:34:43Z,"Sandbox Breakout / Arbitrary Code Execution in safer-eval",safer-eval,0,1.3.2,,MODERATE,,
 GHSA-69r6-7h4f-9p7q,2020-09-03T20:41:01Z,"Malicious Package in discord.js-user",discord.js-user,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6c37-2rw5-9j7x,2020-09-02T20:25:46Z,"Malicious Package in requesst",requesst,0,,,CRITICAL,CWE-506,
+GHSA-6c4r-g249-wv3c,2026-07-02T17:06:10Z,"OpenClaw: Sandboxed session spawn could expose the real workspace path to child prompts",openclaw,0,2026.4.26,,MODERATE,CWE-668,
 GHSA-6chw-6frg-f759,2020-04-03T21:48:38Z,"Regular Expression Denial of Service in Acorn",acorn,5.5.0,5.7.4,,HIGH,CWE-400,
 GHSA-6chw-6frg-f759,2020-04-03T21:48:38Z,"Regular Expression Denial of Service in Acorn",acorn,6.0.0,6.4.1,,HIGH,CWE-400,
 GHSA-6chw-6frg-f759,2020-04-03T21:48:38Z,"Regular Expression Denial of Service in Acorn",acorn,7.0.0,7.1.1,,HIGH,CWE-400,
@@ -7483,11 +7785,16 @@ GHSA-6mrq-7r7m-hh4p,2020-09-03T22:52:58Z,"Malicious Package in hs-sha3",hs-sha3,
 GHSA-6q22-g298-grjh,2026-04-04T06:13:25Z,"Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver",directus,0,11.17.0,,HIGH,CWE-400;CWE-770,
 GHSA-6q2v-vfwp-pvwh,2026-03-29T15:30:20Z,"Duplicate Advisory: OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path",openclaw,0,2026.3.8,,MODERATE,CWE-367,
 GHSA-6qc7-jgq7-34rf,2020-09-02T20:18:18Z,"Malicious Package in exprss",exprss,0,,,CRITICAL,CWE-506,
+GHSA-6qc9-mqvw-jg7x,2026-07-22T22:10:41Z,"n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`",n8n,0,1.123.67,,HIGH,CWE-863,
+GHSA-6qc9-mqvw-jg7x,2026-07-22T22:10:41Z,"n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-863,
+GHSA-6qc9-mqvw-jg7x,2026-07-22T22:10:41Z,"n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`",n8n,2.32.0,2.32.1,,HIGH,CWE-863,
 GHSA-6qgx-f452-7699,2020-09-03T23:28:39Z,"Malicious Package in superhappyfuntime",superhappyfuntime,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6qqf-vvcr-7qrv,2019-05-23T09:27:22Z,"Cryptographically Weak PRNG in generate-password",generate-password,0,1.4.1,,MODERATE,CWE-338,
 GHSA-6qqj-rx4w-r3cj,2020-08-31T22:48:44Z,"CSRF Vulnerability in jquery-ujs",jquery-ujs,0,1.0.4,,MODERATE,CWE-352,
 GHSA-6r5x-hmgg-7h53,2019-07-15T19:46:01Z,"Remote code execution in Handlebars.js",handlebars,0,4.1.0,,MODERATE,,
 GHSA-6rmx-gvvg-vh6j,2026-03-09T19:52:47Z,"OpenClaw's hooks count non-POST requests toward auth lockout",openclaw,0,2026.3.7,,MODERATE,CWE-307;CWE-799,
+GHSA-6v4m-fw66-8r4x,2026-07-24T22:33:38Z,"Shescape: Path disclosure on Unix with Zsh",shescape,0,2.1.14,,MODERATE,CWE-155;CWE-78,
+GHSA-6v4m-fw66-8r4x,2026-07-24T22:33:38Z,"Shescape: Path disclosure on Unix with Zsh",shescape,3.0.0,3.0.1,,MODERATE,CWE-155;CWE-78,
 GHSA-6v7q-wjvx-w8wg,2026-04-10T20:18:23Z,"basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",basic-ftp,0,5.2.2,,HIGH,CWE-93,
 GHSA-6x2m-hqfw-hvpj,2026-03-02T22:29:45Z,"OpenClaw: Node exec approvals could be replayed across nodes",openclaw,0,2026.2.23,,MODERATE,CWE-285;CWE-863,
 GHSA-6x2m-p4xp-wg22,2026-06-19T21:42:36Z,"Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups",network-ai,0,5.12.2,,MODERATE,CWE-22;CWE-59,
@@ -7498,6 +7805,7 @@ GHSA-6xm4-p6r2-mwrc,2020-09-03T22:47:30Z,"Malicious Package in cuffer-xor",cuffe
 GHSA-724c-6vrf-99rq,2020-09-02T21:49:48Z,"Sensitive Data Exposure in loopback",loopback,0,2.42.0,,LOW,CWE-200,
 GHSA-724c-6vrf-99rq,2020-09-02T21:49:48Z,"Sensitive Data Exposure in loopback",loopback,3.0.0,3.26.0,,LOW,CWE-200,
 GHSA-725f-3pw7-rq6x,2020-09-03T21:09:47Z,"Malicious Package in 8.9.4",8.9.4,0.0.0,,,CRITICAL,CWE-506,
+GHSA-725q-c4vp-q4cg,2026-07-22T12:32:18Z,"Duplicate Advisory: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution",n8n,0,,,HIGH,CWE-367,
 GHSA-72gr-qfp7-vwhw,2026-03-20T20:50:09Z,"h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`",h3,0,1.15.9,,MODERATE,CWE-22,
 GHSA-72q8-jcmc-97wx,2026-04-25T23:46:31Z,"OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy",openclaw,0,2026.4.20,,MODERATE,CWE-863,
 GHSA-72r4-9c5j-mj57,2026-06-27T00:12:39Z,"pnpm: `patch-remove` could delete project-selected files outside the patches directory",pnpm,0,10.34.4,,HIGH,CWE-22;CWE-73,
@@ -7517,11 +7825,12 @@ GHSA-75hx-xj24-mqrw,2026-04-10T20:59:58Z,"n8n-mcp has unauthenticated session te
 GHSA-762c-v946-pf25,2020-09-04T16:47:33Z,"Malicious Package in bpi39",bpi39,0.0.0,,,CRITICAL,CWE-506,
 GHSA-766v-7gjx-55hf,2020-09-03T23:08:34Z,"Malicious Package in js-shq3",js-shq3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-7696-qr5q-pg37,2020-09-03T23:19:08Z,"Malicious Package in zs-sha3",zs-sha3,0.0.0,,,CRITICAL,CWE-506,
-GHSA-76mc-f452-cxcm,2026-06-15T19:59:09Z,"DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",dompurify,0,3.4.7,,MODERATE,CWE-501;CWE-693,
 GHSA-76qf-6mvw-c5hm,2020-09-03T19:45:42Z,"Malicious Package in js-base64-int",js-base64-int,0.0.0,,,CRITICAL,CWE-506,
 GHSA-76xq-58hj-vwm2,2020-09-11T21:16:59Z,"Malicious Package in test-module-a",test-module-a,0,,,CRITICAL,CWE-506,
 GHSA-779f-wgxg-qr8f,2020-09-03T18:10:22Z,"Prototype Pollution in lodash.mergewith",lodash.mergewith,0,4.6.2,,HIGH,CWE-1321,
 GHSA-77hf-7fqf-f227,2026-03-03T21:32:35Z,"OpenClaw skills-install-download: tar.bz2 extraction bypassed archive safety parity checks (local DoS)",openclaw,0,2026.3.2,,MODERATE,CWE-400;CWE-409,
+GHSA-77pv-3w4q-vrj5,2026-07-02T16:56:24Z,"OpenClaw: QQBot pre-dispatch slash commands could skip allowFrom checks",openclaw,0,2026.4.27,,MODERATE,CWE-863,
+GHSA-77q5-rr5v-x43q,2026-07-02T17:22:11Z,"OpenClaw: Trusted retry endpoint checks could match hostname prefixes",openclaw,0,2026.5.7,,HIGH,CWE-1023;CWE-20;CWE-345,
 GHSA-785g-gx74-gr39,2020-09-03T23:12:48Z,"Malicious Package in js-wha3",js-wha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-788m-pj96-7w2c,2020-09-02T21:23:51Z,"Cross-Site Scripting in fomantic-ui",fomantic-ui,0,2.7.0,,HIGH,CWE-79,
 GHSA-78p3-fwcq-62c2,2024-10-03T19:50:59Z,"@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution  by manipulating `lang` and  `defstring` parameters when setting localizer strings",@saltcorn/server,0,1.0.0-beta.14,,HIGH,CWE-1321,
@@ -7541,6 +7850,7 @@ GHSA-7fhm-mqm4-2wp7,2020-03-13T20:36:16Z,"Withdrawn: ESLint dependencies are vul
 GHSA-7fpw-cfc4-3p2c,2017-12-28T22:51:45Z,"Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2",passport-wsfed-saml2,0,3.0.5,,HIGH,CWE-290,
 GHSA-7fqq-q52p-2jjg,2026-03-29T15:27:41Z,"OpenCC  has an Out-of-bounds read when processing truncated UTF-8 input",opencc,0,1.2.0,,MODERATE,CWE-125,
 GHSA-7frr-c83r-fm22,2020-09-03T22:20:49Z,"Malicious Package in buffez-xor",buffez-xor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-7gfh-x38p-prh3,2026-07-24T16:21:22Z,"Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)",velocityjs,0,2.1.7,,CRITICAL,CWE-94,
 GHSA-7h7g-x2px-94hj,2026-03-13T20:54:18Z,"OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens",openclaw,0,2026.3.12,,MODERATE,CWE-532,
 GHSA-7hgr-7h44-33w2,2026-05-19T20:13:35Z,"CamoFox MCP: Unauthenticated HTTP MCP browser-control surface",camofox-mcp,0,1.13.2,,HIGH,CWE-306,
 GHSA-7hrg-5w46-5r2x,2026-04-24T00:31:52Z,"Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders",openclaw,0,2026.4.2,,LOW,CWE-346,
@@ -7552,12 +7862,17 @@ GHSA-7jm2-g593-4qrc,2026-04-25T23:51:11Z,"OpenClaw: Agent gateway config mutatio
 GHSA-7m7q-q53v-j47v,2021-02-25T02:01:47Z,"Regular Expression Denial of Service",marked,0.5.0,0.6.1,,MODERATE,,
 GHSA-7p6w-x2gr-rrf8,2020-09-02T21:28:05Z,"ag-grid Cross-Site Scripting vulnerability",ag-grid,0,14.0.0,,HIGH,CWE-79,
 GHSA-7q64-3rg2-h9pf,2026-02-27T18:31:06Z,"Duplicate Advisory: Nest has a Fastify URL Encoding Middleware Bypass",@nestjs/platform-fastify,0,11.1.14,,HIGH,CWE-863,
+GHSA-7q8q-rj6j-mhjq,2026-07-20T22:37:31Z,"Axios: Nested axios option objects can consume polluted prototype values",axios,0.8.0,0.33.0,,MODERATE,CWE-1321,
+GHSA-7q8q-rj6j-mhjq,2026-07-20T22:37:31Z,"Axios: Nested axios option objects can consume polluted prototype values",axios,1.0.0,1.18.0,,MODERATE,CWE-1321,
 GHSA-7q9x-8g6p-3x75,2026-03-25T17:15:40Z,"@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template",@grackle-ai/server,0,0.70.1,,LOW,CWE-79,
 GHSA-7qf6-h84j-8fq4,2026-03-03T22:21:59Z,"OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model",openclaw,0,2026.2.26,,LOW,CWE-367;CWE-918,
 GHSA-7qg7-6g3g-8vxg,2020-09-03T22:46:25Z,"Malicious Package in bwffer-xor",bwffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-7r5f-7qr4-pf6q,2020-09-03T19:03:33Z,"Sandbox Breakout / Arbitrary Code Execution in notevil",notevil,0,1.3.2,,HIGH,,
 GHSA-7r9x-hr76-jr96,2020-09-04T17:26:18Z,"Command Injection in giting",giting,0.0.0,,,CRITICAL,CWE-77,
 GHSA-7rgr-72hp-9wp3,2025-10-06T03:31:38Z,"Duplicate Advisory: Flowise is vulnerable to stored XSS via ""View Messages"" allows credential theft in FlowiseAI admin panel",flowise,0,3.0.5,,HIGH,CWE-79,
+GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",@auth/core,0.1.0,0.41.3,,CRITICAL,CWE-180,
+GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",next-auth,4.10.3,4.24.15,,CRITICAL,CWE-180,
+GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",next-auth,5.0.0-beta.1,5.0.0-beta.32,,CRITICAL,CWE-180,
 GHSA-7rx3-28cr-v5wh,2026-03-29T15:17:15Z,"Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry",handlebars,4.6.0,4.7.9,,MODERATE,CWE-1321,
 GHSA-7rx4-c5vx-g8w3,2026-05-14T18:26:02Z,"Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections",@karakeep/sdk,0,0.32.0,,HIGH,CWE-918,
 GHSA-7v28-g2pq-ggg8,2022-06-17T01:16:03Z,"Ghost vulnerable to remote code execution in locale setting change",ghost,0,4.48.2,,MODERATE,,
@@ -7581,8 +7896,11 @@ GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",
 GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",derby,3.0.0,3.0.2,,LOW,CWE-1321,
 GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",derby,4.0.0-beta1,4.0.0-beta.11,,LOW,CWE-1321,
 GHSA-82rm-qcfx-2v78,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay",openclaw,2026.4.10,2026.4.14,,MODERATE,CWE-862,
+GHSA-8342-988q-86cr,2026-07-22T22:04:54Z,"n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login",n8n,0,2.31.5,,HIGH,CWE-345;CWE-863,
+GHSA-8342-988q-86cr,2026-07-22T22:04:54Z,"n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login",n8n,2.32.0,2.32.1,,HIGH,CWE-345;CWE-863,
 GHSA-83pq-466j-fc6j,2020-09-04T15:17:50Z,"Prototype Pollution in sahmat",sahmat,0.0.0,,,HIGH,CWE-1321,
 GHSA-83rx-c8cr-6j8q,2019-06-05T20:48:55Z,"Insecure Default Configuration in tesseract.js",tesseract.js,0,1.0.19,,MODERATE,CWE-829,
+GHSA-83w9-h5wv-j9xm,2026-07-02T16:23:41Z,"OpenClaw: Node pairing reconnection could confuse approval scope state",openclaw,0,2026.5.27,,HIGH,CWE-367,
 GHSA-846p-hgpv-vphc,2026-04-07T18:15:00Z,"OpenClaw: QQ Bot structured payloads could read arbitrary local files",openclaw,0,2026.4.2,,MODERATE,CWE-22,
 GHSA-84c3-j8r2-mcm8,2024-02-26T20:10:10Z,"@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys",@nfid/embed,0.10.0,0.10.1-alpha.6,,CRITICAL,CWE-321;CWE-330,
 GHSA-84jw-g43v-8gjm,2024-09-19T17:30:05Z,"DOM Clobbering Gadget found in Rspack's AutoPublicPathRuntimeModule that leads to XSS",@rspack/core,0,1.0.0-rc.1,,MODERATE,CWE-79,
@@ -7591,7 +7909,10 @@ GHSA-8549-p68h-m9mc,2020-09-03T21:46:21Z,"Malicious Package in buffdr-xor",buffd
 GHSA-855m-jchh-9qjc,2020-09-02T20:19:22Z,"Malicious Package in commnader",commnader,0,,,CRITICAL,CWE-506,
 GHSA-85q4-v37c-wfpc,2020-09-04T15:39:28Z,"Malicious Package in bitcion-ops",bitcion-ops,0.0.0,,,CRITICAL,CWE-506,
 GHSA-866c-wwm5-4rj7,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing",openclaw,0,,2026.2.24,MODERATE,CWE-294,
+GHSA-866w-xmhq-wj7x,2026-07-24T15:58:05Z,"SvelteKit: Prototype pollution in file input deletion path in remote-function forms",@sveltejs/kit,0,2.69.1,,MODERATE,CWE-1321,
 GHSA-86gv-xpwv-jprc,2020-09-03T17:36:00Z,"Malicious Package in diamond-clien",diamond-clien,0.0.0,,,CRITICAL,CWE-506,
+GHSA-86j7-9j95-vpqj,2026-07-07T20:55:28Z,"Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp",better-auth,0,1.6.13,,HIGH,CWE-601;CWE-79,
+GHSA-86j7-9j95-vpqj,2026-07-07T20:55:28Z,"Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp",better-auth,1.7.0-beta.0,1.7.0-beta.4,,HIGH,CWE-601;CWE-79,
 GHSA-86jj-29wc-7q2w,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's Signal reaction-only status events could, in limited cases, be enqueued before access checks",openclaw,0,,2026.2.24,MODERATE,CWE-863,
 GHSA-86mr-6m89-vgj3,2020-09-03T15:51:38Z,"Buffer Overflow in node-weakauras-parser",node-weakauras-parser,1.0.4,1.0.5,,MODERATE,CWE-120,
 GHSA-86mr-6m89-vgj3,2020-09-03T15:51:38Z,"Buffer Overflow in node-weakauras-parser",node-weakauras-parser,2.0.0,2.0.2,,MODERATE,CWE-120,
@@ -7604,6 +7925,7 @@ GHSA-87qp-7cw8-8q9c,2024-03-25T06:30:24Z,"Duplicate Advisory: web3-utils Prototy
 GHSA-87qw-7v97-w34r,2020-09-02T18:33:18Z,"Malicious Package in asinc",asinc,0,,,CRITICAL,CWE-506,
 GHSA-87v3-4cfp-cm76,2026-03-18T16:10:26Z,"Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas",@pdfme/schemas,0,5.5.9,,MODERATE,CWE-79,
 GHSA-886v-mm6p-4m66,2019-06-05T09:48:02Z,"High severity vulnerability that affects gun",gun,0,0.2019.416,,HIGH,CWE-22,
+GHSA-88c4-pcqm-3r9p,2026-07-22T12:32:17Z,"Duplicate Advisory: GraphQL Node Bypasses ""Allowed HTTP Request Domains"" Restriction",n8n,0,,,MODERATE,CWE-863,
 GHSA-88h9-fc6v-jcw7,2020-09-03T20:28:51Z,"Unintended Require in larvitbase-www",larvitbase-www,0.0.0,,,MODERATE,,
 GHSA-88qp-p4qg-rqm6,2026-02-19T20:30:25Z,"CPU exhaustion in SvelteKit remote form deserialization (experimental only)",@sveltejs/kit,2.49.0,2.52.2,,MODERATE,CWE-843,
 GHSA-88xx-23mf-rcj2,2020-09-03T22:51:52Z,"Malicious Package in bs-sha3",bs-sha3,0.0.0,,,CRITICAL,CWE-506,
@@ -7615,6 +7937,7 @@ GHSA-8c8c-4vfj-rrpc,2020-09-01T19:05:11Z,"Reflected Cross-Site Scripting in redi
 GHSA-8cp7-rp8r-mg77,2026-03-04T18:55:48Z,"OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP",openclaw,2026.1.20,2026.2.19,,MODERATE,CWE-918,
 GHSA-8f93-rv4p-x4jw,2019-06-12T16:36:52Z,"SQL Injection in sql",sql,0,,0.78.0,MODERATE,CWE-89,
 GHSA-8f9r-gr6r-x63q,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation",openclaw,0,2026.3.28,,MODERATE,CWE-696,
+GHSA-8fpg-xm3f-6cx3,2026-07-23T14:52:23Z,"Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)",next-auth,5.0.0-beta.0,5.0.0-beta.32,,CRITICAL,CWE-285;CWE-636,
 GHSA-8fw4-xh83-3j6q,2020-09-11T21:18:05Z,"Cross-Site Scripting in diagram-js",diagram-js,0,2.6.2,,MODERATE,CWE-79,
 GHSA-8fw4-xh83-3j6q,2020-09-11T21:18:05Z,"Cross-Site Scripting in diagram-js",diagram-js,3.0.0,3.3.1,,MODERATE,CWE-79,
 GHSA-8g29-8xwr-qmhr,2026-03-25T17:33:01Z,"@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling",@grackle-ai/server,0,0.70.6,,LOW,CWE-754,
@@ -7651,17 +7974,20 @@ GHSA-8mm3-2mcj-cx6r,2020-09-11T21:09:24Z,"Malicious Package in angluar-cli",angl
 GHSA-8mmf-qp7j-2w24,2020-09-02T21:35:33Z,"Malicious Package in colour-string",colour-string,0,,,CRITICAL,CWE-506,
 GHSA-8mpm-q7mh-8fvh,2026-03-18T16:09:42Z,"Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)",@capgo/cli,0,7.84.6,,HIGH,CWE-276;CWE-377;CWE-59,
 GHSA-8mr2-f9wf-hcfq,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback",openclaw,0,2026.2.22,,LOW,CWE-522,
+GHSA-8mv7-9c27-98vc,2026-07-20T23:26:27Z,"Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered",astro,7.0.0,7.0.6,,MODERATE,CWE-352,
 GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",@sequelize/core,0,7.0.0-alpha.20,,CRITICAL,CWE-790,
 GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",sequelize,0,6.29.0,,CRITICAL,CWE-790,
 GHSA-8pf2-vj79-4wxg,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API",openclaw,0,2026.3.31,,MODERATE,CWE-441,
 GHSA-8pwx-j4r6-5v38,2020-09-03T17:05:25Z,"Malicious Package in hdkye",hdkye,0.0.0,,,CRITICAL,CWE-506,
 GHSA-8px5-2gfr-7ph6,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path",openclaw,2026.1.21,,2026.2.17,MODERATE,CWE-78,
 GHSA-8q2c-2396-hf7j,2020-09-03T17:34:55Z,"Malicious Package in appx-compiler",appx-compiler,0.0.0,,,CRITICAL,CWE-506,
+GHSA-8q49-2h5h-434x,2026-07-24T22:40:00Z,"FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller",@frontmcp/adapters,0,1.5.6,,MODERATE,CWE-918,
 GHSA-8qm3-746x-r74r,2026-02-19T20:29:17Z,"devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed",devalue,0,5.6.3,,LOW,CWE-1321,
 GHSA-8qx4-r7fx-xc4v,2020-09-11T21:08:19Z,"Malicious Package in requst",requst,0,,,CRITICAL,CWE-506,
 GHSA-8r4g-cg4m-x23c,2021-09-22T18:22:02Z,"Denial of Service in node-static",node-static,0,,0.7.11,MODERATE,CWE-248;CWE-400,
 GHSA-8r69-3cvp-wxc3,2022-11-02T18:18:10Z,"Batched HTTP requests may set incorrect `cache-control` response header",@apollo/server,0,4.1.0,,MODERATE,CWE-524,
 GHSA-8r69-3cvp-wxc3,2022-11-02T18:18:10Z,"Batched HTTP requests may set incorrect `cache-control` response header",apollo-server-core,3.0.0,3.11.0,,MODERATE,CWE-524,
+GHSA-8r6m-32jq-jx6q,2026-07-21T22:06:36Z,"fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits",fast-xml-parser,5.9.3,5.10.1,,HIGH,CWE-776,
 GHSA-8rgj-285w-qcq4,2025-02-10T17:59:09Z,"Unknown vulnerability in Coinbase Wallet SDK",@coinbase/wallet-sdk,4.0.0-beta.0,4.3.0,,HIGH,,
 GHSA-8v5f-hp78-jgxq,2019-06-06T15:30:33Z,"Signature Verification Bypass in jwt-simple",jwt-simple,0,0.5.3,,HIGH,CWE-347,
 GHSA-8vj3-jgcf-77jv,2020-09-02T20:26:49Z,"Malicious Package in requeest",requeest,0,,,CRITICAL,CWE-506,
@@ -7691,7 +8017,6 @@ GHSA-93rg-2xm5-2p9v,2026-05-04T21:14:17Z,"OpenClaw's Gateway Control UI bootstra
 GHSA-943q-mwmv-hhvh,2026-03-02T23:32:22Z,"OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval",openclaw,0,2026.2.14,,HIGH,CWE-78,
 GHSA-95cg-3r4g-7w6j,2020-09-03T23:01:29Z,"Malicious Package in js-rha3",js-rha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-96qw-h329-v5rg,2026-01-08T21:13:37Z,"Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles",shakapacker,0,9.5.0,,HIGH,CWE-200,
-GHSA-9752-mhqh-h34f,2026-06-18T14:26:42Z,"npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation",praisonai,1.6.0,1.7.2,,CRITICAL,CWE-306,
 GHSA-97mg-3cr6-3x4c,2020-09-04T17:27:23Z,"Remote Code Execution in mongodb-query-parser",mongodb-query-parser,0,2.0.0,,CRITICAL,,
 GHSA-97mp-9g5c-6c93,2020-09-04T16:50:48Z,"Malicious Package in bs58chcek",bs58chcek,0.0.0,,,CRITICAL,CWE-506,
 GHSA-97pr-9hgg-3p8r,2026-06-19T21:42:48Z,"parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change",parse-server,0,8.6.83,,LOW,CWE-200,
@@ -7702,15 +8027,20 @@ GHSA-98ch-45wp-ch47,2026-04-07T18:15:48Z,"OpenClaw: Windows-compatible env overr
 GHSA-98pf-gfh3-x3mp,2022-11-10T16:02:51Z,"Read the Docs vulnerable to Cross-Site Scripting (XSS)",readthedocs,0,8.8.1,,MODERATE,CWE-79,
 GHSA-992f-wf4w-x36v,2020-09-01T21:16:13Z,"Prototype Pollution in merge-objects",merge-objects,0.0.0,,,LOW,CWE-1321,
 GHSA-9959-c6q6-6qp3,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects validator",validator,0,2.0.0,,MODERATE,,
-GHSA-99pg-hqvx-r4gf,2025-09-15T20:00:39Z,"Flowise has an Arbitrary File Read",flowise,3.0.5,3.0.6,,CRITICAL,,
-GHSA-9c83-rr99-vfwj,2026-06-19T21:42:24Z,"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested",@bitbonsai/mcpvault,0,0.11.5,,MODERATE,CWE-22;CWE-538,
+GHSA-99pg-hqvx-r4gf,2025-09-15T20:00:39Z,"Flowise has an Arbitrary File Read",flowise,3.0.5,3.0.6,,CRITICAL,CWE-22,
+GHSA-9c3v-684m-579c,2026-07-01T22:09:28Z,"OpenClaw MCP SSE redirects could forward Authorization headers",openclaw,0,2026.6.5,,MODERATE,CWE-200;CWE-522;CWE-601,
+GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,0,1.123.67,,MODERATE,CWE-20,
+GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-20,
+GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,2.32.0,2.32.1,,MODERATE,CWE-20,
 GHSA-9cph-cqqh-36pw,2020-09-04T15:29:25Z,"Malicious Package in babel-loqder",babel-loqder,0.0.0,,,CRITICAL,CWE-506,
 GHSA-9f72-qcpw-2hxc,2026-03-03T19:08:08Z,"OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs",openclaw,0,2026.2.24,,HIGH,CWE-200;CWE-284,
 GHSA-9f79-7pw8-3fj8,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf",openclaw,0,,2026.2.25,HIGH,CWE-22,
 GHSA-9ggv-8w38-r7pm,2026-06-19T19:18:49Z,"TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)",typeorm,0.1.12,0.3.29,,MODERATE,CWE-89,
 GHSA-9gvx-vj57-vqqx,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication",openclaw,0,2026.3.23,,MODERATE,CWE-288,
 GHSA-9gxr-rhx6-4jgv,2020-09-04T15:18:57Z,"Sandbox Breakout / Prototype Pollution in notevil",notevil,0,1.3.3,,MODERATE,CWE-1321,
+GHSA-9h47-pqcx-hjr4,2026-07-07T20:55:41Z,"Better Auth has insecure cryptographic defaults in oidcProvider: alg=none advertised and plain PKCE accepted by default",better-auth,0,1.6.11,,HIGH,CWE-1188;CWE-327;CWE-757,
 GHSA-9h6g-pr28-7cqp,2024-01-31T22:42:54Z,"nodemailer ReDoS when trying to send a specially crafted email",nodemailer,0,6.9.9,,MODERATE,CWE-1333,
+GHSA-9hc2-hjx8-q6pv,2026-07-14T19:52:41Z,"TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution",tidgi,0,,0.13.0,CRITICAL,CWE-94,
 GHSA-9hc2-w9gg-q6jw,2020-09-01T21:07:41Z,"Malicious Package in boogeyman",boogeyman,0.0.0,,,CRITICAL,CWE-506,
 GHSA-9hqj-38j2-5jgm,2020-09-01T21:19:23Z,"Command Injection in ascii-art",ascii-art,0,1.4.4,,LOW,CWE-77,
 GHSA-9hrv-gvrv-6gf2,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise,0,3.1.0,,MODERATE,CWE-918,
@@ -7720,6 +8050,7 @@ GHSA-9m65-766c-r333,2026-05-14T16:37:10Z,"TanStack Start - Server Core: Inbound
 GHSA-9mjp-gv34-3jcf,2020-09-02T18:37:35Z,"Malicious Package in aasync",aasync,0,,,CRITICAL,CWE-506,
 GHSA-9mmw-3fmh-96g3,2020-09-02T20:23:38Z,"Malicious Package in calk",calk,0,,,CRITICAL,CWE-506,
 GHSA-9mph-4f7v-fmvh,2026-03-04T19:02:59Z,"OpenClaw has agent avatar symlink traversal in gateway session metadata",openclaw,0,2026.2.22,,MODERATE,CWE-59,
+GHSA-9mqv-5hh9-4cgg,2026-07-21T22:04:27Z,"Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake",@hono/node-server,2.0.0,2.0.10,,MODERATE,CWE-401;CWE-770,
 GHSA-9p64-h5q4-phpm,2020-09-02T15:44:58Z,"Remote Code Execution in office-converter",office-converter,0.0.0,,,HIGH,CWE-20,
 GHSA-9p93-7j67-5pc2,2026-03-27T22:28:25Z,"OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding",openclaw,0,,2026.3.24,HIGH,CWE-226;CWE-863,
 GHSA-9pcf-h8q9-63f6,2020-09-03T17:12:41Z,"Sandbox Breakout / Arbitrary Code Execution in safe-eval",safe-eval,0.0.0,,,HIGH,,
@@ -7768,8 +8099,10 @@ GHSA-9xgp-hfw7-73rq,2020-08-19T21:30:04Z,"Authentication Weakness in keystone",k
 GHSA-9xr8-8hmc-389f,2019-11-22T13:45:33Z,"Cross-Site Scripting in vant",vant,0,2.1.8,,HIGH,CWE-79,
 GHSA-9xww-fwh9-95c5,2020-09-02T21:43:59Z,"Malicious Package in uglyfi-js",uglyfi-js,0,,,CRITICAL,CWE-506,
 GHSA-c27r-x354-4m68,2020-10-27T20:39:46Z,"xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion",xml-crypto,0,2.0.0,,HIGH,CWE-287,
+GHSA-c29c-2q9c-pc86,2026-07-02T16:43:38Z,"OpenClaw: Slack allowFrom could bind to mutable display names",openclaw,0,2026.5.3,,HIGH,CWE-290,
 GHSA-c2fv-2fmj-9xrx,2025-07-28T06:30:23Z,"Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability",ssrfcheck,0,1.2.0,,HIGH,CWE-918,
 GHSA-c2g6-57fp-22wp,2020-09-03T22:48:35Z,"Malicious Package in fuffer-xor",fuffer-xor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-c2j3-45gr-mqc4,2026-07-21T19:41:07Z,"DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",dompurify,0,3.4.12,,LOW,CWE-184;CWE-693;CWE-79,
 GHSA-c35v-qwqg-87jc,2019-06-06T15:32:32Z,"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison",express-basic-auth,0,1.1.7,,LOW,CWE-208,
 GHSA-c3hq-7mxh-mqxf,2020-09-04T14:59:50Z,"Sandbox Breakout / Arbitrary Code Execution in lighter-vm",lighter-vm,0.0.0,,,CRITICAL,,
 GHSA-c3m8-x3cg-qm2c,2020-09-03T20:39:53Z,"Configuration Override in helmet-csp",helmet-csp,1.2.2,2.9.1,,MODERATE,,
@@ -7786,6 +8119,7 @@ GHSA-c6h2-mpc6-232h,2020-08-27T22:26:15Z,"Command Injection in dns-sync",dns-syn
 GHSA-c6m7-q6pr-c64r,2025-12-12T16:41:58Z,"Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components",@vitejs/plugin-rsc,0,0.5.7,,MODERATE,CWE-1395;CWE-497;CWE-502,
 GHSA-c7pp-x73h-4m2v,2020-09-02T15:53:46Z,"Cross-Site Scripting in bootstrap-vue",bootstrap-vue,0,2.0.0-rc.12,,HIGH,CWE-79,
 GHSA-c7w3-x93f-qmm8,2026-03-26T22:26:46Z,"Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter",nodemailer,0,8.0.4,,LOW,CWE-93,
+GHSA-c8vc-7pv3-g98p,2026-07-24T21:14:49Z," Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)",@budibase/server,0,,3.38.1,HIGH,CWE-639,
 GHSA-c8w7-9w9h-x69q,2026-06-16T21:31:58Z,"Duplicate Advisory: Slack reaction events could ignore reaction notification settings",openclaw,0,,2026.5.7,MODERATE,CWE-862,
 GHSA-cc4f-hjpj-g9p8,2026-04-16T21:21:12Z,"Flowise: Weak Default JWT Secrets",flowise,0,3.1.0,,MODERATE,CWE-327,
 GHSA-ccq6-3qx5-vmqx,2018-07-31T22:54:14Z,"Moderate severity vulnerability that affects is-my-json-valid",is-my-json-valid,0,2.12.4,,MODERATE,,
@@ -7808,22 +8142,24 @@ GHSA-chgg-rrmv-5q7x,2020-08-03T18:05:48Z,Withdrawn,jwt-simple,0,0.3.1,,MODERATE,
 GHSA-chh2-rvhg-wqwr,2020-09-03T21:02:10Z,"Malicious Package in json-serializer",json-serializer,2.0.10,2.0.11,,CRITICAL,,
 GHSA-chm2-m3w2-wcxm,2026-02-17T22:56:39Z,"OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch",clawdbot,0,,2026.1.24-3,LOW,CWE-290;CWE-863,
 GHSA-chm2-m3w2-wcxm,2026-02-17T22:56:39Z,"OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch",openclaw,0,2026.2.14,,LOW,CWE-290;CWE-863,
-GHSA-cj63-jhhr-wcxv,2026-04-03T03:45:08Z,"DOMPurify USE_PROFILES prototype pollution allows event handlers",dompurify,0,3.3.2,,MODERATE,CWE-1321,
+GHSA-cj9h-qx8g-pq2g,2026-07-22T22:11:22Z,"n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON",n8n,0,1.123.67,,HIGH,CWE-863,
+GHSA-cj9h-qx8g-pq2g,2026-07-22T22:11:22Z,"n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-863,
+GHSA-cj9h-qx8g-pq2g,2026-07-22T22:11:22Z,"n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON",n8n,2.32.0,2.32.1,,HIGH,CWE-863,
 GHSA-cjg8-85gj-v9q2,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed",openclaw,0,2026.4.15,,CRITICAL,CWE-1188,
-GHSA-cjmm-f4jc-qw8r,2026-04-03T03:46:07Z,"DOMPurify ADD_ATTR predicate skips URI validation",dompurify,0,3.3.2,,MODERATE,CWE-183,
 GHSA-cjq8-m7wj-xmq9,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows",openclaw,0,,,LOW,CWE-863,
 GHSA-cjv3-m589-v3rx,2026-03-03T23:17:06Z,"OpenClaw has Canvas route hardening for mixed-trust deployments",openclaw,0,2026.2.21,,MODERATE,CWE-1021;CWE-79,
-GHSA-cmwh-pvxp-8882,2026-06-18T14:27:37Z,"DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",dompurify,0,3.4.11,,MODERATE,CWE-471;CWE-665;CWE-79,
 GHSA-cp47-r258-q626,2023-03-02T23:36:22Z," Vega vulnerable to arbitrary code execution when clicking href links",vega,0,4.5.1,,MODERATE,,
 GHSA-cp47-r258-q626,2023-03-02T23:36:22Z," Vega vulnerable to arbitrary code execution when clicking href links",vega,5.0.0,5.4.1,,MODERATE,,
 GHSA-cpgr-wmr9-qxv4,2020-09-11T21:20:14Z,"Cross-Site Scripting in serve",serve,0,10.0.2,,MODERATE,CWE-79,
 GHSA-cpqf-f22c-r95x,2025-12-12T16:41:08Z,"Vite Plugin React has a Denial of Service Vulnerability in React Server Components",@vitejs/plugin-rsc,0,0.5.7,,HIGH,CWE-1395;CWE-400;CWE-502,
 GHSA-cqmh-pcgr-q42f,2026-05-06T23:23:25Z,"@axonflow/openclaw fix introduces plugin cache and credential-file permission hardening",@axonflow/openclaw,0,2.0.0,,MODERATE,CWE-552;CWE-732,
+GHSA-cqwv-9qjx-vxw2,2026-07-02T16:38:03Z,"OpenClaw: Skill Workshop apply flow could override pending approval",openclaw,0,2026.5.6,,MODERATE,CWE-807,
 GHSA-cr3w-cw5w-h3fj,2026-01-26T23:34:49Z,"Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCE",@saltcorn/server,1.1.1,1.5.0-beta.19,,CRITICAL,CWE-77;CWE-79,
 GHSA-cr4x-w2v7-4mmf,2020-09-03T22:26:13Z,"Malicious Package in bufver-xor",bufver-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-cr56-66mx-293v,2020-09-03T15:53:50Z,"Cross-Site Scripting in @toast-ui/editor",@toast-ui/editor,0,2.2.0,,HIGH,CWE-79,
 GHSA-cr5w-6rv4-r2qg,2020-09-03T02:37:45Z,"Malicious Package in maleficent",maleficent,0,,,CRITICAL,CWE-506,
 GHSA-cr67-78jr-j94p,2020-09-03T18:14:47Z,"Local File Inclusion in domokeeper",domokeeper,0.0.0,,,MODERATE,,
+GHSA-cr7p-cr3q-h5cm,2026-07-24T21:43:11Z," Budibase: Account Enumeration via Login Lockout Response Differential",@budibase/server,0,,3.38.1,MODERATE,CWE-204,
 GHSA-crf7-fvjx-863q,2020-09-03T17:09:26Z,"Path Traversal in zero",zero,0,1.0.6,,HIGH,CWE-22,
 GHSA-crfh-jmv2-2f9v,2020-09-03T17:03:11Z,"Malicious Package in singale",singale,0.0.0,,,CRITICAL,CWE-506,
 GHSA-crfx-5phg-hmw9,2019-06-13T18:59:12Z,"Cross-Site Scripting in ids-enterprise",ids-enterprise,0,4.18.2,,HIGH,CWE-79,
@@ -7831,7 +8167,7 @@ GHSA-crhg-xgrg-vvcc,2023-01-13T21:34:29Z,"a12nserver vulnerable to potential SQL
 GHSA-crpm-fm48-chj7,2020-09-11T21:13:44Z,"SQL Injection in resquel",resquel,0,,,HIGH,CWE-89,
 GHSA-crr2-ph72-c52g,2020-09-03T17:27:22Z,"Malicious Package in my-very-own-package",my-very-own-package,0.0.0,,,CRITICAL,CWE-506,
 GHSA-crvj-3gj9-gm2p,2018-10-09T00:44:29Z,"High severity vulnerability that affects qs",qs,0,1.0.0,,HIGH,,
-GHSA-cv3v-7846-6pxm,2020-09-03T21:15:19Z,"Unauthorized File Access in node-git-server",node-git-server,0,0.6.1,,HIGH,CWE-552,
+GHSA-cv3v-7846-6pxm,2020-09-03T21:15:19Z,"Unauthorized File Access in node-git-server",node-git-server,0.2.0,0.6.1,,HIGH,CWE-552,
 GHSA-cvfm-xjc8-f2vm,2020-09-03T15:46:36Z,"Denial of Service in @commercial/subtext",@commercial/subtext,5.1.1,5.1.2,,HIGH,,
 GHSA-cw28-63x4-37c3,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection",openclaw,0,2026.3.31,,MODERATE,CWE-367,
 GHSA-cwj3-vqpp-pmxr,2026-05-05T18:44:31Z,"OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes",openclaw,0,2026.4.23,,HIGH,CWE-862,
@@ -7845,6 +8181,8 @@ GHSA-f3h5-h452-vp3j,2026-04-17T22:00:59Z,"OpenClaw: Nostr profile mutation route
 GHSA-f3pc-c2gf-hvgw,2020-09-02T21:13:14Z,"Malicious Package in requets",requets,0,,,CRITICAL,CWE-506,
 GHSA-f3vw-587g-r29g,2020-09-03T15:50:38Z,"Path Traversal in sapper",sapper,0,0.27.11,,CRITICAL,CWE-22,
 GHSA-f478-xwv9-p93q,2022-05-24T17:18:00Z,"Duplicate Advisory: Kerberos for NodeJS allows DLL Injection",kerberos,0,1.0.0,,HIGH,CWE-427,
+GHSA-f4gw-2p7v-4548,2026-07-20T22:20:18Z,"Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",axios,0.31.0,0.33.0,,MODERATE,CWE-183;CWE-918,
+GHSA-f4gw-2p7v-4548,2026-07-20T22:20:18Z,"Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",axios,1.15.0,1.18.0,,MODERATE,CWE-183;CWE-918,
 GHSA-f52g-6jhx-586p,2020-09-03T23:20:12Z,"Denial of Service in handlebars",handlebars,4.0.0,4.4.5,,MODERATE,CWE-400,
 GHSA-f5cv-xrv9-r8w7,2020-09-01T21:17:16Z,"NoSQL injection in express-cart",express-cart,0,1.1.8,,HIGH,CWE-89,
 GHSA-f5fm-9jmp-c88r,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections",openclaw,0,2026.4.2,,MODERATE,CWE-639,
@@ -7861,6 +8199,7 @@ GHSA-f7gc-6hcj-wc42,2020-09-03T17:05:06Z,"Malicious Package in path-to-regxep",p
 GHSA-f7qw-5pvg-mmwp,2019-06-13T18:58:44Z,"Prototype Pollution in lutils-merge",lutils-merge,0,,0.2.6,MODERATE,CWE-400,
 GHSA-f7r3-p866-q9qr,2019-06-03T17:27:49Z,"ircdkit vulnerable to Denial of Service due to unhandled connection end event",ircdkit,0,1.0.4,,LOW,CWE-400,
 GHSA-f7xj-rg7h-mc87,2023-07-07T20:32:55Z,"Stylelint has vulnerability in semver dependency",stylelint,8.0.0,15.10.1,,LOW,,
+GHSA-f88m-g3jw-g9cj,2026-07-21T22:07:17Z,"sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",sharp,0,0.35.0,,HIGH,CWE-1395,
 GHSA-f8h3-rqrm-47v9,2020-09-02T16:02:40Z,"Prototype Pollution in smart-extend",smart-extend,0,,,MODERATE,CWE-1321,
 GHSA-f8jj-45fj-44r6,2020-09-03T23:05:43Z,"Malicious Package in js-she3",js-she3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-f8pq-3926-8gx5,2023-08-09T20:59:14Z,"Unsanitized user controlled input in module generation","@opentelemetry/instrumentation",0.40.0,0.41.2,,HIGH,,
@@ -7868,6 +8207,10 @@ GHSA-f8r2-vg7x-gh8m,2026-03-13T20:55:03Z,"OpenClaw: Exec approval allowlist patt
 GHSA-f8rq-m28h-8hxj,2020-09-03T15:50:29Z,"Cross-Site Scripting in htmr",htmr,0,0.8.7,,HIGH,CWE-79,
 GHSA-f8vf-6hwg-hw55,2020-09-04T15:38:21Z,"Malicious Package in bictore-lib",bictore-lib,0.0.0,,,CRITICAL,CWE-506,
 GHSA-f934-5rqf-xx47,2026-04-17T22:33:33Z,"OpenClaw: QMD memory_get restricts reads to canonical or indexed memory paths",openclaw,0,2026.4.15,,MODERATE,CWE-22,
+GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/auth,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
+GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/mcp,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
+GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/plugin-core,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
+GHSA-fcrw-f7gg-6g9f,2026-07-24T21:14:31Z," Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users",@budibase/server,0,3.39.25,,MODERATE,CWE-200,
 GHSA-ff5x-w9wg-h275,2020-03-06T01:15:46Z,"Holder can generate proof of ownership for credentials it does not control in vp-toolkit",vp-toolkit,0,0.2.2,,HIGH,,
 GHSA-ff6g-gm92-rf32,2020-09-03T19:42:06Z,"Malicious Package in coinstirng",coinstirng,0.0.0,,,CRITICAL,CWE-506,
 GHSA-ff98-w8hj-qrxf,2026-03-03T21:39:26Z,"OpenClaw plugin runtime command execution is part of trusted plugin boundary",openclaw,0,2026.2.19,,MODERATE,CWE-78,
@@ -7883,16 +8226,13 @@ GHSA-fm7r-2pr7-rw2p,2020-09-02T21:45:02Z,"Malicious Package in yeoman-genrator",
 GHSA-fm93-fhh2-cg2c,2022-01-27T14:21:53Z,"Duplicate Advisory: Prototype Pollution in min-dash",min-dash,0,3.8.1,,HIGH,CWE-1321,
 GHSA-fmh4-wr37-44fp,2025-12-03T19:07:52Z,"React Server Components are Vulnerable to RCE",@vitejs/plugin-rsc,0,0.5.3,,CRITICAL,CWE-502,
 GHSA-fmr4-7g9q-7hc7,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects handlebars",handlebars,0,4.0.0,,MODERATE,,
+GHSA-fmvg-vhqq-r2mj,2026-07-22T12:32:17Z,"Duplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data",n8n,0,,,MODERATE,CWE-532,
 GHSA-fp4x-ggrf-wmc6,2026-03-23T21:48:24Z,"H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation",h3,2.0.1-rc.17,2.0.1-rc.18,,MODERATE,CWE-601,
 GHSA-fpf2-pr3j-4cm3,2020-09-03T17:06:06Z,"Malicious Package in ecruve",ecruve,0.0.0,,,CRITICAL,CWE-506,
 GHSA-fpg4-jhqr-589c,2026-02-28T02:04:39Z,"SvelteKit  has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)",@sveltejs/kit,2.49.0,2.53.3,,LOW,CWE-770,
 GHSA-fpgg-r39h-3x5x,2020-09-03T17:06:22Z,"Malicious Package in cxt",cxt,0.0.0,,,CRITICAL,CWE-506,
 GHSA-fpw3-x4xq-6vxq,2020-09-02T18:32:13Z,"Malicious Package in wepack-cli",wepack-cli,0,,,CRITICAL,CWE-506,
 GHSA-fpw4-p57j-hqmq,2026-04-16T22:49:13Z,"Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization",@paperclipai/ui,0,2026.416.0,,MODERATE,CWE-79,
-GHSA-fq4x-789w-jg5h,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/claudecode,0,0.2.39,,HIGH,CWE-306,
-GHSA-fq4x-789w-jg5h,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/codex,0,0.1.33,,HIGH,CWE-306,
-GHSA-fq4x-789w-jg5h,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/core,0,0.9.43,,HIGH,CWE-306,
-GHSA-fq4x-789w-jg5h,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/openclaw,0,0.5.71,,HIGH,CWE-306,
 GHSA-fqrj-m88p-qf3v,2026-04-07T18:14:50Z,"OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets",openclaw,2026.2.19,2026.3.31,,LOW,CWE-287,
 GHSA-fqw4-mph7-2vr8,2026-03-27T22:29:47Z,"OpenClaw: Silent privilege escalation via gateway shared-auth reconnect",openclaw,0,,2026.3.24,CRITICAL,CWE-863,
 GHSA-fqw7-8v6m-2f86,2020-09-02T21:37:39Z,"Malicious Package in hulp",hulp,0,,,CRITICAL,CWE-506,
@@ -7901,6 +8241,7 @@ GHSA-fr4h-3cph-29xv,2026-06-27T00:02:51Z,"pnpm: Hoisted install imports lockfile
 GHSA-fr4j-65pv-gjjj,2026-01-13T20:28:16Z,"Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration",renovate,35.63.0,40.33.0,,MODERATE,CWE-77,
 GHSA-fr9g-2m2h-c27j,2023-08-16T06:30:24Z,"Duplicate Advisory: @excalidraw/excalidraw Cross-site Scripting vulnerability",@excalidraw/excalidraw,0,0.15.3,,MODERATE,CWE-79,
 GHSA-frr5-j3mh-h9ch,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes",openclaw,0,2026.4.22,,MODERATE,CWE-367,
+GHSA-frvp-7c67-39w9,2026-07-21T18:17:25Z,"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",@hono/node-server,0,2.0.5,,MODERATE,CWE-22,
 GHSA-frxq-v7fm-m4pv,2020-09-02T20:27:53Z,"Malicious Package in requuest",requuest,0,,,CRITICAL,CWE-506,
 GHSA-fvfv-ppw4-7h2w,2026-02-26T22:46:42Z,"n8n has a Guardrail Node Bypass",n8n,0,2.10.0,,MODERATE,CWE-20;CWE-693,
 GHSA-fvh2-gm75-j4j7,2026-05-18T17:00:25Z,"dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport",dynoxide,0.9.3,0.9.13,,HIGH,CWE-346;CWE-350;CWE-352,
@@ -7925,6 +8266,7 @@ GHSA-g485-8j3v-p6x8,2026-05-05T18:28:32Z,"@tdurieux/anonymous_github Vulnerable
 GHSA-g49q-jw42-6x85,2024-05-09T21:31:35Z,"thelounge may publicly disclose of all usernames/idents via port 113",thelounge,0,,4.4.3,LOW,,
 GHSA-g4m3-rpxr-h7vg,2020-09-03T19:52:25Z,"Malicious Package in mogodb-core",mogodb-core,0.0.0,,,CRITICAL,CWE-506,
 GHSA-g5q2-fcg9-j526,2020-09-03T17:40:18Z,"Malicious Package in hsf-clients",hsf-clients,0.0.0,,,CRITICAL,CWE-506,
+GHSA-g5vv-q72c-7j78,2026-07-24T21:47:29Z,"@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion",@anephenix/hub,0,0.2.16,,HIGH,CWE-400,
 GHSA-g64q-3vg8-8f93,2020-09-03T15:47:10Z,"Prototype Pollution in pez",pez,0.0.0,,,HIGH,CWE-1321,
 GHSA-g6f4-j6c2-w3p3,2018-10-09T00:39:43Z,"High severity vulnerability that affects uglify-js",uglify-js,0,2.4.24,,HIGH,,
 GHSA-g6w6-h933-4rc5,2023-08-03T19:44:52Z,"Soketi was exposed to Sandbox Escape vulnerability via vm2",@soketi/soketi,0,1.6.0,,CRITICAL,,
@@ -7953,39 +8295,50 @@ GHSA-g9wg-wq4f-2x5w,2020-09-03T19:00:10Z,"Cross-Site Scripting in console-feed",
 GHSA-gc25-3vc5-2jf9,2020-09-04T15:00:58Z,"Sandbox Breakout / Arbitrary Code Execution in sandbox",sandbox,0.0.0,,,CRITICAL,,
 GHSA-gc94-6w89-hpqr,2019-06-12T16:37:07Z,"Command Injection in fs-path",fs-path,0,0.0.25,,HIGH,CWE-77,
 GHSA-gcfc-mgg3-8j2c,2020-09-03T18:11:29Z,"Malicious Package in sdfjghlkfjdshlkjdhsfg",sdfjghlkfjdshlkjdhsfg,0.0.0,,,CRITICAL,CWE-506,
+GHSA-gcfj-64vw-6mp9,2026-07-20T22:40:07Z,"Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning",axios,0.31.1,0.33.0,,HIGH,CWE-1321;CWE-200,
+GHSA-gcfj-64vw-6mp9,2026-07-20T22:40:07Z,"Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning",axios,1.15.2,1.18.0,,HIGH,CWE-1321;CWE-200,
 GHSA-gcj7-r3hg-m7w6,2026-03-03T22:25:37Z,"OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity",openclaw,0,2026.2.26,,LOW,CWE-294;CWE-345,
+GHSA-gf29-4f56-r2jf,2026-07-22T22:06:45Z,"n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction",n8n,0,1.123.67,,HIGH,CWE-22,
+GHSA-gf29-4f56-r2jf,2026-07-22T22:06:45Z,"n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-22,
+GHSA-gf29-4f56-r2jf,2026-07-22T22:06:45Z,"n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction",n8n,2.32.0,2.32.1,,HIGH,CWE-22,
 GHSA-gf8q-jrpm-jvxq,2022-01-08T00:22:02Z,"URL parsing in node-forge could lead to undesired behavior.",node-forge,0,1.0.0,,LOW,CWE-601,
 GHSA-gfg9-5357-hv4c,2026-04-29T21:34:39Z,"OpenClaw: Webchat audio embedding could read local files without local-root containment",openclaw,0,2026.4.15,,MODERATE,CWE-200;CWE-22,
-GHSA-gfj5-979r-92pw,2026-06-18T17:22:47Z,"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()",@acastellon/auth,0,2.3.0,,CRITICAL,CWE-290,
 GHSA-gfj6-p24g-6hpm,2020-09-03T22:55:06Z,"Malicious Package in jc-sha3",jc-sha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gfjr-xqhm-qvv3,2020-09-02T20:16:09Z,"Malicious Package in aysnc",aysnc,0,,,CRITICAL,CWE-506,
 GHSA-gfm8-g3vm-53jh,2020-09-03T17:21:19Z,"Malicious Package in leetlog",leetlog,0.1.2,,,CRITICAL,CWE-506,
 GHSA-gfmx-pph7-g46x,2026-04-09T14:22:14Z,"OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade",openclaw,0,2026.4.8,,HIGH,CWE-501,
 GHSA-gfp8-mp24-5vxg,2026-05-21T20:43:27Z,"@hulumi/baseline: CloudTrail selector tampering events were not fully detected",@hulumi/baseline,0,1.3.2,,MODERATE,CWE-778,
 GHSA-ggm6-h3mx-cmmp,2026-03-19T03:30:57Z,"Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags",openclaw,0,,2026.2.17,LOW,CWE-78,
+GHSA-gh4h-34gr-87r7,2026-07-24T21:25:20Z," Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders",@budibase/server,0,,3.38.1,MODERATE,CWE-200,
+GHSA-gj2h-2fpw-fhv9,2026-07-02T20:16:12Z,"@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration",@nuxt/ui,0,,4.7.1,MODERATE,CWE-200;CWE-598,
 GHSA-gjhc-6xm7-mc8q,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,5.9.0,,MODERATE,CWE-79,
 GHSA-gjph-xf5q-6mfq,2020-09-03T15:46:02Z,"Denial of Service in @hapi/ammo",@hapi/ammo,0,3.1.2,,HIGH,,
 GHSA-gjph-xf5q-6mfq,2020-09-03T15:46:02Z,"Denial of Service in @hapi/ammo",@hapi/ammo,4.0.0,5.0.1,,HIGH,,
+GHSA-gm3r-q2wp-hw87,2026-07-24T22:35:08Z,"Shescape: Quadratic-time denial of service in the flag-protection",shescape,2.1.11,2.1.14,,HIGH,CWE-400;CWE-407,
+GHSA-gm3r-q2wp-hw87,2026-07-24T22:35:08Z,"Shescape: Quadratic-time denial of service in the flag-protection",shescape,3.0.0,3.0.1,,HIGH,CWE-400;CWE-407,
 GHSA-gm68-572p-q28r,2023-07-06T15:30:51Z,"@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability",@vendure/admin-ui-plugin,0,2.0.3,,MODERATE,CWE-79,
 GHSA-gm9g-2g8v-fvxj,2019-06-06T15:32:28Z,"Prototype Pollution in upmerge",upmerge,0,,0.1.8,MODERATE,CWE-345;CWE-400,
 GHSA-gm9m-x74r-8whg,2026-03-31T15:31:56Z,"Duplicate Advisory: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication",openclaw,0,2026.3.28,,MODERATE,CWE-307,
 GHSA-gm9x-q798-hmr4,2020-07-29T14:53:40Z,"Command Injection in git-tags-remote",git-tags-remote,0,1.0.4,,HIGH,CWE-78,
 GHSA-gmjp-776j-2394,2020-09-03T17:04:24Z,"Malicious Package in ripmed160",ripmed160,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gp3q-wpq4-5c5h,2026-03-12T14:21:45Z,"OpenClaw: LINE group allowlist scope mismatch with DM pairing-store entries",openclaw,0,2026.2.26,,HIGH,CWE-863,
+GHSA-gp79-m99v-gjmh,2026-07-02T16:45:14Z,"OpenClaw: Mattermost handlers could fall open when channel type was missing",openclaw,0,2026.5.6,,MODERATE,CWE-636,
 GHSA-gpg2-7r7j-4pm9,2020-09-03T22:09:56Z,"Malicious Package in buffer-xob",buffer-xob,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gpv5-7x3g-ghjv,2023-06-15T19:05:13Z,"fast-xml-parser regex vulnerability patch could be improved from a safety perspective",fast-xml-parser,4.2.4,4.2.5,,LOW,,
 GHSA-gq3j-xvxp-8hrf,2026-02-19T20:15:59Z,"Hono added timing comparison hardening in basicAuth and bearerAuth",hono,0,4.11.10,,LOW,CWE-208,
+GHSA-gqcv-rfj6-r29g,2026-07-08T15:32:01Z,"Duplicate Advisory: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects",n8n,0,,,MODERATE,CWE-639,
 GHSA-gqf6-75v8-vr26,2020-09-04T16:56:11Z,"Arbitrary File Write in bin-links",bin-links,0,1.1.5,,LOW,,
-GHSA-gqmf-56h7-rrpf,2026-06-18T14:26:28Z,"npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients",praisonai,1.2.3,1.7.2,,HIGH,CWE-653;CWE-693,
 GHSA-gqq4-937c-2282,2020-09-03T22:49:42Z,"Malicious Package in juffer-xor",juffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gqqj-85qm-8qhf,2026-04-16T22:47:40Z,"Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email",paperclipai,0,,2026.403.0,HIGH,CWE-284,
 GHSA-gr4j-r575-g665,2020-08-25T14:04:47Z,"Cross-Site Scripting in highcharts",highcharts,0,7.2.2,,HIGH,CWE-79,
 GHSA-gr4j-r575-g665,2020-08-25T14:04:47Z,"Cross-Site Scripting in highcharts",highcharts,8.0.0,8.1.1,,HIGH,CWE-79,
+GHSA-grc3-2j34-p6gm,2026-07-02T16:53:15Z,"OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs",openclaw,0,2026.5.2,,MODERATE,CWE-522,
 GHSA-gv2f-q4wp-fvh5,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials",openclaw,0,2026.3.28,,HIGH,CWE-346,
+GHSA-gv7g-jm28-cr3m,2026-07-22T22:10:15Z,"n8n: Expression sandbox escape via arrow-function bodies enabling command execution",n8n,0,2.31.5,,HIGH,CWE-94,
+GHSA-gv7g-jm28-cr3m,2026-07-22T22:10:15Z,"n8n: Expression sandbox escape via arrow-function bodies enabling command execution",n8n,2.32.0,2.32.1,,HIGH,CWE-94,
 GHSA-gv7w-rqvm-qjhr,2026-06-12T20:08:59Z,"Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY",esbuild,0.17.0,0.28.1,,HIGH,CWE-426;CWE-494,
 GHSA-gvff-25cc-4f66,2020-09-03T17:15:56Z,"Path Traversal in restify-swagger-jsdoc",restify-swagger-jsdoc,0,3.2.1,,HIGH,CWE-22,
 GHSA-gvm7-8fq3-qjj2,2020-09-03T19:43:18Z,"Malicious Package in bs85",bs85,0.0.0,,,CRITICAL,CWE-506,
-GHSA-gvmj-g25r-r7wr,2026-06-15T20:02:40Z,"DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",dompurify,3.0.0,3.4.8,,LOW,CWE-79,
 GHSA-gw2c-6hcg-5g52,2026-06-16T21:31:58Z,"Duplicate Advisory: Focus command could miss controlScope enforcement",openclaw,0,,2026.4.24,MODERATE,CWE-862,
 GHSA-gw32-9rmw-qwww,2026-01-16T21:02:56Z,"svelte is vulnerable to XSS with textarea bind:value",svelte,3.0.0,3.59.2,,HIGH,CWE-79,
 GHSA-h232-fpqx-mqgr,2020-09-03T21:03:15Z,"Malicious Package in log-symboles",log-symboles,0.0.0,,,CRITICAL,CWE-506,
@@ -8002,12 +8355,13 @@ GHSA-h25m-26qc-wcjf,2026-01-28T15:38:01Z,"Next.js HTTP request deserialization c
 GHSA-h26f-j4mv-84g7,2020-09-02T18:39:43Z,"Malicious Package in asycn",asycn,0,,,CRITICAL,CWE-506,
 GHSA-h29r-4vqp-8jxf,2020-08-20T17:21:46Z,"Cross-Site Scripting in keystone",keystone,0,4.0.0,,MODERATE,,
 GHSA-h2j3-gg8w-4858,2020-09-03T22:12:09Z,"Malicious Package in buffer-xos",buffer-xos,0.0.0,,,CRITICAL,CWE-506,
-GHSA-h2w2-v7j6-xqm4,2026-06-18T14:26:51Z,"npm PraisonAI AgentLoop onToolCall approval runs after tool execution",praisonai,1.4.0,1.7.2,,HIGH,CWE-693;CWE-862;CWE-863,
 GHSA-h36m-2vh5-x699,2026-03-19T03:30:57Z,"Duplicate Advisory: ACPX Windows wrapper shell fallback allowed cwd injection in specific paths",openclaw,2026.2.26,,,MODERATE,CWE-78,
 GHSA-h3hw-29fv-2x75,2026-01-21T16:36:27Z,"@envelop/graphql-modules has a Race Condition vulnerability",@envelop/graphql-modules,0,9.1.0,,HIGH,CWE-362,
 GHSA-h3jj-5f3v-3685,2026-06-16T22:40:06Z,"n8n: Public API Execution Retry Authorization Bypass",n8n,0,2.25.7,,MODERATE,CWE-863,
 GHSA-h3jj-5f3v-3685,2026-06-16T22:40:06Z,"n8n: Public API Execution Retry Authorization Bypass",n8n,2.26.0,2.26.2,,MODERATE,CWE-863,
 GHSA-h3m2-h22h-695r,2020-09-03T17:29:31Z,"Malicious Package in ali-contributor",ali-contributor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-h3rm-78g3-j7cp,2026-07-24T15:43:22Z,"@better-auth/stripe: cross-organization billing tampering in organization subscription actions",@better-auth/stripe,1.4.11,1.6.21,,HIGH,CWE-639;CWE-863,
+GHSA-h3rm-78g3-j7cp,2026-07-24T15:43:22Z,"@better-auth/stripe: cross-organization billing tampering in organization subscription actions",@better-auth/stripe,1.7.0-beta.0,1.7.0-beta.10,,HIGH,CWE-639;CWE-863,
 GHSA-h42x-xx2q-6v6g,2025-03-13T22:38:03Z,"Flowise Pre-auth Arbitrary File Upload",flowise,0,,2.2.7,CRITICAL,CWE-434,
 GHSA-h44f-769q-j6px,2020-09-02T20:33:14Z,"Malicious Package in requet",requet,0,,,CRITICAL,CWE-506,
 GHSA-h45p-w933-jxh3,2021-06-01T21:20:22Z,"Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript ","@aws-crypto/client-browser",0,1.9.0,,MODERATE,CWE-347,
@@ -8020,20 +8374,25 @@ GHSA-h5mp-5q4p-ggf5,2020-09-03T18:07:05Z,"Prototype Pollution in lodash.defaults
 GHSA-h5vj-f7r9-w564,2020-09-01T21:22:35Z,"Entropy Backdoor in text-qrcode",text-qrcode,0.0.0,,,HIGH,CWE-506,
 GHSA-h5vm-jhq7-w647,2020-09-02T20:17:13Z,"Malicious Package in momen",momen,0,,,CRITICAL,CWE-506,
 GHSA-h5x8-xp6m-x6q4,2026-06-19T22:10:37Z,"@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing","@jhb.software/payload-cloudinary-plugin",0.3.0,0.4.0,,HIGH,CWE-347,
+GHSA-h5xr-fqvj-253p,2026-07-22T12:32:17Z,"Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`",n8n,0,,,HIGH,CWE-79,
 GHSA-h656-5vcf-cm23,2026-03-03T19:08:30Z,"OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check",openclaw,0,2026.2.24,,MODERATE,"CWE-208;CWE-404;CWE-406;CWE-770",
 GHSA-h6ch-v84p-w6p9,2019-06-13T18:58:54Z,"Regular Expression Denial of Service (ReDoS)",diff,0,3.5.0,,HIGH,CWE-400,
 GHSA-h6m3-cx24-9626,2020-09-03T23:11:45Z,"Malicious Package in js-sla3",js-sla3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-h6mq-3cj6-h738,2020-09-03T23:21:16Z,"Reverse Tabnabbing in showdown",showdown,0,1.9.1,,LOW,CWE-1022,
 GHSA-h726-x36v-rx45,2020-09-03T18:04:54Z,"Prototype Pollution in lodash.merge",lodash.merge,0,4.6.2,,HIGH,CWE-1321,
 GHSA-h87q-g2wp-47pj,2022-02-09T22:41:19Z,"Signatures are mistakenly recognized to be valid in jsrsasign",jsrsasign,0,10.2.0,,MODERATE,CWE-347,
-GHSA-h8r8-wccr-v5f2,2026-03-27T20:41:29Z,"DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",dompurify,0,3.3.2,,MODERATE,CWE-79,
 GHSA-h96f-fc7c-9r55,2021-01-06T19:25:46Z,"Regex denial of service vulnerability in codesample plugin",tinymce,0,5.6.0,,LOW,CWE-400,
 GHSA-h97f-6pqj-q452,2026-03-03T21:48:55Z,"OpenClaw has a IPv6 multicast SSRF classifier bypass",openclaw,0,2026.2.25,,MODERATE,CWE-918,
 GHSA-h97g-4mx7-5p2p,2020-09-03T17:11:36Z,"Open Redirect in apostrophe",apostrophe,0,2.92.0,,MODERATE,CWE-601,
+GHSA-h9fm-xcv2-qfw3,2026-07-22T12:32:17Z,"Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook",n8n,0,,,MODERATE,CWE-306,
 GHSA-h9h6-pwqv-j9hv,2026-06-16T21:32:00Z,"Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes",openclaw,0,,2026.5.10-beta.2,LOW,CWE-266,
 GHSA-h9wq-xcqx-mqxm,2023-07-11T22:46:19Z,"Vendure Cross Site Request Forgery vulnerability impacting all API requests",@vendure/core,0,2.0.3,,LOW,,
 GHSA-h9wr-xr4r-66fh,2020-09-03T18:20:20Z,"Cross-Site Scripting in dmn-js-properties-panel",dmn-js-properties-panel,0,0.3.0,,HIGH,CWE-79,
 GHSA-hc4w-hm59-9w88,2026-06-16T21:31:59Z,"Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment",openclaw,0,,2026.4.24,LOW,CWE-636,
+GHSA-hcm3-8f6r-6xwg,2026-07-02T16:54:44Z,"OpenClaw: Browser debug/export routes could reuse already-open blocked tabs",openclaw,0,2026.4.29,,MODERATE,CWE-862,
+GHSA-hcpx-6fm6-wx23,2026-07-20T22:38:04Z,"Axios form serializer maxDepth bypass via {} metatoken",axios,0.31.1,0.33.0,,MODERATE,CWE-674,
+GHSA-hcpx-6fm6-wx23,2026-07-20T22:38:04Z,"Axios form serializer maxDepth bypass via {} metatoken",axios,1.15.1,1.18.0,,MODERATE,CWE-674,
+GHSA-hfhx-w8p8-4hc7,2026-07-24T21:44:44Z,"Budibase: SSRF via bare fetch() in uploadUrl during AI table generation",@budibase/server,0,,3.38.1,MODERATE,CWE-918,
 GHSA-hfpr-jhpq-x4rm,2026-03-09T19:54:41Z,"OpenClaw: `operator.write` chat.send could reach admin-only config writes",openclaw,0,2026.3.7,,MODERATE,CWE-863,
 GHSA-hfwx-c7q6-g54c,2021-03-12T23:04:46Z,"Vulnerability allowing for reading internal HTTP resources",highcharts-export-server,0,2.1.0,,HIGH,CWE-552,
 GHSA-hfxh-rjv7-2369,2023-11-27T17:25:11Z,"Uptime Kuma Authenticated remote code execution via TailscalePing",uptime-kuma,1.23.0,1.23.7,,MODERATE,,
@@ -8048,14 +8407,16 @@ GHSA-hgwr-wr8h-rxm7,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: Google C
 GHSA-hgxv-3497-3hhj,2023-07-04T18:30:58Z,"Duplicate Advisory: @fastify/oauth2 Oauth2 state parameter reuse",@fastify/oauth2,0,7.2.0,,MODERATE,,
 GHSA-hh43-q692-2xmq,2026-03-29T15:30:19Z,"Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state",openclaw,0,,2026.3.8,CRITICAL,CWE-863,
 GHSA-hj5w-xgw9-w4rj,2020-09-03T19:41:44Z,"Malicious Package in coinstrng",coinstrng,0.0.0,,,CRITICAL,CWE-506,
-GHSA-hjwc-26pj-v3pm,2026-06-18T17:20:55Z,"AgenticMail: Cross-agent task authorization bypass in AgenticMail API",@agenticmail/api,0,0.9.64,,HIGH,CWE-639;CWE-862,
 GHSA-hm63-vwj4-mj2q,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure",openclaw,0,2026.3.22,,MODERATE,CWE-789,
 GHSA-hmfr-rx46-4jx2,2025-08-26T18:42:37Z,"GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation","@escape.tech/graphql-armor-max-depth",0,2.4.2,,MODERATE,CWE-400,
+GHSA-hp3v-mfqw-h74c,2026-07-20T23:24:34Z,"@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped",@astrojs/netlify,0,8.1.2,,LOW,CWE-185,
+GHSA-hp6v-6jw7-gv2f,2026-07-24T21:17:39Z," Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified",@budibase/server,0,,3.38.1,CRITICAL,CWE-287,
 GHSA-hpfq-8wx8-cgqw,2019-06-13T18:59:18Z,"Cross-Site Scripting in ids-enterprise",ids-enterprise,0,4.18.2,,HIGH,CWE-79,
 GHSA-hpr5-wp7c-hh5q,2020-09-01T19:37:29Z,"Cross-Site Scripting in mrk.js",mrk.js,0,2.0.1,,HIGH,CWE-79,
 GHSA-hq75-xg7r-rx6c,2025-07-11T17:09:53Z,"Better Call routing bug can lead to Cache Deception",better-call,0,1.0.12,,MODERATE,CWE-525,
 GHSA-hq8g-qq57-5275,2020-09-11T21:24:33Z,"SQL Injection in untitled-model",untitled-model,0,,,HIGH,CWE-89,
 GHSA-hqf9-8xv5-x8xw,2026-01-05T19:57:46Z,"ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.","@openzeppelin/confidential-contracts",0,0.3.1,,MODERATE,CWE-190,
+GHSA-hr66-5mqr-8mpx,2026-07-24T21:25:00Z," Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint",@budibase/server,0,,3.38.1,HIGH,CWE-200,
 GHSA-hrpp-f84w-xhfg,2020-09-04T16:55:06Z,"Outdated Static Dependency in vue-moment",vue-moment,0,4.1.0,,MODERATE,CWE-1104,
 GHSA-hv4w-jhcj-6wfw,2020-09-03T20:34:23Z,"Cross-Site Scripting in snekserve",snekserve,0.0.0,,,HIGH,CWE-79,
 GHSA-hv7x-3x78-gx53,2026-06-16T18:59:58Z,"n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint",n8n,0,1.123.55,,MODERATE,CWE-284,
@@ -8066,7 +8427,12 @@ GHSA-hv93-r4j3-q65f,2026-02-17T16:43:34Z,"OpenClaw Hook Session Key Override Ena
 GHSA-hvgc-mggg-pxr2,2020-09-03T23:02:33Z,"Malicious Package in js-sha7",js-sha7,0.0.0,,,CRITICAL,CWE-506,
 GHSA-hvqh-jw65-wcpq,2026-06-22T23:00:50Z,"devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs",devbridge-autocomplete,0,2.0.1,,MODERATE,CWE-79,
 GHSA-hvxq-j2r4-4jm8,2020-09-03T20:31:04Z,"Regular Expression Denial of Service in sql-injection",sql-injection,0.0.0,,,HIGH,,
+GHSA-hw9r-h9mr-4jff,2026-07-02T16:06:00Z,"OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
 GHSA-hwh3-fhf6-73x9,2020-09-04T15:36:09Z,"Malicious Package in bictoinjs-lib",bictoinjs-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,0,1.123.67,,MODERATE,CWE-1321,
+GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-1321,
+GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,2.32.0,2.32.1,,MODERATE,CWE-1321,
+GHSA-hx4v-668p-g2qr,2026-05-29T18:31:33Z,"Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity",openclaw,0,2026.5.18,,HIGH,CWE-862,
 GHSA-hx5x-49mm-vmhw,2020-09-03T02:36:43Z,"SQL Injection in sails-mysql",sails-mysql,0,0.10.8,,HIGH,CWE-89,
 GHSA-hx78-272p-mqqh,2020-09-03T19:21:11Z,"Authorization Bypass in graphql-shield",graphql-shield,0,6.0.6,,LOW,CWE-285,
 GHSA-hxcm-v35h-mg2x,2019-06-07T21:12:50Z,"Prototype Pollution in querystringify",querystringify,0,2.0.0,,HIGH,CWE-1321,
@@ -8082,8 +8448,8 @@ GHSA-j425-whc4-4jgc,2026-03-09T19:52:59Z,"OpenClaw's `system.run` env override f
 GHSA-j42q-r6qx-xrfp,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: Google Chat Authz Bypass via Group Policy Rebinding with Mutable Space displayName",openclaw,0,,2026.3.24,LOW,CWE-807,
 GHSA-j44m-5v8f-gc9c,2025-10-10T22:55:09Z,"Flowise is vulnerable to arbitrary file exposure through its ReadFileTool",flowise,0,3.0.8,,HIGH,CWE-22,
 GHSA-j44m-5v8f-gc9c,2025-10-10T22:55:09Z,"Flowise is vulnerable to arbitrary file exposure through its ReadFileTool",flowise-components,0,3.0.8,,HIGH,CWE-22,
+GHSA-j472-gf56-x589,2026-07-02T17:22:52Z,"OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks",openclaw,0,2026.5.12,,HIGH,CWE-184,
 GHSA-j4c5-89f5-f3pm,2026-04-25T23:49:42Z,"OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks",openclaw,0,2026.4.20,,LOW,CWE-918,
-GHSA-j4f3-55x4-r6q2,2026-06-18T14:26:48Z,"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call",praisonai,1.5.0,1.7.2,,CRITICAL,CWE-1188;CWE-306;CWE-862,
 GHSA-j4mr-9xw3-c9jx,2019-05-31T23:47:01Z,"Out-of-bounds Read in base64-url",base64-url,0,2.0.0,,HIGH,CWE-125,
 GHSA-j4vm-hg8g-g9qv,2020-09-03T17:33:50Z,"Malicious Package in antd-cloud",antd-cloud,0.0.0,,,CRITICAL,CWE-506,
 GHSA-j56c-wpqm-h24x,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants",openclaw,0,2026.3.23,,HIGH,CWE-294,
@@ -8092,6 +8458,7 @@ GHSA-j5g3-5c8r-7qfx,2023-08-30T21:24:57Z,"Prevent logging invalid header values"
 GHSA-j5g3-5c8r-7qfx,2023-08-30T21:24:57Z,"Prevent logging invalid header values",apollo-server-core,0,2.26.1,,LOW,,
 GHSA-j5g3-5c8r-7qfx,2023-08-30T21:24:57Z,"Prevent logging invalid header values",apollo-server-core,3.0.0,3.12.1,,LOW,,
 GHSA-j5qh-5234-4rqp,2026-03-31T12:31:35Z,"Duplicate Advisory: OpenClaw: Workspace plugin auto-discovery allowed code execution from cloned repositories",openclaw,0,2026.3.12,,HIGH,CWE-829,
+GHSA-j5qp-p44g-2m49,2026-07-02T19:08:04Z,"@asymmetric-effort/specifyjs: No redirect target validation in secureFetch","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-918,
 GHSA-j67m-jg9p-ppg4,2020-09-03T23:18:05Z,"Malicious Package in ns-sha3",ns-sha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-j6v9-xgvh-f796,2020-09-11T21:11:34Z,"Command Injection in wxchangba",wxchangba,0.0.0,,,MODERATE,CWE-77,
 GHSA-j6x7-42x2-hpcf,2020-09-03T22:14:20Z,"Malicious Package in buffer-xoz",buffer-xoz,0.0.0,,,CRITICAL,CWE-506,
@@ -8101,10 +8468,11 @@ GHSA-j899-348x-h3rq,2020-09-03T19:57:54Z,"Malicious Package in serializes",seria
 GHSA-j8hw-49gg-vq3w,2020-09-03T17:45:41Z,"Malicious Package in retcodelog",retcodelog,0.0.0,,,CRITICAL,CWE-506,
 GHSA-j8qr-rvcv-crhv,2020-09-11T21:18:05Z,"Malicious Package in electron-native-notify",electron-native-notify,0,,,CRITICAL,,
 GHSA-j8r2-2x94-2q67,2020-09-11T21:19:09Z,"Cross-Site Scripting in diagram-js-direct-editing","diagram-js-direct-editing",0,1.4.3,,MODERATE,CWE-79,
+GHSA-j8v8-g9cx-5qf4,2026-07-07T20:57:05Z,"@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers",@better-auth/scim,1.5.0,1.7.0-beta.4,,HIGH,CWE-639;CWE-862,
 GHSA-j95h-wmx9-4279,2021-02-25T17:15:39Z,"Denial of Service",sails,0,0.12.0,,HIGH,,
 GHSA-j965-2qgj-vjmq,2026-01-08T22:04:26Z,"JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3",aws-sdk,2.0.0,,3.0.0,LOW,CWE-20,
-GHSA-j99q-93c9-h869,2026-06-18T14:30:43Z,"MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence",@bitbonsai/mcpvault,0,0.11.4,,MODERATE,CWE-178;CWE-41,
 GHSA-j9f8-8h89-j69x,2019-06-11T16:16:34Z,"Remote Code Execution in node-os-utils",node-os-utils,0,1.1.0,,HIGH,CWE-94,
+GHSA-j9fc-w3mr-x6mv,2026-07-24T21:12:40Z," Budibase: Privilege escalation via public role assignment API missing app-level authorization",@budibase/server,0,,3.38.1,HIGH,CWE-269;CWE-862;CWE-863,
 GHSA-j9pv-rrcj-6pfx,2026-04-02T21:01:57Z,"OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes",openclaw,0,2026.3.31,,MODERATE,CWE-212,
 GHSA-jc5m-wrp2-qq38,2026-03-05T21:58:02Z,"Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint",flowise,0,3.0.13,,MODERATE,CWE-200,
 GHSA-jccr-rrw2-vc8h,2026-03-31T23:56:13Z,"OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure",openclaw,0,2026.3.28,,HIGH,CWE-185;CWE-200,
@@ -8134,14 +8502,19 @@ GHSA-jp99-5h8w-gmxc,2020-09-04T15:03:13Z,"Sandbox Breakout / Arbitrary Code Exec
 GHSA-jp9g-5x75-ccp8,2020-09-02T21:34:30Z,"Malicious Package in colro-name",colro-name,0,,,CRITICAL,CWE-506,
 GHSA-jpvj-wpmj-h7rv,2026-06-04T19:37:04Z,"Supply chain compromise via malicious @cap-js/openapi",@cap-js/openapi,1.4.1,1.4.2,,CRITICAL,CWE-506,
 GHSA-jq4x-98m3-ggq6,2026-03-02T22:32:23Z,"OpenClaw Canvas Path Traversal Information Disclosure Vulnerability",openclaw,0,2026.2.21,,HIGH,CWE-22,
+GHSA-jqh4-m9w3-8hp9,2026-07-20T22:27:12Z,"Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`",axios,1.7.0,1.18.0,,MODERATE,CWE-770,
 GHSA-jqjg-v355-hr9q,2020-09-03T22:11:02Z,"Malicious Package in buffer-xop",buffer-xop,0.0.0,,,CRITICAL,CWE-506,
 GHSA-jqpf-vj28-9v7r,2026-03-19T03:30:57Z,"Duplicate Advisory: Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch",openclaw,2026.2.22,,2026.2.23,HIGH,CWE-863,
 GHSA-jqvv-r4w3-8f7w,2020-09-04T15:35:00Z,"Malicious Package in bictoind-rpc",bictoind-rpc,0.0.0,,,CRITICAL,CWE-506,
+GHSA-jqwr-vx3p-r266,2026-07-22T23:20:03Z,"n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances",n8n,0,1.123.67,,MODERATE,CWE-89,
+GHSA-jqwr-vx3p-r266,2026-07-22T23:20:03Z,"n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-89,
+GHSA-jqwr-vx3p-r266,2026-07-22T23:20:03Z,"n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances",n8n,2.32.0,2.32.1,,MODERATE,CWE-89,
 GHSA-jqx4-9gpq-rppm,2025-05-06T16:44:22Z,"@misskey-dev/summaly allows IP Filter Bypass via Redirect",@misskey-dev/summaly,5.1.0,5.2.1,,MODERATE,CWE-346,
 GHSA-jr6x-2q95-fh2g,2026-03-02T21:59:51Z,"OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools",openclaw,0,2026.3.1,,HIGH,CWE-269;CWE-862,
 GHSA-jrj9-5qp6-2v8q,2020-09-03T23:22:19Z,"Machine-In-The-Middle in airtable",airtable,0.1.19,0.7.2,,HIGH,,
 GHSA-jvcm-f35g-w78p,2026-06-19T21:42:29Z,"Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory",network-ai,0,5.12.2,,MODERATE,CWE-22;CWE-23,
 GHSA-jvfv-jhw9-jmpp,2020-09-03T21:23:09Z,"Malicious Package in b5ffer-xor",b5ffer-xor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-jvm4-4j77-39p6,2026-07-02T16:34:39Z,"OpenClaw: QQBot streaming command could mutate config without explicit allowFrom",openclaw,0,2026.4.29,,HIGH,CWE-863,
 GHSA-jwm3-qcfw-c5pp,2026-06-16T22:39:46Z,"n8n: Python Code Node AST Validator Bypass",n8n,0,2.25.7,,MODERATE,CWE-693,
 GHSA-jwm3-qcfw-c5pp,2026-06-16T22:39:46Z,"n8n: Python Code Node AST Validator Bypass",n8n,2.26.0,2.26.2,,MODERATE,CWE-693,
 GHSA-jx3c-247h-cxwp,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code",openclaw,0,2026.3.31,,HIGH,CWE-829,
@@ -8172,6 +8545,7 @@ GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect A
 GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior",@openzeppelin/contracts,4.3.0,4.4.2,,MODERATE,,
 GHSA-m734-r4g6-34f9,2019-06-04T19:36:17Z,"NoSQL Injection in loopback-connector-mongodb","loopback-connector-mongodb",0,3.6.0,,HIGH,CWE-89,
 GHSA-m794-qv59-gj7c,2020-09-03T17:03:22Z,"Malicious Package in signqle",signqle,0.0.0,,,CRITICAL,CWE-506,
+GHSA-m7jc-p4hf-xhwq,2026-07-22T12:32:17Z,"Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,0,,,HIGH,CWE-917,
 GHSA-m7qm-r2r5-f77q,2020-09-01T20:43:48Z,"Cross-Site Scripting in react-marked-markdown",react-marked-markdown,0.0.0,,,HIGH,CWE-79,
 GHSA-m837-xvxr-vqwg,2026-05-20T15:38:02Z,"Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage",flowise,0,3.1.2,,MODERATE,CWE-942,
 GHSA-m852-866j-69j8,2020-09-01T20:47:01Z,"Malicious Package in eslint-config-airbnb-standard","eslint-config-airbnb-standard",2.0.0,2.1.0,,CRITICAL,CWE-506,
@@ -8201,25 +8575,32 @@ GHSA-mgv2-57vj-99xc,2019-10-07T16:54:24Z,"Low severity vulnerability that affect
 GHSA-mh5c-679w-hh4r,2020-09-03T21:12:01Z,"Denial of Service in mongodb",mongodb,0,3.1.13,,HIGH,,
 GHSA-mh6f-8j2x-4483,2018-11-26T23:58:21Z,"Critical severity vulnerability that affects event-stream and flatmap-stream",event-stream,3.3.6,4.0.0,,CRITICAL,CWE-506,
 GHSA-mh6f-8j2x-4483,2018-11-26T23:58:21Z,"Critical severity vulnerability that affects event-stream and flatmap-stream",flatmap-stream,0,,,CRITICAL,CWE-506,
+GHSA-mhq8-78pj-5j79,2026-07-02T16:05:38Z,"OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion",openclaw,0,2026.5.18,,HIGH,CWE-200;CWE-284;CWE-78,
+GHSA-mhvh-gwhr-76pw,2026-07-22T12:32:18Z,"Duplicate Advisory: Google Service Account Private Key Exposed in JWT Header",n8n,0,,,MODERATE,CWE-312,
 GHSA-mhwj-73qx-jqxm,2026-05-11T16:10:12Z,"@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function","@theecryptochad/merge-guard",0,1.0.1,,HIGH,CWE-1321,
 GHSA-mhxg-pr3j-v9gr,2020-09-03T19:41:22Z,"Malicious Package in colne",colne,0.0.0,,,CRITICAL,CWE-506,
 GHSA-mj4p-rc52-m843,2026-03-13T15:48:16Z,"OpenClaw: Sandbox staged writes could escape the verified parent directory before commit",openclaw,0,2026.3.11,,HIGH,CWE-367;CWE-59,
 GHSA-mjjq-c88q-qhr6,2020-09-03T21:22:00Z,"Cross-Site Scripting in dompurify",dompurify,0,2.0.7,,CRITICAL,CWE-79,
 GHSA-mmph-wp49-r48h,2020-09-02T20:20:26Z,"Malicious Package in experss",experss,0,,,CRITICAL,CWE-506,
 GHSA-mmqv-m45h-q2hp,2020-09-04T15:22:40Z,"Sandbox Breakout / Arbitrary Code Execution in localeval",localeval,0,15.3.0,,CRITICAL,,
+GHSA-mmx7-hfxf-jppx,2026-07-20T22:25:07Z,"Axios: Prototype pollution gadgets can alter axios request construction",axios,0,0.33.0,,MODERATE,CWE-1321,
+GHSA-mmx7-hfxf-jppx,2026-07-20T22:25:07Z,"Axios: Prototype pollution gadgets can alter axios request construction",axios,1.0.0,1.18.0,,MODERATE,CWE-1321,
 GHSA-mp55-2274-4pj8,2020-09-03T21:54:09Z,"Malicious Package in buffer-xgr",buffer-xgr,0.0.0,,,CRITICAL,CWE-506,
 GHSA-mpcx-8qqw-rmcq,2020-08-19T21:51:20Z,"SQL Injection in waterline-sequel",waterline-sequel,0,0.5.1,,HIGH,,
 GHSA-mph8-9v29-pm42,2026-05-06T23:16:24Z,"axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification",@axonflow/sdk,0,6.0.0,,MODERATE,CWE-345;CWE-347,
 GHSA-mpjf-8cmf-p789,2020-09-01T21:25:46Z,"Cross-Site Scripting in jingo",jingo,0,1.9.2,,HIGH,CWE-79,
 GHSA-mq6v-w35g-3c97,2024-02-03T00:37:56Z,"Local File Inclusion vulnerability in zmarkdown",zmarkdown,0,10.1.3,,LOW,,
 GHSA-mq9h-cwc2-6j5r,2020-09-03T17:42:27Z,"Malicious Package in midway-dataproxy",midway-dataproxy,0.0.0,,,CRITICAL,CWE-506,
+GHSA-mqhr-6j6h-74p5,2026-07-24T21:22:51Z," Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak ",@budibase/server,0,,3.38.1,CRITICAL,CWE-200,
 GHSA-mrr8-v49w-3333,2023-07-10T19:08:10Z,"sweetalert2 contains potentially undesirable behavior",sweetalert2,11.6.14,11.22.4,,LOW,CWE-440,
 GHSA-mrvx-jmjw-vggc,2026-06-19T21:42:46Z," SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`",mcp-searxng,0,1.7.1,,HIGH,CWE-918,
 GHSA-mvch-rh6h-2m47,2020-09-11T21:10:29Z,"Malicious Package in equest",equest,0,,,CRITICAL,CWE-506,
 GHSA-mvrp-3cvx-c325,2023-10-04T14:46:06Z,"Zod denial of service vulnerability during email validation",express-zod-api,0,10.0.0-beta1,,HIGH,CWE-1333,
 GHSA-mvw6-62qv-vmqf,2025-07-25T06:30:30Z,"Duplicate Advisory: Koa Open Redirect via Referrer Header (User-Controlled)",koa,0,3.0.1,,LOW,CWE-601,
 GHSA-mw7w-g3mg-xqm7,2026-03-27T22:32:06Z,"OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events",openclaw,0,,2026.3.24,MODERATE,CWE-288;CWE-863,
+GHSA-mwf2-3pr3-8698,2026-07-20T22:37:03Z,"Axios: HTTP/2 streamed uploads bypass `maxBodyLength`",axios,1.13.0,1.18.0,,MODERATE,CWE-400,
 GHSA-mwp6-j9wf-968c,2019-09-13T21:33:25Z,"Critical severity vulnerability that affects generator-jhipster",generator-jhipster,0,6.3.0,,CRITICAL,CWE-338,
+GHSA-mwq7-vcmc-cm4q,2026-07-22T12:32:17Z,"Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",n8n,0,,,HIGH,CWE-639,
 GHSA-mwv6-3258-q52c,2025-12-11T22:49:27Z,"Next Vulnerable to Denial of Service with Server Components",next,13.3.0,14.2.34,,HIGH,CWE-1395;CWE-400;CWE-502,
 GHSA-mwv6-3258-q52c,2025-12-11T22:49:27Z,"Next Vulnerable to Denial of Service with Server Components",next,15.0.0-canary.0,15.0.6,,HIGH,CWE-1395;CWE-400;CWE-502,
 GHSA-mwv6-3258-q52c,2025-12-11T22:49:27Z,"Next Vulnerable to Denial of Service with Server Components",next,15.1.1-canary.0,15.1.10,,HIGH,CWE-1395;CWE-400;CWE-502,
@@ -8236,6 +8617,8 @@ GHSA-mxjx-28vx-xjjj,2026-06-19T21:42:32Z,"Network-AI: ApprovalInbox HTTP server
 GHSA-mxmg-3p7m-2ghr,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw: system.run approval identity mismatch could execute a different binary than displayed",openclaw,0,,2026.2.24,MODERATE,CWE-436,
 GHSA-mxmj-84q8-34r7,2020-09-03T02:39:49Z,"Command Injection in expressfs",expressfs,0,,,HIGH,CWE-77,
 GHSA-mxq6-vrrr-ppmg,2022-05-24T17:04:00Z,"Duplicate Advisory: tree-kill vulnerable to remote code execution",tree-kill,0,,1.2.1,CRITICAL,CWE-94,
+GHSA-p2fh-f5fc-44hr,2026-07-02T16:18:02Z,"OpenClaw: memory-wiki ingest could read local files with operator.write scope",openclaw,0,2026.5.12,,MODERATE,CWE-732,
+GHSA-p2fr-6hmx-4528,2026-07-07T20:54:32Z,"@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators","@better-auth/oauth-provider",1.4.8,1.7.0-beta.4,,MODERATE,CWE-285;CWE-863,
 GHSA-p33q-w45h-2hcj,2020-09-02T18:30:03Z,"Malicious Package in 4equest",4equest,0,,,CRITICAL,CWE-506,
 GHSA-p3h2-2j4p-p83g,2026-04-22T20:50:19Z,"MCPHub has Path Traversal via Malicious MCPB Manifest Name",@samanhappy/mcphub,0,0.12.13,,HIGH,CWE-22,
 GHSA-p3jx-g34v-q56j,2020-09-03T22:54:02Z,"Malicious Package in j3-sha3",j3-sha3,0.0.0,,,CRITICAL,CWE-506,
@@ -8247,10 +8630,13 @@ GHSA-p4mf-4qvh-w8g5,2020-09-04T15:41:42Z,"Malicious Package in bitcionjslib",bit
 GHSA-p56r-jr4p-4wgh,2020-08-03T18:16:37Z,Withdrawn,whereis,0,0.4.1,,HIGH,,
 GHSA-p5p2-rhc3-wmf3,2020-09-03T17:03:31Z,"Malicious Package in siganle",siganle,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p62r-jf56-h429,2020-09-03T20:29:58Z,"Malicious Package in evil-package",evil-package,0.0.0,,,CRITICAL,CWE-506,
-GHSA-p69m-4f92-2v84,2026-06-18T14:26:37Z,"PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool",praisonai,0,1.7.2,,CRITICAL,CWE-94,
+GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,0,3.2.7,,CRITICAL,CWE-22;CWE-552;CWE-862,
+GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,4.0.0,4.1.10,,CRITICAL,CWE-22;CWE-552;CWE-862,
+GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,5.0.0-beta.1,5.0.0-beta.6,,CRITICAL,CWE-22;CWE-552;CWE-862,
 GHSA-p6gq-j5cr-w38f,2026-06-18T14:28:05Z,"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message",nodemailer,0,9.0.1,,HIGH,CWE-73;CWE-918,
 GHSA-p6j4-wvmc-vx2h,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete",openclaw,0,2026.3.22,,MODERATE,CWE-696,
 GHSA-p72p-rjr2-r439,2019-05-29T20:24:02Z,"Server-Side Request Forgery in terriajs-server",terriajs-server,0,2.7.4,,HIGH,CWE-918,
+GHSA-p73f-w79w-jqr5,2026-07-02T17:23:43Z,"OpenClaw: Native command authorization could skip owner-command enforcement",openclaw,0,2026.5.6,,HIGH,CWE-863,
 GHSA-p77h-hv6g-fmfp,2020-09-03T20:43:16Z,"Sensitive Data Exposure in ibm_db",ibm_db,0,2.6.0,,MODERATE,,
 GHSA-p7j5-4mwm-hv86,2021-05-06T17:28:14Z,"Duplicate Advisory: Cross-site scripting in TinyMCE",tinymce,0,4.9.7,,MODERATE,CWE-79,
 GHSA-p7j5-4mwm-hv86,2021-05-06T17:28:14Z,"Duplicate Advisory: Cross-site scripting in TinyMCE",tinymce,5.0.0,5.1.4,,MODERATE,CWE-79,
@@ -8262,6 +8648,8 @@ GHSA-p9g3-vpvp-hcj5,2020-09-03T21:41:55Z,"Malicious Package in bufber-xor",bufbe
 GHSA-p9vv-3945-x93h,2020-09-02T15:47:10Z,"Cross-Site Scripting in semantic-ui-search",semantic-ui-search,0,,,HIGH,CWE-79,
 GHSA-pc5p-h8pf-mvwp,2020-04-16T03:14:56Z,"Machine-In-The-Middle in https-proxy-agent",https-proxy-agent,0,2.2.3,,MODERATE,CWE-300,
 GHSA-pc7q-c837-3wjq,2020-09-03T17:02:58Z,"Malicious Package in wallet-address-validtaor",wallet-address-validtaor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-pf2q-pxhf-hgmw,2026-07-22T22:13:36Z,"n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory",n8n,0,2.31.5,,MODERATE,CWE-22,
+GHSA-pf2q-pxhf-hgmw,2026-07-22T22:13:36Z,"n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory",n8n,2.32.0,2.32.1,,MODERATE,CWE-22,
 GHSA-pf56-h9qf-rxq4,2024-10-07T15:14:40Z,"Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page",@saltcorn/server,0,1.0.0-beta.16,,MODERATE,CWE-79,
 GHSA-pfq2-hh62-7m96,2026-01-13T19:54:29Z,"Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`",renovate,32.124.0,42.68.5,,MODERATE,CWE-78,
 GHSA-pfv5-rpcw-x34x,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution",openclaw,0,,,HIGH,CWE-78,
@@ -8277,10 +8665,15 @@ GHSA-phgf-3849-rgjq,2026-03-31T12:31:35Z,"Duplicate Advisory: OpenClaw: Plugin s
 GHSA-phph-xpj4-wvcv,2020-09-03T21:13:07Z,"Cross-Site Scripting in hexo-admin",hexo-admin,0.0.0,,,HIGH,CWE-79,
 GHSA-pj97-j597-ppm7,2020-09-02T21:15:22Z,"Malicious Package in rqeuest",rqeuest,0,,,CRITICAL,CWE-506,
 GHSA-pjvx-rx66-r3fg,2026-03-09T19:54:08Z,"OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping",openclaw,0,2026.3.7,,MODERATE,CWE-639;CWE-863,
+GHSA-pm4m-ph32-ghv5,2026-07-24T16:47:36Z,"js-yaml: Exponential parsing time in flow collections leads to denial of service",js-yaml,5.0.0,5.2.2,,HIGH,CWE-407,
 GHSA-pm52-wwrw-c282,2019-06-13T18:59:06Z,"Command Injection in wiki-plugin-datalog",wiki-plugin-datalog,0,0.1.6,,HIGH,CWE-94,
 GHSA-pm9v-325f-5g74,2020-09-02T21:30:11Z,"Malicious Package in saync",saync,0,,,CRITICAL,CWE-506,
 GHSA-pmf3-2q63-jmp6,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)",openclaw,0,,2026.2.22,MODERATE,CWE-61,
 GHSA-pmgv-94f5-6w7w,2020-09-02T20:21:30Z,"Malicious Package in eact",eact,0,,,CRITICAL,CWE-506,
+GHSA-pmpg-2mxq-6xwr,2026-07-24T21:43:34Z," Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete",@budibase/server,0,,3.38.1,HIGH,CWE-89,
+GHSA-pmv8-rq9r-6j72,2026-07-20T17:48:18Z,"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",axios,0.28.0,0.33.0,,MODERATE,CWE-400;CWE-770,
+GHSA-pmv8-rq9r-6j72,2026-07-20T17:48:18Z,"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",axios,1.0.0,1.18.0,,MODERATE,CWE-400;CWE-770,
+GHSA-ppr4-5f46-j9c6,2026-07-24T21:16:41Z," Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile",@budibase/server,0,,3.38.1,HIGH,CWE-209,
 GHSA-ppwq-6v66-5m6j,2026-03-26T21:15:59Z,"OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status",openclaw,0,2026.3.22,,MODERATE,CWE-200;CWE-212;CWE-522,
 GHSA-pqhp-25j4-6hq9,2024-11-22T20:40:49Z,"smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables",smol-toml,0,1.3.1,,MODERATE,CWE-674,
 GHSA-pqhr-mp3f-hrpp,2026-03-31T23:26:29Z,"Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters",nuxt-og-image,0,6.2.5,,MODERATE,CWE-918,
@@ -8288,6 +8681,7 @@ GHSA-pqpp-2363-649v,2020-09-02T18:22:30Z,"Cross-Site Scripting in buttle",buttle
 GHSA-pr66-whqj-rq5p,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message",openclaw,0,2026.3.31,,LOW,CWE-351,
 GHSA-prmc-5v5w-c465,2021-04-06T17:32:38Z,"Client TLS credentials sent raw to server in npm package nats",nats,2.0.0-201,2.0.0-209,,CRITICAL,CWE-522,
 GHSA-pv6r-vchh-cxg9,2020-09-03T20:42:09Z,"Denial of Service in apostrophe",apostrophe,0,2.97.1,,LOW,CWE-400,
+GHSA-pvcr-8mvp-w8qr,2026-07-24T21:42:51Z," Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)",@budibase/server,0,,3.38.1,HIGH,CWE-285;CWE-345;CWE-352,
 GHSA-pxmp-fwjc-4x7q,2020-09-03T15:45:23Z,"HTML Injection in marky-markdown",marky-markdown,0.0.0,,,MODERATE,CWE-79,
 GHSA-pxqp-mv67-g528,2020-09-03T21:38:34Z,"Malicious Package in bqffer-xor",bqffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-q2c6-c6pm-g3gh,2020-09-04T15:07:38Z,"Arbitrary Code Execution in handlebars",handlebars,0,3.0.8,,HIGH,,
@@ -8310,10 +8704,14 @@ GHSA-q4gf-8mx6-v5v3,2026-04-10T15:35:47Z,"Next.js has a Denial of Service with S
 GHSA-q4h9-46xg-m3x9,2021-09-15T20:22:13Z,"UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable","@openzeppelin/contracts-upgradeable",4.1.0,4.3.2,,CRITICAL,,
 GHSA-q4pp-j36h-3gqg,2023-08-24T12:53:06Z,"Minimal `basti` IAM Policy Allows Shell Access",basti-cdk,0,1.0.1,,LOW,,
 GHSA-q4xx-mc3q-23x8,2025-08-14T12:30:22Z,"Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection",flowise,0,,3.0.5,CRITICAL,CWE-94,
+GHSA-q53c-4prm-w95q,2026-07-24T22:34:39Z,"Shescape: Home-directory disclosure in assignment context on Unix with Dash",shescape,0,2.1.14,,MODERATE,CWE-116;CWE-200,
+GHSA-q53c-4prm-w95q,2026-07-24T22:34:39Z,"Shescape: Home-directory disclosure in assignment context on Unix with Dash",shescape,3.0.0,3.0.1,,MODERATE,CWE-116;CWE-200,
 GHSA-q5pp-5q2h-g8rv,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,,,MODERATE,CWE-79,
 GHSA-q5pr-72pq-83v3,2026-03-23T21:44:55Z,"H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,2.0.1-rc.18,,MODERATE,CWE-400,
 GHSA-q643-w9jp-q2qg,2020-09-04T17:34:59Z,"Hardcoded Initialization Vector in parsel",parsel,0.0.0,,,HIGH,,
 GHSA-q67q-549q-p849,2025-09-15T20:11:39Z,"Flowise has arbitrary file access due to missing chat flow id validation",flowise,2.2.8,3.0.6,,CRITICAL,CWE-22,
+GHSA-q6mx-qvhp-fqmg,2026-07-15T12:32:03Z,"Duplicate Advisory: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,0,,,MODERATE,CWE-639,
+GHSA-q6x4-v3qx-85qw,2026-07-24T21:15:02Z," Budibase: SQL Injection via `multipleStatements: true`",@budibase/server,0,,3.38.1,CRITICAL,CWE-89,
 GHSA-q7jf-gf43-6x6p,2025-10-24T19:15:13Z,"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,4.10.3,,MODERATE,CWE-444,
 GHSA-q83v-hq3j-4pq3,2024-08-15T06:32:22Z,"Duplicate Advisory: Improper access control in Directus",directus,0,,10.13.0,MODERATE,CWE-639,
 GHSA-q849-wxrc-vqrp,2024-12-02T20:11:39Z,"hull.js Code Injection Vulnerability",hull.js,0.2.2,1.0.10,,CRITICAL,CWE-94,
@@ -8328,11 +8726,13 @@ GHSA-qcc4-p59m-p54m,2026-03-12T14:21:54Z,"OpenClaw: Sandbox dangling-symlink ali
 GHSA-qcc9-q247-3m2m,2020-09-03T19:46:49Z,"Malicious Package in js-regular",js-regular,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qccf-q7p4-3q3j,2020-09-04T15:16:42Z,"Prototype Pollution in safe-object2",safe-object2,0.0.0,,,HIGH,CWE-1321,
 GHSA-qcff-ffx3-m25c,2020-09-04T17:31:44Z,"Command Injection in meta-git",meta-git,0.0.0,,,CRITICAL,CWE-77,
+GHSA-qcr8-x557-7cp3,2026-07-02T19:03:10Z,"@asymmetric-effort/specifyjs: Production console warnings may leak internal framework state","@asymmetric-effort/specifyjs",0,0.2.140,,MODERATE,CWE-209,
 GHSA-qf6h-p3mr-vmh5,2024-08-15T03:30:28Z,"Duplicate Advisory: Code injection in Directus",directus,0,,10.13.0,MODERATE,CWE-79,
 GHSA-qfc9-x7gv-27jr,2020-09-03T18:12:36Z,"Malicious Package in deasyncp",deasyncp,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qfmr-6qvh-49gm,2021-02-25T01:44:38Z,XSS,knockout,0,3.5.0,,MODERATE,,
 GHSA-qgp3-3rj7-qqq4,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Discord Slash Commands Bypass Group DM Channel Allowlist",openclaw,0,2026.3.31,,LOW,CWE-863,
 GHSA-qgx9-6px9-7p75,2026-04-23T18:33:04Z,"Duplicate Advisory: OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization",openclaw,0,2026.4.20,,LOW,CWE-863,
+GHSA-qh2f-99mv-mrcf,2026-07-02T15:42:42Z,"OpenClaw: Bundle MCP loopback could miss its exec denylist on session spawn",openclaw,0,2026.5.12,,MODERATE,CWE-284;CWE-78,
 GHSA-qhh4-458h-xwh2,2026-05-08T20:06:00Z,"@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry",@cyclonedx/cdxgen,9.9.5,12.3.3,,MODERATE,CWE-346;CWE-522,
 GHSA-qhrr-grqp-6x2g,2026-03-03T19:50:45Z,"OpenClaw's tools.exec.safeBins trusted PATH directories allowed binary shadowing in allowlist mode",openclaw,0,2026.2.22,,MODERATE,CWE-426,
 GHSA-qhwp-454g-2gv4,2025-09-15T00:30:15Z,"Duplicate Advisory: express-xss-sanitizer has an unbounded recursion depth",express-xss-sanitizer,0,,2.0.0,MODERATE,CWE-674,
@@ -8343,6 +8743,7 @@ GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via ma
 GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency",@metamask/sdk,0.16.0,0.33.1,,MODERATE,CWE-506,
 GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency",@metamask/sdk-react,0.16.0,0.33.1,,MODERATE,CWE-506,
 GHSA-qjfh-xc44-rm9x,2020-09-03T16:49:43Z,"Path Traversal in file-static-server",file-static-server,0.0.0,,,HIGH,CWE-22,
+GHSA-qjpc-qf9m-xwmr,2026-07-02T16:43:53Z,"OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
 GHSA-qm4q-f956-fg64,2020-09-03T17:39:13Z,"Malicious Package in luna-mock",luna-mock,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,2.0.0,2.25.3,,HIGH,CWE-79,
 GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,3.0.0,3.4.1,,HIGH,CWE-79,
@@ -8357,6 +8758,8 @@ GHSA-qpw2-xchm-655q,2022-01-06T20:31:01Z,"Out-of-Bounds read in stringstream",st
 GHSA-qq4x-c6h6-rfxh,2025-03-31T22:37:42Z,"aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct",aws-cdk-lib,2.37.0,2.187.0,,MODERATE,,
 GHSA-qq6h-5g6j-q3cm,2022-11-23T15:26:43Z,"sweetalert2 v11.4.9 and above contains hidden functionality",sweetalert2,11.4.9,11.22.4,,LOW,CWE-912,
 GHSA-qq9g-96v4-m3cj,2026-03-18T16:10:16Z,"Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas",@pdfme/schemas,0,5.5.9,,MODERATE,CWE-79,
+GHSA-qq9h-g4jm-xgf3,2026-07-24T15:44:01Z,"Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in",better-auth,1.1.3,1.6.22,,HIGH,CWE-287;CWE-345,
+GHSA-qq9h-g4jm-xgf3,2026-07-24T15:44:01Z,"Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in",better-auth,1.7.0-beta.0,1.7.0-beta.10,,HIGH,CWE-287;CWE-345,
 GHSA-qqf5-x7mj-v43p,2026-06-18T17:24:47Z,"budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL",budibase,0,3.39.19,,HIGH,CWE-89,
 GHSA-qr2g-p6q7-w82m,2026-03-07T02:37:47Z,"x402 SDK Security Advisory",@x402/svm,0,2.6.0,,HIGH,,
 GHSA-qrg3-f6h6-vq8q,2020-08-19T22:15:57Z,"Denial of Service in https-proxy-agent",https-proxy-agent,0,2.2.0,,HIGH,,
@@ -8369,10 +8772,14 @@ GHSA-qrv3-253h-g69c,2026-06-27T00:13:18Z,"pnpm: Path traversal in configDependen
 GHSA-qv2g-99x4-45x6,2021-01-29T18:12:07Z,"Malicious npm package: discord-fix",discord-fix,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qv78-398w-cxp7,2020-09-11T21:08:19Z,"Malicious Package in shrugging-logging",shrugging-logging,0,,,CRITICAL,CWE-506,
 GHSA-qvmw-h675-h7qg,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard",openclaw,0,2026.4.22,,MODERATE,CWE-918,
+GHSA-qw6m-8fw2-2v64,2026-07-24T21:25:51Z," Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution",@budibase/server,0,,3.38.1,HIGH,CWE-943,
 GHSA-qwmf-95r9-gx9x,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes",openclaw,0,,,HIGH,CWE-290,
+GHSA-qwww-vcr4-c8h2,2026-07-24T16:44:43Z,"React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response",react-router,7.12.0,8.3.0,,HIGH,CWE-352,
 GHSA-qx4v-6gc5-f2vv,2019-06-20T14:32:56Z,"Regular Expression Denial of Service",esm,0,3.1.0,,MODERATE,CWE-400,
 GHSA-qxrj-x7rm-2h49,2020-09-03T17:05:59Z,"Malicious Package in dhkey",dhkey,0.0.0,,,CRITICAL,CWE-506,
 GHSA-r27j-894h-3w3p,2026-05-06T17:32:01Z,"mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`",icu-minify,0,4.9.2,,LOW,CWE-1321,
+GHSA-r28c-9q8g-f849,2026-07-24T16:24:55Z,"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",postcss,0,8.5.18,,HIGH,CWE-22,
+GHSA-r292-9mhp-454m,2026-07-24T16:26:16Z,"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection",tar,0,7.5.21,,MODERATE,CWE-400;CWE-674,
 GHSA-r294-2894-92j3,2026-03-03T22:09:26Z,"OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering",openclaw,0,2026.2.23,,MODERATE,CWE-79,
 GHSA-r2c6-8jc8-g32w,2026-02-02T00:30:23Z,"Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl",clawdbot,0,2026.1.29,,HIGH,CWE-669,
 GHSA-r2fx-hp6p-pgrm,2026-06-16T21:31:59Z,"Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state",openclaw,0,,2026.4.24,MODERATE,CWE-863,
@@ -8421,13 +8828,19 @@ GHSA-rc4v-99cr-pjcm,2023-10-17T14:21:16Z,"Prototype Pollution in ali-security/mo
 GHSA-rc8f-r29c-chr6,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing",openclaw,0,,2026.3.24,MODERATE,CWE-307,
 GHSA-rch7-f4h5-x9rj,2019-08-23T00:04:52Z,"Identity Spoofing in libp2p-secio",libp2p-secio,0,0.9.0,,CRITICAL,CWE-290,
 GHSA-rchv-x836-w7xp,2026-03-09T19:52:29Z,"OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage",openclaw,0,2026.3.7,,HIGH,CWE-200,
+GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,0,1.123.67,,HIGH,CWE-78,
+GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-78,
+GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,2.32.0,2.32.1,,HIGH,CWE-78,
 GHSA-rcv7-4w2m-gj9v,2020-09-03T23:24:26Z,"Malicious Package in sj-tw-test-security",sj-tw-test-security,0.0.0,,,CRITICAL,CWE-506,
 GHSA-rcx4-77x4-hjx5,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata",openclaw,0,,2026.2.22-2,MODERATE,CWE-807,
 GHSA-rf75-g96h-j3rm,2026-04-02T21:32:52Z,"Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation",openclaw,0,2026.4.2,,MODERATE,CWE-184,
 GHSA-rffp-mc78-wjf7,2020-09-02T18:26:48Z,"Command Injection in cocos-utils",cocos-utils,0,,,HIGH,CWE-77,
+GHSA-rggc-m335-3wvj,2026-07-02T16:03:10Z,"OpenClaw: Same-host trusted-proxy deployments could accept local forged identity headers",openclaw,0,2026.5.18,,HIGH,"CWE-269;CWE-284;CWE-287;CWE-290;CWE-863",
 GHSA-rggq-f2wf-m6cp,2020-09-02T18:31:08Z,"Malicious Package in jajajejejiji",jajajejejiji,0,,,CRITICAL,CWE-506,
 GHSA-rhc3-76jw-4f2x,2020-09-04T17:58:46Z,"Denial of Service in @commercial/ammo",@commercial/ammo,0,2.1.1,,HIGH,,
 GHSA-rj39-33v7-9xrq,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)",openclaw,0,,,HIGH,CWE-78,
+GHSA-rjg6-39jm-rgg4,2026-07-24T15:40:54Z,"@better-auth/scim: account takeover and stale access via SCIM provider-id collision",@better-auth/scim,1.4.0-beta.27,1.6.22,,CRITICAL,CWE-20;CWE-639;CWE-862,
+GHSA-rjg6-39jm-rgg4,2026-07-24T15:40:54Z,"@better-auth/scim: account takeover and stale access via SCIM provider-id collision",@better-auth/scim,1.7.0-beta.0,1.7.0-beta.10,,CRITICAL,CWE-20;CWE-639;CWE-862,
 GHSA-rjhc-w3fj-j6x9,2020-09-03T17:32:45Z,"Malicious Package in alipayjsapi",alipayjsapi,0.0.0,,,CRITICAL,CWE-506,
 GHSA-rjvj-673q-4hfw,2020-09-04T17:54:31Z,"Command Injection in traceroute",traceroute,0.0.0,,,CRITICAL,CWE-77,
 GHSA-rm5c-4rmf-vvhw,2026-04-03T03:01:57Z,"OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses",openclaw,0,2026.3.31,,MODERATE,CWE-367,
@@ -8454,6 +8867,7 @@ GHSA-v3f4-w7r7-v3hm,2026-06-19T21:43:09Z,"Uni-CLI: Legacy HTTP MCP transport acc
 GHSA-v3qc-wrwx-j3pw,2026-04-03T03:03:18Z,"OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`",openclaw,0,2026.3.28,,HIGH,CWE-285,
 GHSA-v3rj-xjv7-4jmq,2026-03-25T21:03:56Z,"smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines",smol-toml,0,1.6.1,,MODERATE,CWE-674,
 GHSA-v3wr-67px-44xg,2022-03-03T19:11:14Z,"Execution with Unnecessary Privileges in arc-electron","@advanced-rest-client/base",0,0.1.10,,HIGH,,
+GHSA-v42f-v8xc-j435,2026-07-24T21:44:27Z,"Budibase: SSRF via DNS rebinding in the REST datasource integration",@budibase/server,0,,3.38.1,HIGH,CWE-367;CWE-918,
 GHSA-v457-wxvj-p9w9,2026-04-10T15:36:00Z,"@vitejs/plugin-rsc has a Denial of Service with React Server Components",@vitejs/plugin-rsc,0,0.5.23,,HIGH,CWE-400,
 GHSA-v45m-2wcp-gg98,2020-09-04T17:18:44Z,"Global node_modules Binary Overwrite in bin-links",bin-links,0,1.1.6,,LOW,,
 GHSA-v4x8-gw49-7hv4,2020-09-03T20:37:42Z,"Path Traversal in swagger-injector",swagger-injector,0.0.0,,,CRITICAL,CWE-22,
@@ -8482,14 +8896,18 @@ GHSA-vf5m-q45w-8mh9,2020-09-03T23:00:25Z,"Malicious Package in js-qha3",js-qha3,
 GHSA-vf8q-pw7h-r2x2,2020-09-11T21:15:54Z,"Malicious Package in epress",epress,0,,,CRITICAL,CWE-506,
 GHSA-vg44-fw64-cpjx,2020-03-24T15:08:59Z,"Incorrect Account Used for Signing","@metamask/eth-ledger-bridge-keyring",0,0.2.2,,HIGH,CWE-287,
 GHSA-vg44-fw64-cpjx,2020-03-24T15:08:59Z,"Incorrect Account Used for Signing","eth-ledger-bridge-keyring",0,0.2.1,,HIGH,CWE-287,
+GHSA-vh45-f885-3848,2026-07-24T21:50:45Z,"sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock",sm-crypto,0,0.5.0,,CRITICAL,CWE-338,
 GHSA-vh4c-j2xv-9pv9,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)",openclaw,0,,,MODERATE,CWE-306,
 GHSA-vh4h-fvqf-q9wv,2025-05-01T03:31:17Z,"Duplicate Advisory: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack","@cloudflare/workers-oauth-provider",0,0.0.5,,MODERATE,CWE-287,
 GHSA-vh5j-5fhq-9xwg,2025-06-27T22:06:48Z,"Taylor has race condition in /get-patch that allows purchase token replay",taylored,0,8.1.3,,LOW,CWE-362,
+GHSA-vhcw-f978-xjjg,2026-07-22T12:32:18Z,"Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview",n8n,0,,,HIGH,CWE-79,
+GHSA-vhf8-cg2h-cg3p,2026-07-22T22:07:04Z,"n8n: SSRF Protection Bypass via MCP Client Node",n8n,0,2.31.5,,MODERATE,CWE-918,
+GHSA-vhf8-cg2h-cg3p,2026-07-22T22:07:04Z,"n8n: SSRF Protection Bypass via MCP Client Node",n8n,2.32.0,2.32.1,,MODERATE,CWE-918,
 GHSA-vj2p-7pgw-g2wf,2026-03-27T15:46:53Z,"Postiz App has a High-Severity SSRF Vulnerability via Next.js",postiz,0,,2.0.12,HIGH,CWE-1395;CWE-918,
+GHSA-vjc7-jrh9-9j86,2026-07-06T21:22:10Z,"9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats",9router,0,,0.4.41,CRITICAL,CWE-200;CWE-306;CWE-862,
 GHSA-vjf3-2gpj-233v,2026-02-26T22:45:13Z,"n8n has an SSO Enforcement Bypass in its Self-Service Settings API",n8n,0,2.8.0,,MODERATE,CWE-269;CWE-284;CWE-287,
 GHSA-vjh7-7g9h-fjfh,2025-02-12T19:47:52Z,"Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)",elliptic,0,6.6.1,,CRITICAL,CWE-200,
 GHSA-vjqw-w5jr-g9w5,2026-03-29T15:30:19Z,"Duplicate Advisory: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured",openclaw,0,2026.3.12,,HIGH,CWE-347,
-GHSA-vjv9-7m7j-h833,2026-06-18T14:26:34Z,"npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining",praisonai,1.2.3,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
 GHSA-vjvw-wcmw-pr26,2020-09-04T17:37:08Z,"Insufficient Entropy in parsel",parsel,0.0.0,,,CRITICAL,CWE-331,
 GHSA-vm29-7mq3-9jrg,2026-03-31T12:31:35Z,"Duplicate Advisory: OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode",OpenClaw,0,2026.3.11,,LOW,CWE-636,
 GHSA-vm67-mh96-95mq,2020-09-03T21:40:48Z,"Malicious Package in bubfer-xor",bubfer-xor,0.0.0,,,CRITICAL,CWE-506,
@@ -8498,7 +8916,6 @@ GHSA-vm7j-4rj6-mw2p,2020-09-03T21:08:42Z,"Malicious Package in ember_cli_babe",e
 GHSA-vmh4-322v-cfpc,2020-09-03T18:18:06Z,"Cross-Site Scripting in cmmn-js-properties-panel",cmmn-js-properties-panel,0,0.8.0,,HIGH,CWE-79,
 GHSA-vmhq-cqm9-6p7q,2026-03-13T20:54:25Z,"OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes",openclaw,0,2026.3.11,,HIGH,CWE-863,
 GHSA-vmhw-fhj6-m3g5,2019-05-31T23:46:33Z,"Path Traversal in angular-http-server",angular-http-server,0,1.4.4,,HIGH,CWE-22,
-GHSA-vmmj-pfw7-fjwp,2026-06-18T14:26:32Z,"npm PraisonAI codeMode sandbox escape via Function constructor",praisonai,1.4.0,1.7.2,,CRITICAL,CWE-184;CWE-693,
 GHSA-vp58-j275-797x,2025-02-24T20:49:50Z,"Better Auth allows bypassing the trustedOrigins Protection which leads to ATO",better-auth,0,1.1.21,,HIGH,CWE-601,
 GHSA-vp93-gcx5-4w52,2020-09-11T21:21:19Z,"Cross-Site Scripting in swagger-ui",swagger-ui,0,2.2.1,,MODERATE,CWE-79,
 GHSA-vpgc-7h78-gx8f,2020-09-04T18:05:14Z,"personnummer/js vulnerable to Improper Input Validation",personnummer,0,3.1.0,,LOW,,
@@ -8513,6 +8930,8 @@ GHSA-vrhm-gvg7-fpcf,2026-02-19T20:29:42Z," Memory exhaustion in SvelteKit remote
 GHSA-vrqm-gvq7-rrwh,2026-03-20T20:44:52Z,"PDFME Affected by Decompression Bomb in FlateDecode Stream Parsing Causes Memory Exhaustion DoS",@pdfme/pdf-lib,0,5.5.10,,MODERATE,CWE-409,
 GHSA-vrxj-4qhw-5vwq,2020-09-03T17:03:41Z,"Malicious Package in scryptys",scryptys,0.0.0,,,CRITICAL,CWE-506,
 GHSA-vv52-3mrp-455m,2020-09-03T15:53:36Z,"Malicious Package in m-backdoor",m-backdoor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-vv65-f55v-xm6g,2026-07-02T19:16:57Z,"Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)",@grackle-ai/powerline,0,,0.132.1,HIGH,CWE-78;CWE-88,
+GHSA-vv65-f55v-xm6g,2026-07-02T19:16:57Z,"Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)",@grackle-ai/runtime-sdk,0,,0.132.1,HIGH,CWE-78;CWE-88,
 GHSA-vv7g-pjw9-4qj9,2020-09-03T17:03:56Z,"Malicious Package in scrytsy",scrytsy,0.0.0,,,CRITICAL,CWE-506,
 GHSA-vvfh-mvjv-w38q,2020-09-04T15:28:19Z,"Malicious Package in babel-loadre",babel-loadre,0.0.0,,,CRITICAL,CWE-506,
 GHSA-vvjh-f6p9-5vcf,2026-03-04T19:17:36Z,"OpenClaw Canvas Authentication Bypass Vulnerability",openclaw,0,2026.2.19,,HIGH,CWE-291,
@@ -8527,7 +8946,8 @@ GHSA-vxp4-25qp-86qh,2017-10-24T18:33:36Z,"Moderate severity vulnerability that a
 GHSA-vxp4-25qp-86qh,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects ember",ember,2.0.0,2.0.3,,MODERATE,,
 GHSA-vxp4-25qp-86qh,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects ember",ember,2.1.0,2.1.2,,MODERATE,,
 GHSA-vxp4-25qp-86qh,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects ember",ember,2.2.0,2.2.1,,MODERATE,,
-GHSA-vxr8-fq34-vvx9,2026-06-15T20:12:53Z,"DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",dompurify,0,3.4.9,,LOW,CWE-693,
+GHSA-w28w-gp39-m4p6,2026-07-24T16:23:59Z,"Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer",@prompty/core,0,0.1.5,,CRITICAL,CWE-1336;CWE-94,
+GHSA-w28w-gp39-m4p6,2026-07-24T16:23:59Z,"Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer",@prompty/core,2.0.0-alpha.1,2.0.0-beta.5,,CRITICAL,CWE-1336;CWE-94,
 GHSA-w2fm-25vw-vh7f,2026-04-01T23:58:50Z,"mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')",mcp-handler,0,1.1.0,,HIGH,CWE-1395;CWE-362,
 GHSA-w32g-5hqp-gg6q,2020-09-02T15:41:41Z,"Cross-Site Scripting in mermaid",mermaid,0,8.2.3,,HIGH,CWE-79,
 GHSA-w37m-7fhw-fmv9,2025-12-11T22:49:56Z,"Next Server Actions Source Code Exposure ",next,15.0.0-canary.0,15.0.6,,MODERATE,CWE-1395;CWE-497;CWE-502,
@@ -8554,13 +8974,18 @@ GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-koa,0,2.14.2,,MODERATE,,
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-lambda,0,2.14.2,,MODERATE,,
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-micro,0,2.14.2,,MODERATE,,
+GHSA-w46p-w7w2-fr9g,2026-07-22T12:32:17Z,"Duplicate Advisory:  AI Agents Project Viewer Privilege Escalation via run_node_tool",n8n,0,,,HIGH,CWE-863,
 GHSA-w48f-fwg7-ww6p,2026-04-04T04:24:27Z,"@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding",@stablelib/cbor,0,2.0.3,,HIGH,CWE-1321,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/core,0,,0.1.142,HIGH,,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/server,0,,0.56.0,HIGH,,
+GHSA-w4hw-qcx7-56pr,2026-07-24T22:34:23Z,"Shescape: Shell injection via unescaped parentheses on Windows with CMD",shescape,0,2.1.14,,CRITICAL,CWE-150;CWE-78,
+GHSA-w4hw-qcx7-56pr,2026-07-24T22:34:23Z,"Shescape: Shell injection via unescaped parentheses on Windows with CMD",shescape,3.0.0,3.0.1,,CRITICAL,CWE-150;CWE-78,
+GHSA-w4v6-g3wm-w36c,2026-07-02T16:48:45Z,"OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy",openclaw,0,2026.4.29,,CRITICAL,CWE-863,
 GHSA-w4vp-3mq7-7v82,2020-09-03T15:49:48Z,"Cross-Site Scripting in lazysizes",lazysizes,0,5.2.1-rc1,,HIGH,CWE-79,
 GHSA-w5c7-9qqw-6645,2026-02-18T00:56:51Z,"OpenClaw inter-session prompts could be treated as direct user instructions",openclaw,0,2026.2.13,,HIGH,CWE-345,
 GHSA-w5cr-2qhr-jqc5,2026-02-13T21:04:00Z,"Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site",agents,0,0.3.10,,MODERATE,CWE-79,
 GHSA-w5q7-3pr9-x44w,2020-09-02T15:59:19Z,"Denial of Service in serialize-to-js",serialize-to-js,0,2.0.0,,HIGH,,
+GHSA-w5ww-7chg-mxcq,2026-07-02T17:18:51Z,"OpenClaw: Telegram interactive callbacks could skip commands.allowFrom",openclaw,0,2026.5.6,,HIGH,CWE-863,
 GHSA-w626-296m-8f85,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw's ACP child sessions inherit subagent security envelope constraints",openclaw,0,2026.4.22,,LOW,CWE-266,
 GHSA-w65v-hx54-xrqx,2020-09-03T17:41:23Z,"Malicious Package in midway-xtpl",midway-xtpl,0.0.0,,,CRITICAL,CWE-506,
 GHSA-w673-8fjw-457c,2026-03-27T18:06:28Z,"n8n: Authenticated XSS and Open Redirect via Form Node",n8n,0,1.123.24,,MODERATE,CWE-601;CWE-79,
@@ -8620,10 +9045,12 @@ GHSA-wp2p-q35g-3rjj,2020-09-01T21:13:01Z,"Malicious Package in soket.io",soket.i
 GHSA-wpfc-3w63-g4hm,2020-09-01T21:09:48Z,"Malicious Package in axois",axois,0,,,CRITICAL,CWE-506,
 GHSA-wpqr-6v78-jr5g,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0,0.39.1,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
 GHSA-wpqr-6v78-jr5g,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0.40.0-preview.2,0.40.0-preview.3,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
+GHSA-wq64-hcrf-8m56,2026-07-22T12:32:17Z,"Duplicate Advisory: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",n8n,0,,,HIGH,CWE-269,
 GHSA-wq95-wr7m-26h4,2025-10-06T03:31:38Z,"Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot",flowise,0,3.0.5,,HIGH,CWE-79,
 GHSA-wqgq-mfvj-6qxp,2020-09-03T19:49:03Z,"Malicious Package in koa-body-parse",koa-body-parse,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wqgx-4q47-j2w5,2020-09-04T17:36:04Z,"Insecure Cryptography Algorithm in parsel",parsel,0.0.0,,,CRITICAL,CWE-327,
 GHSA-wqhw-frpx-5mmp,2020-09-02T16:01:33Z,"Command Injection in tomato",tomato,0,,,HIGH,CWE-77,
+GHSA-wqjv-9729-c5q2,2026-07-24T15:50:40Z,"SvelteKit: Big remote form function payloads can cause Node process to crash",@sveltejs/kit,0,2.69.1,,MODERATE,CWE-248,
 GHSA-wqvq-jvpq-h66f,2026-06-15T17:35:10Z,"Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization",nodemailer,0,8.0.9,,MODERATE,CWE-862,
 GHSA-wr4h-v87w-p3r7,2026-03-18T16:18:32Z,"h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read",h3,0,1.15.6,,MODERATE,CWE-116;CWE-22,
 GHSA-wr4h-v87w-p3r7,2026-03-18T16:18:32Z,"h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read",h3,2.0.0,2.0.1-rc.15,,MODERATE,CWE-116;CWE-22,
@@ -8633,6 +9060,7 @@ GHSA-wrr4-782v-jhwh,2026-06-25T17:46:49Z,"neotoma has tenant isolation gap in re
 GHSA-wrr6-p5r6-474m,2026-06-16T21:31:58Z,"Duplicate Advisory: Exec allowlist could miss side effects from transparent command wrappers",openclaw,0,,2026.5.22,LOW,CWE-184,
 GHSA-wrw9-m778-g6mc,2019-06-03T17:27:57Z,"Memory Exposure in bl",bl,0,0.9.5,,MODERATE,CWE-200,
 GHSA-wrw9-m778-g6mc,2019-06-03T17:27:57Z,"Memory Exposure in bl",bl,1.0.0,1.0.1,,MODERATE,CWE-200,
+GHSA-wv26-j37q-2g7p,2026-07-02T16:18:24Z,"OpenClaw's Slack plugin approvals used the exec approver gate for plugin actions",openclaw,0,2026.5.12,,MODERATE,CWE-863,
 GHSA-wv39-cgmm-cq29,2020-09-03T22:23:00Z,"Malicious Package in buffmr-xor",buffmr-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wvh7-5p38-2qfc,2020-07-23T18:20:10Z,"Storing Password in Local Storage",parse,0,2.10.0,,MODERATE,CWE-256,
 GHSA-wvr4-3wq4-gpc5,2026-03-19T12:51:28Z,"MCP Connect has unauthenticated remote OS command execution via /bridge endpoint",mcp-bridge,0,,2.0.0,CRITICAL,CWE-306,
@@ -8650,18 +9078,22 @@ GHSA-wxj2-777f-vxmf,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripti
 GHSA-wxrm-2h86-v95f,2020-09-03T21:04:20Z,"Malicious Package in pizza-pasta",pizza-pasta,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wxvm-fh75-mpgr,2018-07-26T16:24:34Z,"Critical severity vulnerability that affects dns-sync",dns-sync,0,0.1.1,,CRITICAL,,
 GHSA-wxw3-q3m9-c3jr,2026-05-15T17:33:40Z,"Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE",better-auth,0,1.6.2,,MODERATE,CWE-287;CWE-345;CWE-352,
+GHSA-x27w-589x-frm2,2026-07-20T23:25:07Z,"Astro: Unauthenticated path override in the @astrojs/vercel ISR function",@astrojs/vercel,10.0.3,11.0.3,,MODERATE,CWE-441;CWE-862,
 GHSA-x39m-3393-3qp4,2025-11-14T20:56:02Z,"Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)",flowise-ui,0,3.0.10,,HIGH,CWE-306;CWE-620,
 GHSA-x3ff-w252-2g7j,2026-04-01T22:13:35Z,"StableLib Ed25519 Signature Malleability via Missing S < L Check",@stablelib/ed25519,0,,2.0.2,MODERATE,CWE-347,
 GHSA-x3h8-jrgh-p8jx,2026-05-04T20:23:35Z,"OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs",openclaw,0,2026.4.22,,MODERATE,CWE-200,
 GHSA-x3m6-rprw-862w,2020-09-03T17:43:31Z,"Malicious Package in node-buc",node-buc,0.0.0,,,CRITICAL,CWE-506,
 GHSA-x3w4-mrmv-cw2x,2020-09-03T22:19:44Z,"Malicious Package in buffev-xor",buffev-xor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",@auth/core,0,0.41.3,,MODERATE,CWE-345;CWE-346;CWE-940,
+GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",next-auth,0,4.24.15,,MODERATE,CWE-345;CWE-346;CWE-940,
+GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",next-auth,5.0.0-beta.1,5.0.0-beta.32,,MODERATE,CWE-345;CWE-346;CWE-940,
 GHSA-x45v-pvpg-hcrh,2020-09-03T19:54:36Z,"Malicious Package in mysql-koa",mysql-koa,0.0.0,,,CRITICAL,CWE-506,
 GHSA-x48m-gp6r-gp4v,2020-09-03T18:21:26Z,"Malicious Package in rate-map",rate-map,1.0.3,1.0.5,,CRITICAL,CWE-506,
 GHSA-x49q-fhhm-r9jf,2026-03-20T15:31:14Z,"Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes",openclaw,0,2026.3.12,,CRITICAL,CWE-862,
+GHSA-x4hg-hfwf-p9mw,2026-07-02T20:20:04Z,"@asymmetric-effort/nogginlessdom vulnerable to ReDoS via user-controlled regex in HTMLInputElement pattern validation","@asymmetric-effort/nogginlessdom",0,0.0.22,,MODERATE,CWE-1333,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,0,2.2.2,,MODERATE,,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,3.0.0,3.3.2,,MODERATE,,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,4.0.0,4.1.2,,MODERATE,,
-GHSA-x4vx-rjvf-j5p4,2026-06-15T20:00:02Z,"DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",dompurify,0,,3.4.6,LOW,CWE-79,
 GHSA-x565-32qp-m3vf,2024-04-11T21:30:30Z,"phin may include sensitive headers in subsequent requests after redirect",phin,0,3.7.1,,MODERATE,CWE-200,
 GHSA-x6ch-c6rv-f7wh,2020-09-02T18:34:22Z,"Malicious Package in asymc",asymc,0,,,CRITICAL,CWE-506,
 GHSA-x6gq-467r-hwcc,2020-09-01T21:14:05Z,"Malicious Package in soket.js",soket.js,0,,,CRITICAL,CWE-506,
@@ -8679,6 +9111,7 @@ GHSA-x9p2-fxq6-2m5f,2019-06-20T14:33:07Z,"Reverse Tabnapping in swagger-ui",swag
 GHSA-xc7v-wxcw-j472,2019-06-03T17:08:26Z,"Memory Exposure in tunnel-agent",tunnel-agent,0,0.6.0,,MODERATE,CWE-200,
 GHSA-xcgx-27q5-7634,2020-09-03T19:41:05Z,"Malicious Package in commanedr",commanedr,0.0.0,,,CRITICAL,CWE-506,
 GHSA-xcqx-9jf5-w339,2026-06-19T21:42:43Z," SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`",mcp-searxng,0,1.7.1,,HIGH,CWE-400,
+GHSA-xcx6-4f2g-hhgx,2026-07-24T21:17:03Z," Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs",@budibase/server,0,,3.38.1,HIGH,CWE-863,
 GHSA-xcxh-6cv4-q8p8,2025-08-12T00:13:03Z,"HFS user adding a ""web link"" in HFS is vulnerable to ""target=_blank"" exploit",hfs,0,0.57.10,,LOW,CWE-1022,
 GHSA-xf5p-87ch-gxw2,2019-06-05T14:10:03Z,"Marked ReDoS due to email addresses being evaluated in quadratic time",marked,0.3.14,0.6.2,,MODERATE,CWE-400,
 GHSA-xf64-2f9p-6pqq,2020-09-04T17:24:08Z,"Information Exposure in type-graphql",type-graphql,0,0.17.6,,LOW,CWE-209,
@@ -8686,6 +9119,7 @@ GHSA-xffm-g5w8-qvg7,2025-07-18T20:39:12Z,"@eslint/plugin-kit is vulnerable to Re
 GHSA-xfqj-r5qw-8g4j,2026-04-16T22:47:05Z,"Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode",@paperclipai/server,0,2026.416.0,,HIGH,CWE-306,
 GHSA-xfrc-7mj2-5xh9,2020-09-03T17:14:51Z,"Undefined Behavior in zencashjs",zencashjs,0,1.2.0,,CRITICAL,,
 GHSA-xg59-f45v-9r9j,2026-03-31T12:31:36Z,"Duplicate Advisory: OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty",openclaw,0,2026.3.8,,LOW,CWE-863,
+GHSA-xg5g-26x8-cvf4,2026-07-24T21:17:25Z," Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution",@budibase/server,0,,3.38.1,HIGH,CWE-918,
 GHSA-xg6x-h9c9-2m83,2026-04-03T03:29:59Z,"Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)",better-auth,0,1.4.9,,CRITICAL,CWE-288,
 GHSA-xgh6-85xh-479p,2020-10-16T18:56:26Z,"Regular Expression Denial of Service in npm-user-validate",npm-user-validate,0,1.0.1,,LOW,,
 GHSA-xgp2-cc4r-7vf6,2020-09-03T20:44:21Z,"Denial of Service in http-live-simulator",http-live-simulator,0,1.0.8,,MODERATE,,
@@ -8695,10 +9129,17 @@ GHSA-xh2p-7p87-fhgh,2021-08-05T16:56:58Z,"Incorrect TCR calculation in batchLiqu
 GHSA-xh8g-j88w-6v59,2020-09-03T19:42:16Z,"Malicious Package in cionstring",cionstring,0.0.0,,,CRITICAL,CWE-506,
 GHSA-xh9j-mpc9-2m9p,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions",openclaw,0,,2026.2.24,MODERATE,CWE-807,
 GHSA-xhjx-mfr6-9rr4,2020-09-01T21:20:28Z,"Command Injection in samsung-remote",samsung-remote,0,1.3.5,,CRITICAL,CWE-77,
+GHSA-xj6q-8x83-jv6g,2026-07-20T17:51:17Z,"Axios: Prototype pollution auth subfields can inject Basic auth",axios,1.15.2,1.18.0,,MODERATE,CWE-1321,
 GHSA-xjj9-2w6f-jg55,2026-03-12T12:30:29Z," Duplicate Advisory: OpenClaw safeBins file-existence oracle information disclosure",openclaw,0,2026.2.19,,MODERATE,CWE-200,
 GHSA-xjr7-3c3g-m763,2026-01-13T20:29:00Z,"Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file",renovate,39.53.0,40.33.0,,MODERATE,CWE-77,
 GHSA-xm28-fw2x-fqv2,2019-05-31T23:08:14Z,"Denial of Service in foreman",foreman,0,3.0.1,,HIGH,CWE-400,
 GHSA-xm7f-x4wx-wmgv,2019-06-04T15:47:43Z,"Out-of-bounds Read in byte",byte,0,1.4.1,,MODERATE,CWE-125,
+GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,0,1.123.67,,HIGH,CWE-73,
+GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-73,
+GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,2.32.0,2.32.1,,HIGH,CWE-73,
+GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",@auth/core,0.1.0,0.41.3,,HIGH,CWE-20,
+GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",next-auth,4.0.6,4.24.15,,HIGH,CWE-20,
+GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",next-auth,5.0.0-beta.0,5.0.0-beta.32,,HIGH,CWE-20,
 GHSA-xmh9-rg6f-j3mr,2021-03-12T22:39:01Z,"Verification flaw in Solid identity-token-verifier","@solid/identity-token-verifier",0,0.5.2,,MODERATE,CWE-290,
 GHSA-xmmp-hrmx-x5g7,2020-09-02T21:32:22Z,"Malicious Package in bowe",bowe,0,,,CRITICAL,CWE-506,
 GHSA-xmv6-r34m-62p4,2026-03-03T22:08:54Z,"OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot",openclaw,0,2026.2.25,,HIGH,CWE-22;CWE-59,
@@ -8707,9 +9148,11 @@ GHSA-xpr6-2hgm-4wwp,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw vulnerabl
 GHSA-xq3g-m3j8-2vmm,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels",openclaw,0,,,HIGH,CWE-770,
 GHSA-xq7h-vwjp-5vrh,2026-03-25T17:30:46Z,"@grackle-ai/powerline Runs Without Authentication by Default",@grackle-ai/powerline,0,0.70.1,,MODERATE,CWE-306,
 GHSA-xr3g-4gg5-w3wq,2020-09-03T17:06:14Z,"Malicious Package in degbu",degbu,0.0.0,,,CRITICAL,CWE-506,
+GHSA-xr4f-mjxj-w6w5,2026-07-02T16:55:09Z,"OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes",openclaw,0,2026.5.4,,HIGH,CWE-863,
 GHSA-xr53-m937-jr9c,2020-09-03T15:49:14Z,"Cross-Site Scripting in ngx-md",ngx-md,0,6.0.3,,HIGH,CWE-79,
 GHSA-xrgf-r9gr-jjjf,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: Exec environment denylist missed high-risk interpreter startup variables",openclaw,0,2026.4.10,,HIGH,CWE-184,
 GHSA-xrgv-34cc-q765,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw's system.run allowlist bypass via shell line-continuation command substitution",openclaw,0,,,MODERATE,CWE-78,
+GHSA-xrmc-c5cg-rv7x,2026-07-10T19:34:14Z,"SafeInstall agent guard shell parsing can miss raw package execution",safeinstall-cli,0,0.10.2,,HIGH,CWE-178;CWE-693,
 GHSA-xrmp-99wj-p6jc,2019-05-31T23:43:09Z,"Prototype Pollution in deap",deap,0,1.0.1,,HIGH,CWE-400,
 GHSA-xrq9-jm7v-g9h7,2026-04-25T23:49:00Z,"OpenClaw: Paired-device pairing actions were not limited to the caller device",openclaw,0,2026.4.20,,LOW,CWE-284;CWE-863,
 GHSA-xrr6-6ww3-f3qm,2020-09-02T21:25:58Z,"Sandbox Breakout / Arbitrary Code Execution in value-censorship",value-censorship,0,,,MODERATE,,
@@ -8717,8 +9160,13 @@ GHSA-xrrg-wfwc-c7r3,2020-09-04T15:33:52Z,"Malicious Package in bictoin-ops",bict
 GHSA-xv3q-jrmm-4fxv,2023-04-18T22:28:02Z,"Authentication Bypass in @strapi/plugin-users-permissions","@strapi/plugin-users-permissions",3.2.1,4.6.0,,HIGH,,
 GHSA-xv56-3wq5-9997,2026-01-13T19:57:06Z,"Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository",renovate,39.218.0,40.33.0,,MODERATE,CWE-77,
 GHSA-xvp7-8vm8-xfxx,2025-10-20T17:55:59Z,"Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers",@actual-app/sync-server,0,25.11.0,,MODERATE,CWE-209;CWE-215;CWE-219,
+GHSA-xw57-23p8-9wc5,2026-07-02T19:07:22Z,"@asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range)","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-918,
 GHSA-xw79-hhv6-578c,2020-09-11T21:16:59Z,"Cross-Site Scripting in serve",serve,0,10.0.2,,HIGH,CWE-79,
 GHSA-xwcj-hwhf-h378,2026-03-16T20:40:13Z,"OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs",openclaw,0,2026.3.13,,MODERATE,CWE-532,
 GHSA-xwqw-rf2q-xmhf,2020-09-01T21:23:38Z,"Cross-Site Scripting in buefy",buefy,0,0.7.2,,HIGH,CWE-79,
+GHSA-xww8-gqvh-92x9,2026-07-02T15:40:36Z,"OpenClaw: Exec approval display truncation could hide the command being approved",openclaw,0,2026.5.18,,HIGH,CWE-284;CWE-863,
+GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service",n8n,0,1.123.67,,HIGH,CWE-1321,
+GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-1321,
+GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service",n8n,2.32.0,2.32.1,,HIGH,CWE-1321,
 GHSA-xx4c-jj58-r7x6,2021-11-19T20:14:23Z,"Inefficient Regular Expression Complexity in Validator.js",validator,11.1.0,13.7.0,,MODERATE,CWE-1333,
 GHSA-xxj4-96ph-g6j6,2026-03-31T12:31:36Z,"Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path",openclaw,0,2026.3.11,,MODERATE,CWE-367,