npm - @openrewrite/recipes-nodejs - Versions diffs - 0.47.2 → 0.47.3 - Mend

@openrewrite/recipes-nodejs 0.47.2 → 0.47.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/dist/resources/advisories-npm.csv +333 -29
package/package.json +2 -2

package/dist/resources/advisories-npm.csv CHANGED Viewed

@@ -4549,10 +4549,24 @@ CVE-2026-12151,2026-06-19T14:22:01Z,"undici WebSocket client vulnerable to denia
 CVE-2026-12151,2026-06-19T14:22:01Z,"undici WebSocket client vulnerable to denial of service via fragment count bypass",undici,7.0.0,7.28.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-12151,2026-06-19T14:22:01Z,"undici WebSocket client vulnerable to denial of service via fragment count bypass",undici,8.0.0,8.5.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-1245,2026-01-20T21:31:34Z,"binary-parser library has a code injection vulnerability",binary-parser,0,2.3.0,,MODERATE,CWE-94,
+CVE-2026-12590,2026-07-20T23:23:26Z,"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",body-parser,0,1.20.6,,LOW,CWE-770,
+CVE-2026-12590,2026-07-20T23:23:26Z,"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",body-parser,2.0.0,2.3.0,,LOW,CWE-770,
 CVE-2026-12644,2026-06-19T06:31:56Z,"ts-deepmerge: Prototype Method Override leads to DoS",ts-deepmerge,0,8.0.0,,MODERATE,CWE-248,
+CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,0,1.1.16,,HIGH,CWE-400;CWE-407,
+CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,2.0.0,2.1.2,,HIGH,CWE-400;CWE-407,
+CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,3.0.0,5.0.7,,HIGH,CWE-400;CWE-407,
+CVE-2026-13311,2026-07-20T21:49:34Z,"shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)",shell-quote,0,1.9.0,,HIGH,CWE-407,
+CVE-2026-13676,2026-07-21T19:03:11Z,"fast-uri vulnerable to host confusion via failed IDN canonicalization",fast-uri,2.3.1,2.4.2,,HIGH,CWE-436;CWE-551,
+CVE-2026-13676,2026-07-21T19:03:11Z,"fast-uri vulnerable to host confusion via failed IDN canonicalization",fast-uri,3.0.0,3.1.3,,HIGH,CWE-436;CWE-551,
+CVE-2026-13676,2026-07-21T19:03:11Z,"fast-uri vulnerable to host confusion via failed IDN canonicalization",fast-uri,4.0.0,4.0.1,,HIGH,CWE-436;CWE-551,
+CVE-2026-13760,2026-07-21T19:04:50Z,"aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling",aws-cdk-lib,0,2.260.0,,HIGH,CWE-78,
+CVE-2026-14257,2026-07-24T21:53:14Z,"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash",brace-expansion,0,5.0.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-14620,2026-07-20T22:01:56Z,"webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints",webpack-dev-server,0,5.2.6,,MODERATE,CWE-352;CWE-749,
+CVE-2026-14631,2026-07-20T22:02:31Z,"webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header",webpack-dev-server,0,5.2.6,,MODERATE,CWE-20;CWE-248,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,0,1.123.17,,CRITICAL,CWE-95,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,2.0.0,2.4.5,,CRITICAL,CWE-95,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,2.5.0,2.5.1,,CRITICAL,CWE-95,
+CVE-2026-15074,2026-07-24T16:43:21Z,"@fastify/static vulnerable to route guard bypass via path traversal",@fastify/static,0,10.1.1,,HIGH,CWE-22,
 CVE-2026-1513,2026-01-28T03:30:30Z,"billboard.js is vulnerable to XSS during chart option binding",billboard.js,0,3.18.0,,HIGH,CWE-79,
 CVE-2026-1525,2026-03-13T20:07:03Z,"Undici has an HTTP Request/Response Smuggling issue",undici,0,6.24.0,,MODERATE,CWE-444,
 CVE-2026-1525,2026-03-13T20:07:03Z,"Undici has an HTTP Request/Response Smuggling issue",undici,7.0.0,7.24.0,,MODERATE,CWE-444,
@@ -4563,6 +4577,9 @@ CVE-2026-1527,2026-03-13T20:41:26Z,"Undici has CRLF Injection in undici via `upg
 CVE-2026-1528,2026-03-13T20:07:26Z,"Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",undici,6.0.0,6.24.0,,HIGH,CWE-1284;CWE-248,
 CVE-2026-1528,2026-03-13T20:07:26Z,"Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",undici,7.0.0,7.24.0,,HIGH,CWE-1284;CWE-248,
 CVE-2026-1615,2026-02-09T06:30:28Z,"jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions",jsonpath,0,1.3.0,,HIGH,CWE-94,
+CVE-2026-16221,2026-07-21T22:08:28Z,"fast-uri vulnerable to host confusion via literal backslash authority delimiter",fast-uri,2.3.1,2.4.3,,HIGH,CWE-436,
+CVE-2026-16221,2026-07-21T22:08:28Z,"fast-uri vulnerable to host confusion via literal backslash authority delimiter",fast-uri,3.0.0,3.1.4,,HIGH,CWE-436,
+CVE-2026-16221,2026-07-21T22:08:28Z,"fast-uri vulnerable to host confusion via literal backslash authority delimiter",fast-uri,4.0.0,4.1.1,,HIGH,CWE-436,
 CVE-2026-1664,2026-02-03T18:42:01Z,"Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing",agents,0,0.3.7,,MODERATE,CWE-639,
 CVE-2026-1721,2026-02-13T03:31:23Z,"Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler",agents,0,0.3.10,,MODERATE,CWE-79,
 CVE-2026-1774,2026-02-10T18:30:38Z,"CASL Ability is Vulnerable to Prototype Pollution",@casl/ability,2.4.0,6.7.5,,CRITICAL,CWE-1321,
@@ -6424,6 +6441,14 @@ CVE-2026-44895,2026-05-09T00:10:28Z,"@yoda.digital/gitlab-mcp-server's SSE trans
 CVE-2026-44902,2026-05-11T14:42:10Z,"Prometheus exporter process crash via malformed HTTP request","@opentelemetry/auto-instrumentations-node",0,0.75.0,,HIGH,CWE-755,
 CVE-2026-44902,2026-05-11T14:42:10Z,"Prometheus exporter process crash via malformed HTTP request","@opentelemetry/exporter-prometheus",0,0.217.0,,HIGH,CWE-755,
 CVE-2026-44902,2026-05-11T14:42:10Z,"Prometheus exporter process crash via malformed HTTP request",@opentelemetry/sdk-node,0,0.217.0,,HIGH,CWE-755,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions","react-server-dom-turbopack",19.0.0,19.0.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions","react-server-dom-turbopack",19.1.0,19.1.9,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions","react-server-dom-turbopack",19.2.0,19.2.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-parcel,19.1.0,19.1.9,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-parcel,19.2.0,19.2.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-webpack,19.0.0,19.0.8,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-webpack,19.1.0,19.1.9,,HIGH,CWE-400;CWE-770,
+CVE-2026-44907,2026-07-24T21:12:02Z,"react-server-dom: Denial of Service in Server Functions",react-server-dom-webpack,19.2.0,19.2.8,,HIGH,CWE-400;CWE-770,
 CVE-2026-44966,2026-05-09T00:40:16Z,"Velocity.js has a Prototype Pollution vulnerability through #set path assignment",velocityjs,0,,2.1.5,HIGH,CWE-1321,
 CVE-2026-44974,2026-05-27T00:37:20Z,"@hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parameters",@hapi/content,0,6.0.2,,HIGH,CWE-436,
 CVE-2026-44979,2026-05-27T00:38:09Z,"@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects",@hapi/wreck,0,18.1.1,,MODERATE,CWE-200;CWE-522,
@@ -6557,6 +6582,7 @@ CVE-2026-45577,2026-05-18T14:20:06Z,"Neotoma: Unauthenticated Inspector/API acce
 CVE-2026-45582,2026-05-18T13:26:51Z,"n8n-MCP: Workflow telemetry sanitizer could retain partial values from URL-shaped node parameters",n8n-mcp,0,2.51.3,,MODERATE,CWE-201,
 CVE-2026-45617,2026-05-27T18:08:19Z,"LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex",liquidjs,0,10.26.0,,HIGH,CWE-1333,
 CVE-2026-45618,2026-05-27T18:24:14Z,"LiquidJS is Vulnerable to Remote Code Execution",liquidjs,0,10.26.0,,CRITICAL,CWE-94,
+CVE-2026-45623,2026-07-23T15:06:16Z,"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments",postcss,0,8.5.12,,HIGH,CWE-200;CWE-22,
 CVE-2026-45665,2026-05-14T20:27:45Z,"Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order",open-webui,0,0.8.0,,HIGH,CWE-79,
 CVE-2026-45669,2026-05-19T15:49:25Z,"Nuxt: Reflected XSS in `navigateTo()` external redirect",nuxt,3.4.3,3.21.6,,MODERATE,CWE-83,
 CVE-2026-45669,2026-05-19T15:49:25Z,"Nuxt: Reflected XSS in `navigateTo()` external redirect",nuxt,4.0.0-alpha.1,4.4.6,,MODERATE,CWE-83,
@@ -6583,8 +6609,8 @@ CVE-2026-45773,2026-05-19T19:49:52Z,"Turbo: Login callback CSRF/session fixation
 CVE-2026-45783,2026-05-19T20:07:52Z,"@libp2p/kad-dht: Unvalidated PUT_VALUE records allow unbounded disk exhaustion on DHT server nodes",@libp2p/kad-dht,0,16.2.6,,HIGH,CWE-20;CWE-400,
 CVE-2026-45787,2026-05-14T20:30:04Z,"electerm's encrypt method not safe enough",electerm,0,3.9.5,,MODERATE,"CWE-326;CWE-329;CWE-353;CWE-759;CWE-916",
 CVE-2026-45805,2026-05-19T19:57:36Z,"PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE",@penpot/mcp,0,2.15.0,,HIGH,CWE-749,
-CVE-2026-4598,2026-03-23T06:30:29Z,"jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs",jsrsasign,0,11.1.1,,HIGH,CWE-835,
-CVE-2026-4599,2026-03-23T06:30:29Z,"jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation",jsrsasign,7.0.0,11.1.1,,CRITICAL,CWE-1023,
+CVE-2026-4598,2026-03-23T06:30:29Z,"jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs",jsrsasign,0,11.1.1,,HIGH,CWE-1287;CWE-835,
+CVE-2026-4599,2026-03-23T06:30:29Z,"jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation",jsrsasign,7.0.0,11.1.1,,CRITICAL,CWE-1023;CWE-338,
 CVE-2026-4600,2026-03-23T06:30:29Z,"jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublic",jsrsasign,0,11.1.1,,HIGH,CWE-347,
 CVE-2026-4601,2026-03-23T06:30:29Z,"jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction",jsrsasign,0,11.1.1,,HIGH,CWE-325,
 CVE-2026-4602,2026-03-23T06:30:29Z,"jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass",jsrsasign,0,11.1.1,,HIGH,CWE-681,
@@ -6673,6 +6699,7 @@ CVE-2026-47200,2026-05-29T17:15:11Z,"Nuxt's route middleware is not enforced whe
 CVE-2026-47208,2026-05-29T17:40:15Z,"vm2 is Vulnerable to Sandbox Breakout Through Promise Species",vm2,0,3.11.4,,CRITICAL,CWE-913,
 CVE-2026-47209,2026-05-29T17:49:18Z,"vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain",vm2,0,3.11.4,,HIGH,CWE-693,
 CVE-2026-47210,2026-05-29T17:51:05Z,"vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass",vm2,0,3.11.4,,CRITICAL,CWE-913,
+CVE-2026-47219,2026-07-23T19:33:15Z,"find-my-way: DDoS with HTTP2",find-my-way,0,9.7.0,,HIGH,CWE-1321,
 CVE-2026-47248,2026-05-29T19:18:01Z,"Parse Server's GraphQL ""Did you mean ...?"" validation suggestions disclose schema to unauthenticated callers",parse-server,0,8.6.78,,MODERATE,CWE-209,
 CVE-2026-47248,2026-05-29T19:18:01Z,"Parse Server's GraphQL ""Did you mean ...?"" validation suggestions disclose schema to unauthenticated callers",parse-server,9.0.0,9.9.1-alpha.2,,MODERATE,CWE-209,
 CVE-2026-47250,2026-06-05T15:40:00Z,"MCP Server Kubernetes: kubectl-generic flag injection enables Kubernetes bearer token exfiltration",mcp-server-kubernetes,0,3.7.0,,MODERATE,CWE-88,
@@ -6684,7 +6711,7 @@ CVE-2026-47376,2026-06-05T15:59:53Z,"NocoDB: Reflected Cross-Site Scripting via
 CVE-2026-47377,2026-06-05T16:00:15Z,"NocoDB: Open Redirect via Hash Fragment in hashRedirect Plugin",nocodb,0,2026.04.1,,MODERATE,CWE-601,
 CVE-2026-47378,2026-06-05T16:03:11Z,"NocoDB: Hidden Column Exposure in Public Shared View Endpoints",nocodb,0,2026.04.1,,MODERATE,CWE-639,
 CVE-2026-47379,2026-06-05T16:03:33Z,"NocoDB: Plaintext Password Comparison in Shared Views",nocodb,0,2026.05.1,,MODERATE,CWE-200;CWE-203,
-CVE-2026-47380,2026-06-05T16:03:55Z,"NocoDB: User Enumeration via Sign-In Timing",nocodb,0,2026.04.1,,LOW,CWE-208;CWE-307,
+CVE-2026-47380,2026-06-05T16:03:55Z,"NocoDB: User Enumeration via Sign-In Timing",nocodb,0,2026.04.1,,MODERATE,CWE-208;CWE-307,
 CVE-2026-47381,2026-06-05T16:04:32Z,"NocoDB: Cross-Workspace Integration Use in Connection Test",nocodb,0,2026.05.1,,MODERATE,CWE-290,
 CVE-2026-47382,2026-06-05T16:19:01Z,"NocoDB: Server-Side Request Forgery via Database Connection Host",nocodb,0,2026.05.1,,MODERATE,CWE-918,
 CVE-2026-47383,2026-06-05T16:19:22Z,"NocoDB: Stored Cross-Site Scripting via Row Comments",nocodb,0,2026.05.1,,HIGH,CWE-79,
@@ -6928,6 +6955,7 @@ CVE-2026-53509,2026-07-07T19:35:57Z,"@aborruso/ckan-mcp-server: SSRF via base_ur
 CVE-2026-53512,2026-07-07T20:11:50Z,"Better Auth: OAuth refresh-token replay via missing client authentication on oidc-provider and mcp plugins",better-auth,0,1.6.11,,CRITICAL,"CWE-287;CWE-306;CWE-345;CWE-863",
 CVE-2026-53513,2026-07-07T20:56:19Z,"@better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints",@better-auth/sso,0.1.0,1.6.11,,CRITICAL,"CWE-20;CWE-345;CWE-441;CWE-918",
 CVE-2026-53514,2026-07-07T20:54:51Z,"Better Auth vulnerable to unauthorized invitation acceptance via unverified email match in organization plugin",better-auth,0,1.6.11,,HIGH,"CWE-287;CWE-345;CWE-441;CWE-862",
+CVE-2026-53515,2026-07-20T21:06:17Z,"@better-auth/sso: SSO provider may allow registration for any org member without a checking their role",@better-auth/sso,1.2.10,1.6.11,,HIGH,CWE-269;CWE-285;CWE-863,
 CVE-2026-53516,2026-07-07T20:55:13Z,"Better Auth has an account takeover issue via OAuth auto-link to unverified pre-registered email",better-auth,0,1.6.11,,HIGH,CWE-287;CWE-345,
 CVE-2026-53517,2026-07-07T20:55:48Z,"Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption","@better-auth/oauth-provider",1.6.0,1.6.11,,HIGH,"CWE-294;CWE-362;CWE-367;CWE-613",
 CVE-2026-53517,2026-07-07T20:55:48Z,"Better Auth: OAuth refresh-token rotation forks the token family on concurrent redemption",better-auth,1.4.8-beta.7,1.6.0,,HIGH,"CWE-294;CWE-362;CWE-367;CWE-613",
@@ -6953,6 +6981,11 @@ CVE-2026-53633,2026-06-15T20:05:15Z,"Vitest Browser: Exposed Browser Mode API Ca
 CVE-2026-53655,2026-06-15T17:19:42Z,"node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",tar,0,7.5.16,,MODERATE,CWE-436,
 CVE-2026-53663,2026-06-15T20:06:15Z,"React Router: Potential CSRF via PUT/PATCH/DELETE document requests","@remix-run/server-runtime",2.17.3,2.17.5,,LOW,CWE-352,
 CVE-2026-53663,2026-06-15T20:06:15Z,"React Router: Potential CSRF via PUT/PATCH/DELETE document requests",react-router,7.12.0,7.15.1,,LOW,CWE-352,
+CVE-2026-53666,2026-07-23T19:34:14Z,"React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration",react-router,6.4.0,7.18.0,,MODERATE,CWE-470,
+CVE-2026-53667,2026-07-23T19:35:57Z,"React Router: RSCErrorHandler Missing Protocol Validation (XSS)",react-router,7.11.0,7.18.0,,MODERATE,CWE-79,
+CVE-2026-53668,2026-07-23T19:36:31Z,"React Router: Open redirect leading to XSS",react-router,7.9.6,7.13.0,,MODERATE,CWE-601,
+CVE-2026-53668,2026-07-23T19:36:31Z,"React Router: Open redirect leading to XSS",react-router-dom,6.30.2,,6.30.4,MODERATE,CWE-601,
+CVE-2026-53669,2026-07-23T19:38:28Z,"React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)",react-router,6.0.0,7.18.0,,MODERATE,CWE-601,
 CVE-2026-53721,2026-06-16T13:48:31Z,"Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher",nuxt,3.11.0,3.21.7,,HIGH,CWE-178;CWE-863,
 CVE-2026-53721,2026-06-16T13:48:31Z,"Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher",nuxt,4.0.0,4.4.7,,HIGH,CWE-178;CWE-863,
 CVE-2026-53722,2026-06-16T13:49:36Z,"Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL",nuxt,0,3.21.7,,MODERATE,CWE-79;CWE-83,
@@ -7099,6 +7132,8 @@ CVE-2026-54504,2026-07-15T23:26:57Z,"@andrea9293/mcp-documentation-server: Web U
 CVE-2026-54527,2026-06-19T19:36:04Z,"jupyterlab-git extension: Stored XSS leading to RCE",@jupyterlab/git,0.30.0b3,0.54.0,,HIGH,CWE-79,
 CVE-2026-54546,2026-07-17T19:02:37Z,"TAK-PS-Stats Web UI: Authenticated full-read SSRF in CloudTAK basemap import (PUT /api/basemap) — no IP-classification guard",@tak-ps/cloudtak,0,,13.5.0,MODERATE,CWE-918,
 CVE-2026-54561,2026-07-17T19:23:07Z,"mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath",mcp-memory-keeper,0,0.13.0,,MODERATE,CWE-22;CWE-209,
+CVE-2026-54672,2026-07-24T14:00:59Z,"electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`",app-builder-lib,0,26.15.0,,HIGH,CWE-427,
+CVE-2026-54673,2026-07-24T14:03:19Z,"electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`",builder-util-runtime,0,9.7.0,,HIGH,CWE-200,
 CVE-2026-55091,2026-06-19T20:47:52Z,"flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key",flat-to-nested,0,1.1.2,,HIGH,CWE-1321;CWE-915,
 CVE-2026-55177,2026-07-17T21:35:10Z,"CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard",@tak-ps/cloudtak,0,13.10.0,,HIGH,CWE-918,
 CVE-2026-55180,2026-06-26T23:12:25Z,"pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",pnpm,0,10.34.2,,MODERATE,CWE-200;CWE-201;CWE-522,
@@ -7110,12 +7145,14 @@ CVE-2026-55487,2026-06-26T23:18:13Z,"pnpm: Manifest identity spoof satisfies all
 CVE-2026-55487,2026-06-26T23:18:13Z,"pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",pnpm,11.0.0,11.5.3,,HIGH,CWE-346;CWE-693;CWE-829,
 CVE-2026-55500,2026-07-06T21:37:49Z,"9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover",9router,0,,0.4.71,CRITICAL,CWE-200,
 CVE-2026-55501,2026-07-06T21:46:20Z,"9router: Login brute-force protection bypass via spoofed X-Forwarded-For header",9router,0,0.4.77,,HIGH,CWE-290;CWE-307,
+CVE-2026-55575,2026-07-24T14:05:20Z,"LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce",liquidjs,0,10.27.1,,HIGH,CWE-770,
 CVE-2026-55591,2026-06-18T21:13:36Z,"Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints",signalk-server,0,2.28.0,,MODERATE,CWE-918,
 CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,0.16.0,2.0.10,,MODERATE,CWE-187;CWE-20,
 CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,3.0.0,3.0.6,,MODERATE,CWE-187;CWE-20,
 CVE-2026-55602,2026-06-18T13:06:11Z,"http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",http-proxy-middleware,4.0.0,4.1.0,,MODERATE,CWE-187;CWE-20,
 CVE-2026-55603,2026-06-18T13:06:21Z,"http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`",http-proxy-middleware,3.0.4,3.0.7,,HIGH,CWE-93,
 CVE-2026-55603,2026-06-18T13:06:21Z,"http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`",http-proxy-middleware,4.0.0,4.1.1,,HIGH,CWE-93,
+CVE-2026-55607,2026-07-24T16:54:09Z,"Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution","@anthropic-ai/claude-code",2.1.38,2.1.163,,HIGH,CWE-22;CWE-59;CWE-78,
 CVE-2026-55608,2026-07-14T20:26:39Z,"n8n-MCP: Incorrect authorization can expose default-scope workflow version backups in multi-tenant HTTP mode",n8n-mcp,0,2.57.4,,MODERATE,CWE-200;CWE-863,
 CVE-2026-55617,2026-06-18T13:06:35Z,"Hydro: Insufficient session expiration when recreating sessions",hydrooj,4.10.4,5.0.2,,MODERATE,CWE-613,
 CVE-2026-55650,2026-06-19T21:18:44Z,"Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure",@outerbase/studio,0,,0.10.2,MODERATE,CWE-79,
@@ -7123,6 +7160,7 @@ CVE-2026-55660,2026-06-19T21:15:29Z,"TinaCMS: Cross-origin postMessage handlers
 CVE-2026-55660,2026-06-19T21:15:29Z,"TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover",tinacms,0,3.9.3,,HIGH,"CWE-346;CWE-601;CWE-79;CWE-940",
 CVE-2026-55661,2026-06-18T13:07:05Z,"TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes",@tinacms/mdx,0,2.1.7,,MODERATE,CWE-79;CWE-87,
 CVE-2026-55661,2026-06-18T13:07:05Z,"TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes",tinacms,0,3.9.3,,MODERATE,CWE-79;CWE-87,
+CVE-2026-55685,2026-07-24T14:06:57Z,"React Router: Unauthenticated Denial of Service via Inefficient Route Matching",react-router,7.0.0,7.18.0,,HIGH,CWE-400;CWE-407,
 CVE-2026-55697,2026-06-26T23:20:47Z,"pnpm: Repository-controlled configDependencies can select a pacquet native install engine",pnpm,0,11.5.3,,HIGH,CWE-494;CWE-78;CWE-829,
 CVE-2026-55697,2026-06-26T23:20:47Z,"pnpm: Repository-controlled configDependencies can select a pacquet native install engine",pnpm,11.0.0,11.5.3,,HIGH,CWE-494;CWE-78;CWE-829,
 CVE-2026-55698,2026-06-26T23:34:06Z,"pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes",pnpm,0,10.34.2,,HIGH,CWE-345;CWE-494;CWE-829,
@@ -7149,15 +7187,83 @@ CVE-2026-56357,2026-02-26T15:58:34Z,"n8n: Webhook Forgery on Github Webhook Trig
 CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,0,1.123.25,,MODERATE,CWE-79,
 CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,2.0.0-rc.0,2.11.2,,MODERATE,CWE-79,
 CVE-2026-56761,2026-04-16T01:02:24Z,"hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR",hono,0,4.12.14,,MODERATE,CWE-79,
+CVE-2026-57133,2026-06-18T14:26:54Z,"npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining",praisonai,1.5.1,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
+CVE-2026-57134,2026-06-18T14:25:17Z,"npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation",praisonai,1.5.1,1.7.2,,HIGH,CWE-287;CWE-288;CWE-863,
+CVE-2026-57135,2026-06-18T14:26:28Z,"npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients",praisonai,1.2.3,1.7.2,,HIGH,CWE-653;CWE-693,
+CVE-2026-57136,2026-06-18T14:26:34Z,"npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining",praisonai,1.2.3,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
+CVE-2026-57137,2026-06-18T14:26:51Z,"npm PraisonAI AgentLoop onToolCall approval runs after tool execution",praisonai,1.4.0,1.7.2,,HIGH,CWE-693;CWE-862;CWE-863,
+CVE-2026-57138,2026-06-18T14:26:32Z,"npm PraisonAI codeMode sandbox escape via Function constructor",praisonai,1.4.0,1.7.2,,CRITICAL,CWE-184;CWE-693,
+CVE-2026-57139,2026-06-18T14:26:48Z,"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call",praisonai,1.5.0,1.7.2,,CRITICAL,CWE-1188;CWE-306;CWE-862,
+CVE-2026-57140,2026-06-18T14:26:42Z,"npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation",praisonai,1.6.0,1.7.2,,CRITICAL,CWE-306,
+CVE-2026-57141,2026-06-18T14:26:37Z,"PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool",praisonai,0,1.7.2,,CRITICAL,CWE-94,
+CVE-2026-57441,2026-06-18T14:30:43Z,"MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence",@bitbonsai/mcpvault,0,0.11.4,,MODERATE,CWE-178;CWE-41,
+CVE-2026-57442,2026-06-19T21:42:24Z,"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested",@bitbonsai/mcpvault,0,0.11.5,,MODERATE,CWE-22;CWE-538,
+CVE-2026-57494,2026-06-18T17:20:55Z,"AgenticMail: Cross-agent task authorization bypass in AgenticMail API",@agenticmail/api,0,0.9.64,,HIGH,CWE-639;CWE-862,
+CVE-2026-57495,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/claudecode,0,0.2.39,,HIGH,CWE-306,
+CVE-2026-57495,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/codex,0,0.1.33,,HIGH,CWE-306,
+CVE-2026-57495,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/core,0,0.9.43,,HIGH,CWE-306,
+CVE-2026-57495,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/openclaw,0,0.5.71,,HIGH,CWE-306,
 CVE-2026-5758,2026-04-15T18:31:58Z,"Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution",protocol-buffers-schema,0,3.6.1,,MODERATE,CWE-1321,
 CVE-2026-5831,2026-04-09T03:31:14Z,"Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts",taskflow-ai,0,2.1.9,,MODERATE,CWE-77,
 CVE-2026-5832,2026-04-09T03:31:15Z,"api-lab-mcp vulnerable to SSRF",api-lab-mcp,0,,0.2.1,MODERATE,CWE-918,
 CVE-2026-5833,2026-04-09T06:30:27Z,"awwaiid mcp-server-taskwarrior vulnerable to command injection",mcp-server-taskwarrior,0,,1.0.1,LOW,CWE-74,
 CVE-2026-58399,2026-06-18T17:22:47Z,"@acastellon/auth: Authentication bypass via spoofable headers in validateToken()",@acastellon/auth,0,2.3.0,,CRITICAL,CWE-290,
 CVE-2026-5842,2026-04-09T06:30:28Z,"decolua 9router vulnerable to authorization bypass",9router,0,0.3.75,,MODERATE,CWE-285,
+CVE-2026-58661,2026-07-22T22:25:45Z,"n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads",n8n,0,1.123.58,,MODERATE,CWE-770,
+CVE-2026-58661,2026-07-22T22:25:45Z,"n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads",n8n,2.0.0,2.28.0,,MODERATE,CWE-770,
+CVE-2026-59206,2026-07-22T21:57:21Z,"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration",n8n,0,1.123.61,,HIGH,CWE-1321,
+CVE-2026-59206,2026-07-22T21:57:21Z,"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration",n8n,2.0.0-rc.0,2.27.4,,HIGH,CWE-1321,
+CVE-2026-59206,2026-07-22T21:57:21Z,"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration",n8n,2.28.0,2.28.1,,HIGH,CWE-1321,
+CVE-2026-59207,2026-07-22T21:58:31Z,"n8n: ""Allowed HTTP Request Domains"" Restriction Bypass via AI Agents MCP Connector",n8n,0,2.27.4,,HIGH,CWE-693,
+CVE-2026-59207,2026-07-22T21:58:31Z,"n8n: ""Allowed HTTP Request Domains"" Restriction Bypass via AI Agents MCP Connector",n8n,2.28.0,2.28.1,,HIGH,CWE-693,
+CVE-2026-59208,2026-07-22T21:59:15Z,"n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution",n8n,0,2.27.4,,HIGH,CWE-287;CWE-346,
+CVE-2026-59208,2026-07-22T21:59:15Z,"n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution",n8n,2.28.0,2.28.1,,HIGH,CWE-287;CWE-346,
+CVE-2026-59209,2026-07-22T21:54:53Z,"n8n: Shared Credential Header Leak via HTTP Request Pagination Expression",n8n,0,1.123.61,,HIGH,CWE-200,
+CVE-2026-59209,2026-07-22T21:54:53Z,"n8n: Shared Credential Header Leak via HTTP Request Pagination Expression",n8n,2.0.0-rc.0,2.27.4,,HIGH,CWE-200,
+CVE-2026-59209,2026-07-22T21:54:53Z,"n8n: Shared Credential Header Leak via HTTP Request Pagination Expression",n8n,2.28.0,2.28.1,,HIGH,CWE-200,
+CVE-2026-59253,2026-07-22T22:24:43Z,"n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects",n8n,0,2.28.0,,MODERATE,CWE-639,
+CVE-2026-59254,2026-07-22T22:23:29Z,"n8n: External Secrets Accessible via Workflow Expressions Outside Credentials",n8n,0,2.27.4,,MODERATE,CWE-639,
+CVE-2026-59254,2026-07-22T22:23:29Z,"n8n: External Secrets Accessible via Workflow Expressions Outside Credentials",n8n,2.28.0,2.28.1,,MODERATE,CWE-639,
+CVE-2026-59257,2026-07-22T22:22:22Z,"n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,0,1.123.61,,MODERATE,CWE-89,
+CVE-2026-59257,2026-07-22T22:22:22Z,"n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,2.0.0-rc.0,2.27.4,,MODERATE,CWE-89,
+CVE-2026-59257,2026-07-22T22:22:22Z,"n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,2.28.0,2.28.1,,MODERATE,CWE-89,
+CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,0,1.123.61,,MODERATE,CWE-639,
+CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,2.0.0-rc.0,2.27.4,,MODERATE,CWE-639,
+CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,2.28.0,2.28.1,,MODERATE,CWE-639,
+CVE-2026-59725,2026-07-20T21:49:54Z,"Socket.IO: Engine.IO Polling Transport Connection Exhaustion",engine.io,4.1.0,6.6.7,,HIGH,CWE-404,
+CVE-2026-59727,2026-07-20T23:21:02Z,"Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands",astro,3.10.0,7.0.4,,LOW,CWE-116;CWE-79;CWE-83,
+CVE-2026-59728,2026-07-20T23:21:47Z,"@astrojs/rss: XML Injection via Unescaped RSS Feed Fields",@astrojs/rss,1.0.0,4.0.19,,MODERATE,CWE-91,
+CVE-2026-59729,2026-07-20T23:21:58Z,"Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)",astro,0,7.0.6,,MODERATE,CWE-79,
+CVE-2026-59730,2026-07-20T23:22:22Z,"@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect",@astrojs/node,8.1.0,11.0.2,,LOW,CWE-601,
+CVE-2026-59731,2026-07-20T21:58:27Z,"Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch",astro,6.4.7,6.4.8,,HIGH,CWE-647,
 CVE-2026-59800,2026-07-02T20:17:56Z,"9router: Missing Authorization and OS Command Injection",9router,0,0.4.44,,CRITICAL,CWE-78;CWE-862,
 CVE-2026-5986,2026-04-10T00:30:31Z,"Zod jsVideoUrlParser vulnerable to ReDoS in util.js",js-video-url-parser,0,,0.5.1,MODERATE,CWE-400,
+CVE-2026-59868,2026-07-20T21:19:27Z,"js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml",js-yaml,5.0.0,5.2.0,,MODERATE,CWE-400;CWE-407;CWE-770,
+CVE-2026-59869,2026-07-20T21:19:09Z,"js-yaml: YAML merge-key chains can force quadratic CPU consumption",js-yaml,3.0.0,3.15.0,,HIGH,CWE-400;CWE-407,
+CVE-2026-59869,2026-07-20T21:19:09Z,"js-yaml: YAML merge-key chains can force quadratic CPU consumption",js-yaml,4.0.0,4.3.0,,HIGH,CWE-400;CWE-407,
+CVE-2026-59870,2026-07-20T21:18:51Z,"js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA",js-yaml,5.0.0,5.2.1,,MODERATE,CWE-407;CWE-770,
+CVE-2026-59871,2026-07-20T21:53:14Z,"node-tar: Process crash via PAX numeric path type confusion",tar,0,7.5.18,,MODERATE,CWE-704,
+CVE-2026-59873,2026-07-20T21:52:03Z,"node-tar: Decompression/parse DoS via unlimited input",tar,0,7.5.19,,CRITICAL,CWE-770,
+CVE-2026-59874,2026-07-20T21:51:39Z,"node-tar: Negative tar entry size causes infinite loop in archive replace",tar,0,7.5.18,,HIGH,CWE-835,
+CVE-2026-59875,2026-07-20T21:51:12Z,"node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records",tar,0,7.5.17,,MODERATE,CWE-248,
+CVE-2026-59876,2026-07-20T22:04:07Z,"protobufjs: Text Format string map parsing can mutate returned map object prototype",protobufjs,8.2.0,8.6.5,,MODERATE,CWE-1321,
+CVE-2026-59877,2026-07-20T22:03:00Z,"protobufjs: Denial of Service via infinite loop in .proto option parsing",protobufjs,7.5.0,7.6.5,,MODERATE,CWE-835,
+CVE-2026-59877,2026-07-20T22:03:00Z,"protobufjs: Denial of Service via infinite loop in .proto option parsing",protobufjs,8.0.0,8.6.6,,MODERATE,CWE-835,
+CVE-2026-59879,2026-07-21T18:36:27Z,"Immutable.js `List` 32-bit trie overflow → unrecoverable DoS",immutable,0,4.3.9,,HIGH,"CWE-1284;CWE-190;CWE-400;CWE-835",
+CVE-2026-59879,2026-07-21T18:36:27Z,"Immutable.js `List` 32-bit trie overflow → unrecoverable DoS",immutable,5.0.0-beta.1,5.1.8,,HIGH,"CWE-1284;CWE-190;CWE-400;CWE-835",
+CVE-2026-59880,2026-07-21T19:02:33Z,"Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set",immutable,0,4.3.9,,HIGH,CWE-400;CWE-407,
+CVE-2026-59880,2026-07-21T19:02:33Z,"Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set",immutable,5.0.0-beta.1,5.1.8,,HIGH,CWE-400;CWE-407,
+CVE-2026-59887,2026-07-21T19:06:09Z,"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text",linkify-it,0,5.0.2,,HIGH,CWE-407,
+CVE-2026-59891,2026-07-21T19:34:05Z,"Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry",@sigstore/oci,0,0.7.1,,CRITICAL,CWE-522,
+CVE-2026-59892,2026-07-21T19:07:28Z,"OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header","@opentelemetry/propagator-jaeger",0,2.9.0,,HIGH,CWE-248,
+CVE-2026-59895,2026-07-21T18:33:50Z,"Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility",hono,4.0.0,4.12.27,,MODERATE,CWE-116;CWE-79,
+CVE-2026-59896,2026-07-21T18:34:19Z,"hono/jsx does not isolate context per request, leading to cross-request data disclosure",hono,4.11.8,4.12.27,,MODERATE,CWE-362,
+CVE-2026-59897,2026-07-21T18:18:13Z,"Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication",hono,4.3.3,4.12.27,,MODERATE,CWE-348,
+CVE-2026-59940,2026-07-24T16:14:05Z,"seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization",seroval,0,1.5.3,,CRITICAL,CWE-502;CWE-843,
+CVE-2026-59952,2026-07-24T16:14:31Z,"Valibot: record() issue paths can make flatten() throw for inherited Object property names",valibot,0,1.4.2,,MODERATE,CWE-755,
 CVE-2026-6011,2026-04-10T06:31:38Z,"OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts",openclaw,0,2026.1.29,,LOW,CWE-918,
+CVE-2026-61835,2026-07-20T21:47:17Z,"Directus: SSRF Protection Bypass via 0.0.0.0 in File Import",directus,0,12.0.0,,HIGH,CWE-918,
+CVE-2026-61836,2026-07-20T21:48:15Z,"Directus: Authorization-dependent response served from unsegmented cache key",directus,0,12.0.0,,HIGH,CWE-524;CWE-639,
 CVE-2026-6216,2026-04-13T21:30:45Z,"DbGate has cross site scripting via the  SVG Icon String Handler component",dbgate-web,0,7.1.5,,LOW,CWE-79,
 CVE-2026-6270,2026-04-16T22:29:04Z,"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes",@fastify/middie,0,9.3.2,,CRITICAL,CWE-436,
 CVE-2026-6321,2026-05-08T17:15:09Z,"fast-uri vulnerable to path traversal via percent-encoded dot segments",fast-uri,0,3.1.1,,HIGH,CWE-22,
@@ -7165,6 +7271,68 @@ CVE-2026-6322,2026-05-08T19:13:01Z,"fast-uri vulnerable to host confusion via pe
 CVE-2026-6402,2026-05-18T13:31:42Z,"webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins",webpack-dev-server,0,5.2.4,,MODERATE,CWE-749,
 CVE-2026-6410,2026-04-16T22:34:30Z,"@fastify/static vulnerable to path traversal in directory listing",@fastify/static,8.0.0,9.1.1,,MODERATE,CWE-22,
 CVE-2026-6414,2026-04-16T22:34:03Z,"@fastify/static vulnerable to route guard bypass via encoded path separators",@fastify/static,8.0.0,9.1.1,,MODERATE,CWE-177,
+CVE-2026-64641,2026-07-22T22:59:01Z,"Next.js: Denial of Service in App Router using Server Actions",next,13.0.0,15.5.21,,HIGH,CWE-834,
+CVE-2026-64641,2026-07-22T22:59:01Z,"Next.js: Denial of Service in App Router using Server Actions",next,16.0.0,16.2.11,,HIGH,CWE-834,
+CVE-2026-64642,2026-07-22T22:59:38Z,"Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale",next,16.0.0,16.2.11,,HIGH,CWE-285,
+CVE-2026-64643,2026-07-22T23:00:34Z,"Next.js: Unauthenticated disclosure of internal Server Function endpoints",next,13.0.0,15.5.21,,MODERATE,CWE-201,
+CVE-2026-64643,2026-07-22T23:00:34Z,"Next.js: Unauthenticated disclosure of internal Server Function endpoints",next,16.0.0,16.2.11,,MODERATE,CWE-201,
+CVE-2026-64644,2026-07-22T23:02:05Z,"Next.js: Denial of Service in the Image Optimization API using SVGs",next,15.5.0,15.5.21,,MODERATE,CWE-407,
+CVE-2026-64644,2026-07-22T23:02:05Z,"Next.js: Denial of Service in the Image Optimization API using SVGs",next,16.0.0,16.2.11,,MODERATE,CWE-407,
+CVE-2026-64645,2026-07-22T23:02:23Z,"Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname",next,12.0.0,15.5.21,,HIGH,CWE-918,
+CVE-2026-64645,2026-07-22T23:02:23Z,"Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname",next,16.0.0,16.2.11,,HIGH,CWE-918,
+CVE-2026-64646,2026-07-22T23:02:43Z,"Next.js: Unbounded Server Action payload in Edge runtime",next,13.0.0,15.5.21,,MODERATE,CWE-770,
+CVE-2026-64646,2026-07-22T23:02:43Z,"Next.js: Unbounded Server Action payload in Edge runtime",next,16.0.0,16.2.11,,MODERATE,CWE-770,
+CVE-2026-64647,2026-07-22T23:06:12Z,"Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences",next,13.0.0,15.5.21,,MODERATE,CWE-116,
+CVE-2026-64647,2026-07-22T23:06:12Z,"Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences",next,16.0.0,16.2.11,,MODERATE,CWE-116,
+CVE-2026-64648,2026-07-22T23:08:17Z,"Next.js: Cache confusion of response bodies for requests with bodies",next,13.0.0,15.5.21,,MODERATE,CWE-524,
+CVE-2026-64648,2026-07-22T23:08:17Z,"Next.js: Cache confusion of response bodies for requests with bodies",next,16.0.0,16.2.11,,MODERATE,CWE-524,
+CVE-2026-64649,2026-07-22T23:09:48Z,"Next.js: Server-Side Request Forgery in Server Actions on custom servers",next,14.1.1,15.5.21,,HIGH,CWE-918,
+CVE-2026-64649,2026-07-22T23:09:48Z,"Next.js: Server-Side Request Forgery in Server Actions on custom servers",next,16.0.0,16.2.11,,HIGH,CWE-918,
+CVE-2026-65014,2026-07-22T22:36:10Z,"n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook",n8n,0,2.27.4,,MODERATE,CWE-306,
+CVE-2026-65015,2026-07-22T17:55:55Z,"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool",n8n,0,2.29.8,,HIGH,CWE-863,
+CVE-2026-65015,2026-07-22T17:55:55Z,"n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool",n8n,2.30.0,2.30.1,,HIGH,CWE-863,
+CVE-2026-65016,2026-07-22T22:04:04Z,"n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",n8n,0,1.123.64,,HIGH,CWE-639,
+CVE-2026-65016,2026-07-22T22:04:04Z,"n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-639,
+CVE-2026-65016,2026-07-22T22:04:04Z,"n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",n8n,2.30.0,2.30.1,,HIGH,CWE-639,
+CVE-2026-65589,2026-07-22T22:54:01Z,"n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data",n8n,0,1.123.64,,MODERATE,CWE-532,
+CVE-2026-65589,2026-07-22T22:54:01Z,"n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data",n8n,2.0.0-rc.0,2.29.8,,MODERATE,CWE-532,
+CVE-2026-65589,2026-07-22T22:54:01Z,"n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data",n8n,2.30.0,2.30.1,,MODERATE,CWE-532,
+CVE-2026-65590,2026-07-22T22:28:24Z,"n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows",n8n,0,2.29.8,,MODERATE,CWE-78,
+CVE-2026-65590,2026-07-22T22:28:24Z,"n8n: computer-use Shell Sandbox Not Enforced on Linux and Windows",n8n,2.30.0,2.30.1,,MODERATE,CWE-78,
+CVE-2026-65591,2026-07-22T22:02:04Z,"n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,0,1.123.64,,HIGH,CWE-917,
+CVE-2026-65591,2026-07-22T22:02:04Z,"n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-917,
+CVE-2026-65591,2026-07-22T22:02:04Z,"n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,2.30.0,2.30.1,,HIGH,CWE-917,
+CVE-2026-65592,2026-07-22T17:59:07Z,"n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`",n8n,0,1.123.64,,HIGH,CWE-79,
+CVE-2026-65592,2026-07-22T17:59:07Z,"n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-79,
+CVE-2026-65592,2026-07-22T17:59:07Z,"n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`",n8n,2.30.0,2.30.1,,HIGH,CWE-79,
+CVE-2026-65593,2026-07-22T22:01:10Z,"n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,0,1.123.64,,MODERATE,CWE-918,
+CVE-2026-65593,2026-07-22T22:01:10Z,"n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,2.0.0-rc.0,2.29.8,,MODERATE,CWE-918,
+CVE-2026-65593,2026-07-22T22:01:10Z,"n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,2.30.0,2.30.1,,MODERATE,CWE-918,
+CVE-2026-65594,2026-07-22T22:31:01Z,"n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check",n8n,0,2.29.8,,MODERATE,CWE-863,
+CVE-2026-65594,2026-07-22T22:31:01Z,"n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check",n8n,2.30.0,2.30.1,,MODERATE,CWE-863,
+CVE-2026-65595,2026-07-22T22:00:07Z,"n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",n8n,0,2.29.8,,HIGH,CWE-269,
+CVE-2026-65595,2026-07-22T22:00:07Z,"n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",n8n,2.30.0,2.30.1,,HIGH,CWE-269,
+CVE-2026-65596,2026-07-22T22:32:23Z,"n8n: GraphQL Node Bypasses ""Allowed HTTP Request Domains"" Restriction",n8n,0,1.123.64,,MODERATE,CWE-863,
+CVE-2026-65596,2026-07-22T22:32:23Z,"n8n: GraphQL Node Bypasses ""Allowed HTTP Request Domains"" Restriction",n8n,2.0.0,2.29.8,,MODERATE,CWE-863,
+CVE-2026-65596,2026-07-22T22:32:23Z,"n8n: GraphQL Node Bypasses ""Allowed HTTP Request Domains"" Restriction",n8n,2.30.0,2.30.1,,MODERATE,CWE-863,
+CVE-2026-65597,2026-07-22T17:57:14Z,"n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview",n8n,0,1.123.64,,HIGH,CWE-79,
+CVE-2026-65597,2026-07-22T17:57:14Z,"n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-79,
+CVE-2026-65597,2026-07-22T17:57:14Z,"n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview",n8n,2.30.0,2.30.1,,HIGH,CWE-79,
+CVE-2026-65598,2026-07-22T17:56:35Z,"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution",n8n,0,1.123.64,,HIGH,CWE-367,
+CVE-2026-65598,2026-07-22T17:56:35Z,"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution",n8n,2.0.0-rc.0,2.29.8,,HIGH,CWE-367,
+CVE-2026-65598,2026-07-22T17:56:35Z,"n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution",n8n,2.30.0,2.30.1,,HIGH,CWE-367,
+CVE-2026-65599,2026-07-22T18:00:09Z,"n8n: Google Service Account Private Key Exposed in JWT Header",n8n,0,1.123.64,,MODERATE,CWE-312,
+CVE-2026-65599,2026-07-22T18:00:09Z,"n8n: Google Service Account Private Key Exposed in JWT Header",n8n,2.0.0-rc.0,2.29.8,,MODERATE,CWE-312,
+CVE-2026-65599,2026-07-22T18:00:09Z,"n8n: Google Service Account Private Key Exposed in JWT Header",n8n,2.30.0,2.30.1,,MODERATE,CWE-312,
+CVE-2026-65898,2026-06-18T14:27:37Z,"DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",dompurify,0,3.4.11,,MODERATE,CWE-471;CWE-665;CWE-79,
+CVE-2026-65899,2026-06-15T20:12:53Z,"DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",dompurify,0,3.4.9,,LOW,CWE-693,
+CVE-2026-65900,2026-06-15T20:02:40Z,"DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",dompurify,3.0.0,3.4.8,,LOW,CWE-79,
+CVE-2026-65901,2026-06-15T20:00:02Z,"DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",dompurify,0,,3.4.6,LOW,CWE-79,
+CVE-2026-65902,2026-06-15T19:59:09Z,"DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",dompurify,0,3.4.7,,MODERATE,CWE-501;CWE-693,
+CVE-2026-65903,2026-04-16T00:46:35Z,"DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",dompurify,0,3.4.0,,MODERATE,CWE-783,
+CVE-2026-65912,2026-04-03T03:46:07Z,"DOMPurify ADD_ATTR predicate skips URI validation",dompurify,0,3.3.2,,MODERATE,CWE-183,
+CVE-2026-65913,2026-04-03T03:45:08Z,"DOMPurify USE_PROFILES prototype pollution allows event handlers",dompurify,0,3.3.2,,MODERATE,CWE-1321,
+CVE-2026-65914,2026-03-27T20:41:29Z,"DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",dompurify,0,3.3.2,,MODERATE,CWE-79,
 CVE-2026-6594,2026-04-20T03:34:41Z,"Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization",@brikcss/merge,0,,1.3.1,MODERATE,CWE-1321;CWE-94,
 CVE-2026-6733,2026-06-19T14:19:13Z,"undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse",undici,0,6.27.0,,LOW,CWE-367,
 CVE-2026-6733,2026-06-19T14:19:13Z,"undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse",undici,7.0.0,7.28.0,,LOW,CWE-367,
@@ -7173,6 +7341,7 @@ CVE-2026-6734,2026-06-19T14:20:20Z,"undici vulnerable to cross-origin request ro
 CVE-2026-6734,2026-06-19T14:20:20Z,"undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse",undici,8.0.0,8.2.0,,HIGH,CWE-346,
 CVE-2026-6874,2026-04-23T00:31:20Z,"copilot-api has Reliance on Reverse DNS Resolution for a Security-Critical Action",copilot-api,0,,0.7.0,LOW,CWE-350,
 CVE-2026-6951,2026-04-25T06:30:23Z,"simple-git is vulnerable to Remote Code Execution",simple-git,0,3.36.0,,HIGH,CWE-94,
+CVE-2026-7120,2026-07-24T16:43:44Z,"@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths",@fastify/static,0,10.1.2,,MODERATE,CWE-180,
 CVE-2026-7223,2026-04-28T06:30:29Z,"BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue",@dadigua/hyperchat,0,,2.0.0-alpha.63,MODERATE,CWE-918,
 CVE-2026-7446,2026-04-30T00:31:22Z,"mcp-server-semgrep has a Command Injection issue",mcp-server-semgrep,0,1.0.1,,MODERATE,CWE-77,
 CVE-2026-7600,2026-05-02T03:31:13Z,"yii2-mcp-server has a Command Injection Issue",yii2-mcp-server,0,,1.0.2,LOW,CWE-77,
@@ -7262,22 +7431,33 @@ GHSA-2mj8-pj3j-h362,2020-09-04T17:17:39Z,"Symlink reference outside of node_modu
 GHSA-2mvq-xp48-4c77,2020-09-03T20:35:29Z,"Denial of Service in subtext",subtext,0.0.0,,,HIGH,CWE-400,
 GHSA-2mxc-m4c3-wqhq,2020-09-03T22:50:46Z,"Malicious Package in ruffer-xor",ruffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2p3c-p3qw-69r4,2022-10-12T14:15:48Z,"The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations",apollo-server,2.0.0,2.25.4,,MODERATE,CWE-352,
+GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,1.0.0,2.8.3,,HIGH,CWE-184;CWE-79,
+GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,3.0.0,3.3.4,,HIGH,CWE-184;CWE-79,
+GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,4.0.0,4.0.2,,HIGH,CWE-184;CWE-79,
 GHSA-2p62-c4rm-mr72,2020-09-01T19:44:57Z,"Malicious Package in another-date-picker",another-date-picker,2.0.43,2.0.45,,CRITICAL,CWE-506,
 GHSA-2p99-6f47-8x9j,2020-09-02T18:38:39Z,"Malicious Package in asnc",asnc,0,,,CRITICAL,CWE-506,
 GHSA-2pr6-76vf-7546,2019-06-05T14:35:29Z,"Denial of Service in js-yaml",js-yaml,0,3.13.0,,MODERATE,CWE-400,
+GHSA-2qp2-6frj-p9pq,2026-07-08T15:32:02Z,"Duplicate Advisory: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,0,,,MODERATE,CWE-89,
 GHSA-2qqc-p94c-hxwh,2026-04-16T21:22:00Z,"Flowise: Weak Default Express Session Secret",flowise,0,3.1.0,,MODERATE,CWE-798,
 GHSA-2r2p-4cgf-hv7h,2026-04-22T14:52:03Z,"engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection",engramx,0,2.0.2,,HIGH,"CWE-1188;CWE-306;CWE-352;CWE-942",
 GHSA-2r8f-2665-3gxq,2020-09-02T21:36:36Z,"Malicious Package in froever",froever,0,,,CRITICAL,CWE-506,
 GHSA-2r8f-cf6w-x5vq,2026-02-03T18:30:47Z,"Duplicate Advisory: FUXA contains a hard-coded credential vulnerability",fuxa-server,0,,1.2.7,HIGH,CWE-798,
+GHSA-2rp8-mm9q-fp49,2026-07-21T21:59:23Z," TypeORM: migration:generate template-literal code injection",typeorm,0,0.3.31,,MODERATE,CWE-94,
+GHSA-2rp8-mm9q-fp49,2026-07-21T21:59:23Z," TypeORM: migration:generate template-literal code injection",typeorm,1.0.0,1.1.0,,MODERATE,CWE-94,
 GHSA-2rqg-gjgv-84jm,2026-03-13T20:55:30Z,"OpenClaw: Gateway `agent` calls could override the workspace boundary",openclaw,0,2026.3.11,,HIGH,CWE-668,
 GHSA-2vg6-77g8-24mp,2026-07-07T20:56:45Z,"Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows",@better-auth/scim,1.6.0,1.6.11,,LOW,CWE-459;CWE-613;CWE-672,
 GHSA-2vg6-77g8-24mp,2026-07-07T20:56:45Z,"Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows",better-auth,0.3.4,1.6.11,,LOW,CWE-459;CWE-613;CWE-672,
 GHSA-2vqq-jgxx-fxjc,2020-09-11T21:24:33Z,"Malicious Package in motiv.scss",motiv.scss,0.4.20,0.4.21,,CRITICAL,CWE-506,
+GHSA-2vww-6p9h-5g8j,2026-07-10T15:31:41Z,"Duplicate Advisory: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads",n8n,0,,,MODERATE,CWE-770,
 GHSA-2vx9-7wpg-88jq,2026-05-19T15:55:43Z,"n8n: Legacy ExecuteWorkflow Node Bypassed File Path Restrictions",n8n,0,2.19.3,,MODERATE,CWE-22,
 GHSA-2w22-3f6x-3hf4,2026-06-16T21:32:00Z,"Duplicate Advisory: Workspace-derived service PATH could influence trash command selection",openclaw,0,,,HIGH,CWE-426,
 GHSA-2w8g-m5j8-7m87,2022-01-12T21:45:59Z,"Zalgo-like output that crashes the server",@soketi/soketi,0,0.26.1,,CRITICAL,,
 GHSA-2w8q-69fh-9gq6,2020-09-03T22:25:09Z,"Malicious Package in bufger-xor",bufger-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2w9p-xf5h-qwj3,2023-03-27T03:30:16Z,"Duplicate Advisory: pullit Command Injection vulnerability",pullit,0,,,HIGH,,
+GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,0,1.123.67,,HIGH,CWE-200;CWE-843;CWE-918,
+GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-200;CWE-843;CWE-918,
+GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,2.32.0,2.32.1,,HIGH,CWE-200;CWE-843;CWE-918,
+GHSA-2xgg-r2wc-c5r2,2026-07-24T21:26:19Z,"Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector",@budibase/server,0,,3.38.1,HIGH,CWE-89,
 GHSA-2xp4-qhr4-xqm2,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode",openclaw,0,2026.3.31,,LOW,CWE-352,
 GHSA-2xv3-h762-ccxv,2019-05-29T19:18:02Z,"Out-of-bounds Read in concat-with-sourcemaps",concat-with-sourcemaps,1.0.0,1.0.6,,MODERATE,CWE-125,
 GHSA-2xw5-3767-qxvm,2020-09-11T21:21:20Z,"Malicious Package in ng-ui-library",ng-ui-library,1.0.987,1.0.990,,CRITICAL,CWE-506,
@@ -7307,13 +7487,14 @@ GHSA-388g-jwpg-x6j4,2020-09-11T21:20:14Z,"Cross-Site Scripting in swagger-ui",sw
 GHSA-38c7-23hj-2wgq,2026-02-26T22:47:06Z,"n8n has Webhook Forgery on Zendesk Trigger Node",n8n,0,1.123.18,,MODERATE,CWE-290,
 GHSA-38c7-23hj-2wgq,2026-02-26T22:47:06Z,"n8n has Webhook Forgery on Zendesk Trigger Node",n8n,2.0.0,2.6.2,,MODERATE,CWE-290,
 GHSA-38cw-85xc-xr9x,2026-01-16T21:04:12Z,"Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM",@veramo/data-store,0,6.0.2,,MODERATE,CWE-89,
+GHSA-38fj-36m5-783c,2026-07-22T12:32:17Z,"Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,0,,,MODERATE,CWE-918,
+GHSA-38hq-7x33-php4,2026-07-24T16:20:59Z,"@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass","@backstage/plugin-auth-backend",0,0.29.2,,MODERATE,CWE-601,
 GHSA-38hx-3542-8fh3,2020-10-01T17:09:56Z,"Malicious code in `electorn`",electorn,0,,10.0.0,CRITICAL,CWE-506,
 GHSA-38vq-cjh5-vw7x,2020-09-03T18:13:41Z,"Malicious Package in nodes.js",nodes.js,0.0.0,,,CRITICAL,CWE-506,
 GHSA-392f-ggf5-fp3c,2026-03-02T21:49:33Z,"OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists",openclaw,0,2026.3.1,,MODERATE,CWE-176;CWE-436,
 GHSA-394x-274p-mqc6,2026-04-24T00:31:52Z,"Duplicate Advisory: OpenClaw: Gateway operator.write Can Reach Admin-Class Telegram Config and Cron Persistence via send",openclaw,0,2026.3.28,,HIGH,CWE-269,
 GHSA-39h7-pwv7-rc3x,2026-04-24T20:41:51Z,"Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)","@excalidraw/mermaid-to-excalidraw",0.3.0,1.1.3,,MODERATE,CWE-1395;CWE-79,
 GHSA-39h7-pwv7-rc3x,2026-04-24T20:41:51Z,"Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)",@excalidraw/excalidraw,0.18.0,0.18.1,,MODERATE,CWE-1395;CWE-79,
-GHSA-39q2-94rc-95cp,2026-04-16T00:46:35Z,"DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation",dompurify,0,3.4.0,,MODERATE,CWE-783,
 GHSA-3c7f-5hgj-h279,2026-03-27T18:06:49Z,"n8n has XSS in Chat Trigger Node through Custom CSS",n8n,0,1.123.27,,MODERATE,CWE-79,
 GHSA-3c7f-5hgj-h279,2026-03-27T18:06:49Z,"n8n has XSS in Chat Trigger Node through Custom CSS",n8n,2.0.0-rc.0,2.13.3,,MODERATE,CWE-79,
 GHSA-3c7f-5hgj-h279,2026-03-27T18:06:49Z,"n8n has XSS in Chat Trigger Node through Custom CSS",n8n,2.14.0,2.14.1,,MODERATE,CWE-79,
@@ -7334,6 +7515,7 @@ GHSA-3j63-5h8p-gf7c,2025-08-20T20:51:55Z,"x402 SDK vulnerable in outdated versio
 GHSA-3j63-5h8p-gf7c,2025-08-20T20:51:55Z,"x402 SDK vulnerable in outdated versions in resource servers for builders",x402-express,0,0.5.2,,HIGH,,
 GHSA-3j63-5h8p-gf7c,2025-08-20T20:51:55Z,"x402 SDK vulnerable in outdated versions in resource servers for builders",x402-hono,0,0.5.2,,HIGH,,
 GHSA-3j63-5h8p-gf7c,2025-08-20T20:51:55Z,"x402 SDK vulnerable in outdated versions in resource servers for builders",x402-next,0,0.5.2,,HIGH,,
+GHSA-3j7v-fhjg-6rh2,2026-07-15T12:32:03Z,"Duplicate Advisory: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials",n8n,0,,,MODERATE,CWE-639,
 GHSA-3jx4-q2m7-r496,2026-03-04T19:21:04Z,"OpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations",openclaw,0,2026.2.25,,HIGH,CWE-59;CWE-668,
 GHSA-3mhm-jvqj-fvhg,2020-09-03T23:09:37Z,"Malicious Package in js-sia3",js-sia3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-3mjm-x6gw-2x42,2026-03-25T17:32:04Z,"@grackle-ai/server has Missing Content-Security-Policy and X-Frame-Options Headers",@grackle-ai/server,0,0.70.4,,MODERATE,CWE-693;CWE-79,
@@ -7344,6 +7526,7 @@ GHSA-3p92-886g-qxpq,2019-06-04T15:42:32Z,"Remote Memory Exposure in floody",floo
 GHSA-3pw3-v88x-xj24,2026-04-16T22:45:14Z,"Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath",@paperclipai/shared,0,2026.416.0,,MODERATE,CWE-73,
 GHSA-3qmc-2r76-4rqp,2022-11-10T15:51:01Z,"Redwood is vulnerable to account takeover via dbAuth ""forgot-password"" ",@redwoodjs/api,0.38.0,2.2.5,,HIGH,,
 GHSA-3qmc-2r76-4rqp,2022-11-10T15:51:01Z,"Redwood is vulnerable to account takeover via dbAuth ""forgot-password"" ",@redwoodjs/api,3.0.0,3.3.1,,HIGH,,
+GHSA-3r53-75j5-3g7j,2026-07-24T22:36:45Z,"Quasar: Prototype pollution in the extend() utility",quasar,0,2.22.0,,MODERATE,CWE-1321,
 GHSA-3r56-7hhr-vfg9,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets",openclaw,0,2026.4.5,,MODERATE,CWE-601,
 GHSA-3r78-rqg8-95gg,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse",openclaw,0,,,MODERATE,CWE-294,
 GHSA-3rw8-4xrq-3f7p,2025-03-17T21:30:34Z,"Duplicate Advisory: Uptime Kuma ReDoS vulnerability",uptime-kuma,1.23.0,,2.0.0-dev.0,MODERATE,CWE-1333,
@@ -7353,6 +7536,8 @@ GHSA-3wqh-h42r-x8fq,2020-09-03T15:46:22Z,"Denial of Service in @hapi/content",@h
 GHSA-3wqp-prf6-2m72,2026-07-02T17:08:08Z,"OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement",openclaw,0,2026.5.6,,LOW,CWE-862,
 GHSA-3xc7-xg67-pw99,2019-06-05T20:43:10Z,"Sensitive Data Exposure in sequelize-cli",sequelize-cli,0,,5.4.0,LOW,CWE-532,
 GHSA-3xx2-mqjm-hg9x,2026-04-16T22:49:46Z,"Paperclip: Cross-tenant agent API key IDOR in `/agents/:id/keys` routes allows full victim-company compromise",@paperclipai/server,0,2026.416.0,,CRITICAL,CWE-639,
+GHSA-42h9-826w-cgv3,2026-07-20T17:58:59Z,"Axios: Excessive recursion in formDataToJSON can cause denial of service",axios,0.28.0,0.33.0,,MODERATE,CWE-400;CWE-674,
+GHSA-42h9-826w-cgv3,2026-07-20T17:58:59Z,"Axios: Excessive recursion in formDataToJSON can cause denial of service",axios,1.0.0,1.18.0,,MODERATE,CWE-400;CWE-674,
 GHSA-435c-qcpm-wjw5,2020-09-03T17:05:43Z,"Malicious Package in fs-extar",fs-extar,0.0.0,,,CRITICAL,CWE-506,
 GHSA-4363-x42f-xph6,2020-09-03T17:05:14Z,"Malicious Package in hw-trnasport-u2f",hw-trnasport-u2f,0.0.0,,,CRITICAL,CWE-506,
 GHSA-43vf-2x6g-p2m5,2020-09-02T21:33:26Z,"Malicious Package in browserift",browserift,0,,,CRITICAL,CWE-506,
@@ -7361,6 +7546,8 @@ GHSA-44c9-4rg5-qjgq,2026-03-19T03:30:57Z,"Duplicate Advisory: web_search citatio
 GHSA-44vf-8ffm-v2qh,2020-09-02T15:42:47Z,"Sensitive Data Exposure in rails-session-decoder",rails-session-decoder,0.0.0,,,HIGH,,
 GHSA-457r-cqc8-9vj9,2022-11-23T15:39:50Z,"sweetalert2 v10.16.10 and above contains hidden functionality",sweetalert2,10.16.10,11.22.4,,LOW,CWE-912,
 GHSA-4627-w373-375v,2020-09-11T21:22:24Z,"Malicious Package in grunt-radical",grunt-radical,0.0.14,0.0.13,,CRITICAL,,
+GHSA-464c-974j-9xm6,2026-07-24T16:44:20Z,"AWS CDK CodeBuild S3 Log Encryption Boolean Inversion",@aws-cdk/aws-codebuild,1.75.0,,1.204.0,LOW,CWE-311;CWE-682,
+GHSA-464c-974j-9xm6,2026-07-24T16:44:20Z,"AWS CDK CodeBuild S3 Log Encryption Boolean Inversion",aws-cdk-lib,0,2.253.0,,LOW,CWE-311;CWE-682,
 GHSA-46fh-8fc5-xcwx,2020-09-03T18:09:16Z,"Prototype Pollution in lodash.defaultsdeep",lodash.defaultsdeep,0,4.6.1,,HIGH,CWE-1321,
 GHSA-46j5-6fg5-4gv3,2025-12-18T09:30:30Z,"Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion",nodemailer,0,7.0.11,,MODERATE,CWE-674;CWE-703,
 GHSA-474h-prjg-mmw3,2026-03-03T21:31:57Z,"OpenClaw: Sandboxed sessions_spawn(runtime=""acp"") bypassed sandbox inheritance and allowed host ACP initialization",openclaw,0,2026.3.2,,HIGH,CWE-269,
@@ -7380,6 +7567,7 @@ GHSA-4f9m-pxwh-68hg,2020-09-11T21:20:14Z,"Cross-Site Scripting in swagger-ui",sw
 GHSA-4fqg-89cc-5pv5,2020-09-04T14:58:44Z,"Malicious Package in sj-labc",sj-labc,0.0.0,,,CRITICAL,CWE-506,
 GHSA-4fr9-3x69-36wv,2025-10-03T19:27:06Z,"Flowise vulnerable to XSS",flowise,0,3.0.8,,MODERATE,CWE-79,
 GHSA-4g2x-vq5p-5vj6,2024-03-01T20:09:00Z,"Budibase affected by VM2 Constructor Escape Vulnerability",@budibase/server,0,2.20.0,,CRITICAL,CWE-94,
+GHSA-4g3v-8h47-v7g6,2026-07-20T21:08:16Z,"Astro: Reflected XSS via unescaped View Transition animation properties",astro,2.9.0,7.1.0,,MODERATE,CWE-79,
 GHSA-4g53-vp7q-gfjv,2021-05-28T19:18:28Z,"constructEvent does not verify header","@worker-tools/stripe-webhook",0,1.1.4,,HIGH,,
 GHSA-4gpv-cvmq-6526,2020-08-19T22:23:09Z,"Denial of Service in protobufjs",protobufjs,0,5.0.3,,MODERATE,,
 GHSA-4gpv-cvmq-6526,2020-08-19T22:23:09Z,"Denial of Service in protobufjs",protobufjs,6.0.0,6.8.6,,MODERATE,,
@@ -7401,12 +7589,13 @@ GHSA-4mhr-cxr4-2prm,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: Workspac
 GHSA-4pmg-jgm5-3jg6,2020-09-02T21:16:26Z,"Malicious Package in erquest",erquest,0,,,CRITICAL,CWE-506,
 GHSA-4q2f-8g74-qm56,2020-09-03T17:18:05Z,"Cross-Site Scripting in takeapeek",takeapeek,0.0.0,,,HIGH,CWE-79,
 GHSA-4q8f-5xxj-946r,2020-09-03T02:40:51Z,"Command Injection in addax",addax,0,1.1.0,,HIGH,CWE-77,
+GHSA-4qcj-m5wp-jmf4,2026-07-24T21:13:07Z," Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings",@budibase/server,0,,3.38.1,MODERATE,CWE-862,
 GHSA-4qgr-57jq-93vh,2026-06-16T21:31:59Z,"Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots",openclaw,0,,,HIGH,CWE-426,
 GHSA-4qhx-g9wp-g9m6,2019-06-14T16:09:01Z,"Failure to sanitize quotes which can lead to sql injection in squel",squel,0,,5.13.0,CRITICAL,CWE-74;CWE-89,
-GHSA-4qq2-2j2x-x62c,2026-06-18T14:25:17Z,"npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation",praisonai,1.5.1,1.7.2,,HIGH,CWE-287;CWE-288;CWE-863,
 GHSA-4qqc-mp5f-ccv4,2020-09-02T15:05:51Z,"Command Injection in bestzip",bestzip,0,2.1.7,,CRITICAL,CWE-77,
 GHSA-4r97-78gf-q24v,2020-09-04T17:53:27Z,"Duplicate Advisory: Prototype Pollution in klona",klona,0,1.1.1,,HIGH,CWE-1321,
 GHSA-4rgj-8mq3-hggj,2020-09-03T20:32:11Z,"Denial of Service in @hapi/subtext",@hapi/subtext,0,6.1.2,,HIGH,CWE-400,
+GHSA-4v35-78jc-648r,2026-07-22T12:32:17Z,"Duplicate Advisory: computer-use Shell Sandbox Not Enforced on Linux and Windows",@n8n/computer-use,0,,,MODERATE,CWE-78,
 GHSA-4vcf-q4xf-f48m,2025-11-25T21:42:53Z,"Better Auth Passkey Plugin allows passkey deletion through IDOR",@better-auth/passkey,0,1.4.0,,HIGH,CWE-284;CWE-639,
 GHSA-4vjr-crvh-383h,2023-09-27T20:17:00Z,"@napi-rs/image affected by libwebp CVE",@napi-rs/image,0,1.7.0,,HIGH,,
 GHSA-4vmm-mhcq-4x9j,2019-06-14T16:15:14Z,"Sandbox Bypass Leading to Arbitrary Code Execution in constantinople",constantinople,0,3.1.1,,CRITICAL,,
@@ -7435,6 +7624,7 @@ GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket i
 GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
 GHSA-534w-2vm4-89xr,2026-03-03T23:18:26Z,"OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch",openclaw,0,2026.2.24,,MODERATE,CWE-284;CWE-863,
 GHSA-536f-268f-6gxc,2020-09-03T22:17:36Z,"Malicious Package in buffermxor",buffermxor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-53g2-mvcc-q9x3,2026-07-24T16:18:01Z,"Trix: Stored XSS via HTMLParser attribute injection on paste",trix,0,2.1.18,,MODERATE,CWE-79,
 GHSA-53mj-mc38-q894,2020-09-01T19:40:41Z,"Remote Memory Exposure in openwhisk",openwhisk,0,3.3.1,,MODERATE,,
 GHSA-53p3-c7vp-4mcc,2026-03-29T15:22:17Z,"Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)",trix,0,2.1.18,,LOW,CWE-79,
 GHSA-53rv-hcvm-rpp9,2025-01-14T22:03:59Z,"Lodestar snappy decompression issue",@lodestar/reqresp,0,1.25.0,,LOW,CWE-703,
@@ -7503,7 +7693,6 @@ GHSA-5jgm-f9wr-9qm7,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw: Workspac
 GHSA-5jgp-pg4f-q8vj,2020-09-03T19:55:42Z,"Malicious Package in node-ftp",node-ftp,0.0.0,,,CRITICAL,CWE-506,
 GHSA-5jpx-9hw9-2fx4,2025-10-29T10:43:57Z,"NextAuthjs Email misdelivery Vulnerability",next-auth,0,4.24.12,,MODERATE,CWE-200,
 GHSA-5jpx-9hw9-2fx4,2025-10-29T10:43:57Z,"NextAuthjs Email misdelivery Vulnerability",next-auth,5.0.0-beta.0,5.0.0-beta.30,,MODERATE,CWE-200,
-GHSA-5jv7-2mjm-h6qj,2026-06-18T14:26:54Z,"npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining",praisonai,1.5.1,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
 GHSA-5mh4-3rv3-fpcf,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: Host exec environment sanitization misses package, registry, Docker, compiler, and TLS override variables",openclaw,0,2026.3.31,,HIGH,CWE-668,
 GHSA-5mm9-55c9-p5r7,2020-09-03T19:53:31Z,"Malicious Package in mogoose",mogoose,0.0.0,,,CRITICAL,CWE-506,
 GHSA-5mrr-rgp6-x4gr,2020-09-03T19:39:05Z,"Command Injection in marsdb",marsdb,0.0.0,,,CRITICAL,CWE-77,
@@ -7517,6 +7706,7 @@ GHSA-5rrq-pxf6-6jx5,2022-01-08T00:22:42Z,"Prototype Pollution in node-forge debu
 GHSA-5v72-xg48-5rpm,2019-06-04T19:37:52Z,"Denial of Service in ws",ws,0.6.0,1.1.5,,HIGH,CWE-400,
 GHSA-5v72-xg48-5rpm,2019-06-04T19:37:52Z,"Denial of Service in ws",ws,2.0.0,3.3.1,,HIGH,CWE-400,
 GHSA-5v7r-jg9r-vq44,2020-09-03T21:19:46Z,"Insecure Cryptography Algorithm in simple-crypto-js",simple-crypto-js,0,2.3.0,,MODERATE,CWE-327,
+GHSA-5vfw-jc4p-fj39,2026-07-22T12:32:17Z,"Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check",n8n,0,,,MODERATE,CWE-863,
 GHSA-5vj8-3v2h-h38v,2020-09-04T18:04:08Z,"Remote Code Execution in next",next,0.9.9,5.1.0,,HIGH,CWE-20,
 GHSA-5vjq-5jmg-39xq,2026-04-16T01:34:39Z,"Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenance",renovate,43.65.0,43.102.11,,MODERATE,CWE-94,
 GHSA-5vm8-hhgr-jcjp,2021-05-28T19:18:53Z,"Cross-site scripting vulnerability in TinyMCE",tinymce,0,5.7.1,,MODERATE,CWE-79,
@@ -7537,6 +7727,11 @@ GHSA-6475-r3vj-m8vf,2026-01-08T21:52:45Z,"AWS SDK for JavaScript v3 adopted defe
 GHSA-6477-wvjj-47v6,2026-04-24T00:31:52Z,"Duplicate Advisory: OpenClaw: Zalo replay dedupe keys could suppress messages across chats or senders",openclaw,0,2026.4.2,,MODERATE,CWE-706,
 GHSA-647h-p824-99w7,2026-03-25T17:23:11Z,"@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool",@grackle-ai/mcp,0,0.70.2,,HIGH,CWE-284,
 GHSA-64g7-mvw6-v9qj,2022-01-14T21:09:50Z,"Improper Privilege Management in shelljs",shelljs,0,0.8.5,,MODERATE,CWE-269,
+GHSA-64xh-79j6-r5v8,2026-07-22T22:06:06Z,"n8n: Bypass ""Allowed HTTP Request Domains"" Credential Restriction in Multiple AI and LLM Nodes",n8n,0,2.31.5,,HIGH,CWE-863,
+GHSA-64xh-79j6-r5v8,2026-07-22T22:06:06Z,"n8n: Bypass ""Allowed HTTP Request Domains"" Credential Restriction in Multiple AI and LLM Nodes",n8n,2.32.0,2.32.1,,HIGH,CWE-863,
+GHSA-652q-gvq3-74qv,2026-07-22T23:20:24Z,"n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,0,1.123.67,,MODERATE,CWE-89,
+GHSA-652q-gvq3-74qv,2026-07-22T23:20:24Z,"n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-89,
+GHSA-652q-gvq3-74qv,2026-07-22T23:20:24Z,"n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation",n8n,2.32.0,2.32.1,,MODERATE,CWE-89,
 GHSA-657v-jjf8-83gh,2020-09-03T23:14:55Z,"Malicious Package in jsmsha3",jsmsha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6584-gfwm-3vc3,2020-09-03T21:43:01Z,"Malicious Package in budfer-xor",budfer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-659f-22xc-98f2,2026-03-03T23:00:53Z,"OpenClaw hook transform path containment missed symlink-resolved escapes",openclaw,0,2026.2.22,,HIGH,CWE-94,
@@ -7549,6 +7744,10 @@ GHSA-65xx-c85x-wg76,2020-09-04T17:20:52Z,"Command Injection in plotter",plotter,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,0,1.123.55,,MODERATE,CWE-863,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.0.0-rc.0,2.25.7,,MODERATE,CWE-863,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.26.0,2.26.2,,MODERATE,CWE-863,
+GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,0,6.13.10,,MODERATE,CWE-1321,
+GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,7.0.0,7.8.10,,MODERATE,CWE-1321,
+GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,8.0.0,8.24.1,,MODERATE,CWE-1321,
+GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,9.0.0,9.7.2,,MODERATE,CWE-1321,
 GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,0,16.8.2,,HIGH,,
 GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,17.0.0,17.9.2,,HIGH,,
 GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,18.0.0,18.4.1,,HIGH,,
@@ -7586,11 +7785,16 @@ GHSA-6mrq-7r7m-hh4p,2020-09-03T22:52:58Z,"Malicious Package in hs-sha3",hs-sha3,
 GHSA-6q22-g298-grjh,2026-04-04T06:13:25Z,"Directus: Unauthenticated Denial of Service via GraphQL Alias Amplification of Expensive Health Check Resolver",directus,0,11.17.0,,HIGH,CWE-400;CWE-770,
 GHSA-6q2v-vfwp-pvwh,2026-03-29T15:30:20Z,"Duplicate Advisory: OpenClaw's skills-install-download can be redirected outside the tools root by rebinding the validated base path",openclaw,0,2026.3.8,,MODERATE,CWE-367,
 GHSA-6qc7-jgq7-34rf,2020-09-02T20:18:18Z,"Malicious Package in exprss",exprss,0,,,CRITICAL,CWE-506,
+GHSA-6qc9-mqvw-jg7x,2026-07-22T22:10:41Z,"n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`",n8n,0,1.123.67,,HIGH,CWE-863,
+GHSA-6qc9-mqvw-jg7x,2026-07-22T22:10:41Z,"n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-863,
+GHSA-6qc9-mqvw-jg7x,2026-07-22T22:10:41Z,"n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`",n8n,2.32.0,2.32.1,,HIGH,CWE-863,
 GHSA-6qgx-f452-7699,2020-09-03T23:28:39Z,"Malicious Package in superhappyfuntime",superhappyfuntime,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6qqf-vvcr-7qrv,2019-05-23T09:27:22Z,"Cryptographically Weak PRNG in generate-password",generate-password,0,1.4.1,,MODERATE,CWE-338,
 GHSA-6qqj-rx4w-r3cj,2020-08-31T22:48:44Z,"CSRF Vulnerability in jquery-ujs",jquery-ujs,0,1.0.4,,MODERATE,CWE-352,
 GHSA-6r5x-hmgg-7h53,2019-07-15T19:46:01Z,"Remote code execution in Handlebars.js",handlebars,0,4.1.0,,MODERATE,,
 GHSA-6rmx-gvvg-vh6j,2026-03-09T19:52:47Z,"OpenClaw's hooks count non-POST requests toward auth lockout",openclaw,0,2026.3.7,,MODERATE,CWE-307;CWE-799,
+GHSA-6v4m-fw66-8r4x,2026-07-24T22:33:38Z,"Shescape: Path disclosure on Unix with Zsh",shescape,0,2.1.14,,MODERATE,CWE-155;CWE-78,
+GHSA-6v4m-fw66-8r4x,2026-07-24T22:33:38Z,"Shescape: Path disclosure on Unix with Zsh",shescape,3.0.0,3.0.1,,MODERATE,CWE-155;CWE-78,
 GHSA-6v7q-wjvx-w8wg,2026-04-10T20:18:23Z,"basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",basic-ftp,0,5.2.2,,HIGH,CWE-93,
 GHSA-6x2m-hqfw-hvpj,2026-03-02T22:29:45Z,"OpenClaw: Node exec approvals could be replayed across nodes",openclaw,0,2026.2.23,,MODERATE,CWE-285;CWE-863,
 GHSA-6x2m-p4xp-wg22,2026-06-19T21:42:36Z,"Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups",network-ai,0,5.12.2,,MODERATE,CWE-22;CWE-59,
@@ -7601,6 +7805,7 @@ GHSA-6xm4-p6r2-mwrc,2020-09-03T22:47:30Z,"Malicious Package in cuffer-xor",cuffe
 GHSA-724c-6vrf-99rq,2020-09-02T21:49:48Z,"Sensitive Data Exposure in loopback",loopback,0,2.42.0,,LOW,CWE-200,
 GHSA-724c-6vrf-99rq,2020-09-02T21:49:48Z,"Sensitive Data Exposure in loopback",loopback,3.0.0,3.26.0,,LOW,CWE-200,
 GHSA-725f-3pw7-rq6x,2020-09-03T21:09:47Z,"Malicious Package in 8.9.4",8.9.4,0.0.0,,,CRITICAL,CWE-506,
+GHSA-725q-c4vp-q4cg,2026-07-22T12:32:18Z,"Duplicate Advisory: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution",n8n,0,,,HIGH,CWE-367,
 GHSA-72gr-qfp7-vwhw,2026-03-20T20:50:09Z,"h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversal Protection via `%252e%252e`",h3,0,1.15.9,,MODERATE,CWE-22,
 GHSA-72q8-jcmc-97wx,2026-04-25T23:46:31Z,"OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy",openclaw,0,2026.4.20,,MODERATE,CWE-863,
 GHSA-72r4-9c5j-mj57,2026-06-27T00:12:39Z,"pnpm: `patch-remove` could delete project-selected files outside the patches directory",pnpm,0,10.34.4,,HIGH,CWE-22;CWE-73,
@@ -7620,7 +7825,6 @@ GHSA-75hx-xj24-mqrw,2026-04-10T20:59:58Z,"n8n-mcp has unauthenticated session te
 GHSA-762c-v946-pf25,2020-09-04T16:47:33Z,"Malicious Package in bpi39",bpi39,0.0.0,,,CRITICAL,CWE-506,
 GHSA-766v-7gjx-55hf,2020-09-03T23:08:34Z,"Malicious Package in js-shq3",js-shq3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-7696-qr5q-pg37,2020-09-03T23:19:08Z,"Malicious Package in zs-sha3",zs-sha3,0.0.0,,,CRITICAL,CWE-506,
-GHSA-76mc-f452-cxcm,2026-06-15T19:59:09Z,"DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`",dompurify,0,3.4.7,,MODERATE,CWE-501;CWE-693,
 GHSA-76qf-6mvw-c5hm,2020-09-03T19:45:42Z,"Malicious Package in js-base64-int",js-base64-int,0.0.0,,,CRITICAL,CWE-506,
 GHSA-76xq-58hj-vwm2,2020-09-11T21:16:59Z,"Malicious Package in test-module-a",test-module-a,0,,,CRITICAL,CWE-506,
 GHSA-779f-wgxg-qr8f,2020-09-03T18:10:22Z,"Prototype Pollution in lodash.mergewith",lodash.mergewith,0,4.6.2,,HIGH,CWE-1321,
@@ -7646,6 +7850,7 @@ GHSA-7fhm-mqm4-2wp7,2020-03-13T20:36:16Z,"Withdrawn: ESLint dependencies are vul
 GHSA-7fpw-cfc4-3p2c,2017-12-28T22:51:45Z,"Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2",passport-wsfed-saml2,0,3.0.5,,HIGH,CWE-290,
 GHSA-7fqq-q52p-2jjg,2026-03-29T15:27:41Z,"OpenCC  has an Out-of-bounds read when processing truncated UTF-8 input",opencc,0,1.2.0,,MODERATE,CWE-125,
 GHSA-7frr-c83r-fm22,2020-09-03T22:20:49Z,"Malicious Package in buffez-xor",buffez-xor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-7gfh-x38p-prh3,2026-07-24T16:21:22Z,"Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)",velocityjs,0,2.1.7,,CRITICAL,CWE-94,
 GHSA-7h7g-x2px-94hj,2026-03-13T20:54:18Z,"OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens",openclaw,0,2026.3.12,,MODERATE,CWE-532,
 GHSA-7hgr-7h44-33w2,2026-05-19T20:13:35Z,"CamoFox MCP: Unauthenticated HTTP MCP browser-control surface",camofox-mcp,0,1.13.2,,HIGH,CWE-306,
 GHSA-7hrg-5w46-5r2x,2026-04-24T00:31:52Z,"Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders",openclaw,0,2026.4.2,,LOW,CWE-346,
@@ -7657,12 +7862,17 @@ GHSA-7jm2-g593-4qrc,2026-04-25T23:51:11Z,"OpenClaw: Agent gateway config mutatio
 GHSA-7m7q-q53v-j47v,2021-02-25T02:01:47Z,"Regular Expression Denial of Service",marked,0.5.0,0.6.1,,MODERATE,,
 GHSA-7p6w-x2gr-rrf8,2020-09-02T21:28:05Z,"ag-grid Cross-Site Scripting vulnerability",ag-grid,0,14.0.0,,HIGH,CWE-79,
 GHSA-7q64-3rg2-h9pf,2026-02-27T18:31:06Z,"Duplicate Advisory: Nest has a Fastify URL Encoding Middleware Bypass",@nestjs/platform-fastify,0,11.1.14,,HIGH,CWE-863,
+GHSA-7q8q-rj6j-mhjq,2026-07-20T22:37:31Z,"Axios: Nested axios option objects can consume polluted prototype values",axios,0.8.0,0.33.0,,MODERATE,CWE-1321,
+GHSA-7q8q-rj6j-mhjq,2026-07-20T22:37:31Z,"Axios: Nested axios option objects can consume polluted prototype values",axios,1.0.0,1.18.0,,MODERATE,CWE-1321,
 GHSA-7q9x-8g6p-3x75,2026-03-25T17:15:40Z,"@grackle-ai/server: Unescaped Error String in renderPairingPage() HTML Template",@grackle-ai/server,0,0.70.1,,LOW,CWE-79,
 GHSA-7qf6-h84j-8fq4,2026-03-03T22:21:59Z,"OpenClaw: Microsoft Teams media fetch paths bypass shared SSRF guard model",openclaw,0,2026.2.26,,LOW,CWE-367;CWE-918,
 GHSA-7qg7-6g3g-8vxg,2020-09-03T22:46:25Z,"Malicious Package in bwffer-xor",bwffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-7r5f-7qr4-pf6q,2020-09-03T19:03:33Z,"Sandbox Breakout / Arbitrary Code Execution in notevil",notevil,0,1.3.2,,HIGH,,
 GHSA-7r9x-hr76-jr96,2020-09-04T17:26:18Z,"Command Injection in giting",giting,0.0.0,,,CRITICAL,CWE-77,
 GHSA-7rgr-72hp-9wp3,2025-10-06T03:31:38Z,"Duplicate Advisory: Flowise is vulnerable to stored XSS via ""View Messages"" allows credential theft in FlowiseAI admin panel",flowise,0,3.0.5,,HIGH,CWE-79,
+GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",@auth/core,0.1.0,0.41.3,,CRITICAL,CWE-180,
+GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",next-auth,4.10.3,4.24.15,,CRITICAL,CWE-180,
+GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",next-auth,5.0.0-beta.1,5.0.0-beta.32,,CRITICAL,CWE-180,
 GHSA-7rx3-28cr-v5wh,2026-03-29T15:17:15Z,"Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry",handlebars,4.6.0,4.7.9,,MODERATE,CWE-1321,
 GHSA-7rx4-c5vx-g8w3,2026-05-14T18:26:02Z,"Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections",@karakeep/sdk,0,0.32.0,,HIGH,CWE-918,
 GHSA-7v28-g2pq-ggg8,2022-06-17T01:16:03Z,"Ghost vulnerable to remote code execution in locale setting change",ghost,0,4.48.2,,MODERATE,,
@@ -7686,6 +7896,8 @@ GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",
 GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",derby,3.0.0,3.0.2,,LOW,CWE-1321,
 GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",derby,4.0.0-beta1,4.0.0-beta.11,,LOW,CWE-1321,
 GHSA-82rm-qcfx-2v78,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: Delivery queue recovery could lose group tool-policy context for media replay",openclaw,2026.4.10,2026.4.14,,MODERATE,CWE-862,
+GHSA-8342-988q-86cr,2026-07-22T22:04:54Z,"n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login",n8n,0,2.31.5,,HIGH,CWE-345;CWE-863,
+GHSA-8342-988q-86cr,2026-07-22T22:04:54Z,"n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login",n8n,2.32.0,2.32.1,,HIGH,CWE-345;CWE-863,
 GHSA-83pq-466j-fc6j,2020-09-04T15:17:50Z,"Prototype Pollution in sahmat",sahmat,0.0.0,,,HIGH,CWE-1321,
 GHSA-83rx-c8cr-6j8q,2019-06-05T20:48:55Z,"Insecure Default Configuration in tesseract.js",tesseract.js,0,1.0.19,,MODERATE,CWE-829,
 GHSA-83w9-h5wv-j9xm,2026-07-02T16:23:41Z,"OpenClaw: Node pairing reconnection could confuse approval scope state",openclaw,0,2026.5.27,,HIGH,CWE-367,
@@ -7697,6 +7909,7 @@ GHSA-8549-p68h-m9mc,2020-09-03T21:46:21Z,"Malicious Package in buffdr-xor",buffd
 GHSA-855m-jchh-9qjc,2020-09-02T20:19:22Z,"Malicious Package in commnader",commnader,0,,,CRITICAL,CWE-506,
 GHSA-85q4-v37c-wfpc,2020-09-04T15:39:28Z,"Malicious Package in bitcion-ops",bitcion-ops,0.0.0,,,CRITICAL,CWE-506,
 GHSA-866c-wwm5-4rj7,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw's Nextcloud Talk webhook replay could trigger duplicate inbound processing",openclaw,0,,2026.2.24,MODERATE,CWE-294,
+GHSA-866w-xmhq-wj7x,2026-07-24T15:58:05Z,"SvelteKit: Prototype pollution in file input deletion path in remote-function forms",@sveltejs/kit,0,2.69.1,,MODERATE,CWE-1321,
 GHSA-86gv-xpwv-jprc,2020-09-03T17:36:00Z,"Malicious Package in diamond-clien",diamond-clien,0.0.0,,,CRITICAL,CWE-506,
 GHSA-86j7-9j95-vpqj,2026-07-07T20:55:28Z,"Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp",better-auth,0,1.6.13,,HIGH,CWE-601;CWE-79,
 GHSA-86j7-9j95-vpqj,2026-07-07T20:55:28Z,"Better Auth has stored XSS in the auth-server origin via javascript: redirect_uri in oidc-provider and mcp",better-auth,1.7.0-beta.0,1.7.0-beta.4,,HIGH,CWE-601;CWE-79,
@@ -7712,6 +7925,7 @@ GHSA-87qp-7cw8-8q9c,2024-03-25T06:30:24Z,"Duplicate Advisory: web3-utils Prototy
 GHSA-87qw-7v97-w34r,2020-09-02T18:33:18Z,"Malicious Package in asinc",asinc,0,,,CRITICAL,CWE-506,
 GHSA-87v3-4cfp-cm76,2026-03-18T16:10:26Z,"Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas",@pdfme/schemas,0,5.5.9,,MODERATE,CWE-79,
 GHSA-886v-mm6p-4m66,2019-06-05T09:48:02Z,"High severity vulnerability that affects gun",gun,0,0.2019.416,,HIGH,CWE-22,
+GHSA-88c4-pcqm-3r9p,2026-07-22T12:32:17Z,"Duplicate Advisory: GraphQL Node Bypasses ""Allowed HTTP Request Domains"" Restriction",n8n,0,,,MODERATE,CWE-863,
 GHSA-88h9-fc6v-jcw7,2020-09-03T20:28:51Z,"Unintended Require in larvitbase-www",larvitbase-www,0.0.0,,,MODERATE,,
 GHSA-88qp-p4qg-rqm6,2026-02-19T20:30:25Z,"CPU exhaustion in SvelteKit remote form deserialization (experimental only)",@sveltejs/kit,2.49.0,2.52.2,,MODERATE,CWE-843,
 GHSA-88xx-23mf-rcj2,2020-09-03T22:51:52Z,"Malicious Package in bs-sha3",bs-sha3,0.0.0,,,CRITICAL,CWE-506,
@@ -7723,6 +7937,7 @@ GHSA-8c8c-4vfj-rrpc,2020-09-01T19:05:11Z,"Reflected Cross-Site Scripting in redi
 GHSA-8cp7-rp8r-mg77,2026-03-04T18:55:48Z,"OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP",openclaw,2026.1.20,2026.2.19,,MODERATE,CWE-918,
 GHSA-8f93-rv4p-x4jw,2019-06-12T16:36:52Z,"SQL Injection in sql",sql,0,,0.78.0,MODERATE,CWE-89,
 GHSA-8f9r-gr6r-x63q,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation",openclaw,0,2026.3.28,,MODERATE,CWE-696,
+GHSA-8fpg-xm3f-6cx3,2026-07-23T14:52:23Z,"Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)",next-auth,5.0.0-beta.0,5.0.0-beta.32,,CRITICAL,CWE-285;CWE-636,
 GHSA-8fw4-xh83-3j6q,2020-09-11T21:18:05Z,"Cross-Site Scripting in diagram-js",diagram-js,0,2.6.2,,MODERATE,CWE-79,
 GHSA-8fw4-xh83-3j6q,2020-09-11T21:18:05Z,"Cross-Site Scripting in diagram-js",diagram-js,3.0.0,3.3.1,,MODERATE,CWE-79,
 GHSA-8g29-8xwr-qmhr,2026-03-25T17:33:01Z,"@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling",@grackle-ai/server,0,0.70.6,,LOW,CWE-754,
@@ -7759,17 +7974,20 @@ GHSA-8mm3-2mcj-cx6r,2020-09-11T21:09:24Z,"Malicious Package in angluar-cli",angl
 GHSA-8mmf-qp7j-2w24,2020-09-02T21:35:33Z,"Malicious Package in colour-string",colour-string,0,,,CRITICAL,CWE-506,
 GHSA-8mpm-q7mh-8fvh,2026-03-18T16:09:42Z,"Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)",@capgo/cli,0,7.84.6,,HIGH,CWE-276;CWE-377;CWE-59,
 GHSA-8mr2-f9wf-hcfq,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback",openclaw,0,2026.2.22,,LOW,CWE-522,
+GHSA-8mv7-9c27-98vc,2026-07-20T23:26:27Z,"Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered",astro,7.0.0,7.0.6,,MODERATE,CWE-352,
 GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",@sequelize/core,0,7.0.0-alpha.20,,CRITICAL,CWE-790,
 GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",sequelize,0,6.29.0,,CRITICAL,CWE-790,
 GHSA-8pf2-vj79-4wxg,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API",openclaw,0,2026.3.31,,MODERATE,CWE-441,
 GHSA-8pwx-j4r6-5v38,2020-09-03T17:05:25Z,"Malicious Package in hdkye",hdkye,0.0.0,,,CRITICAL,CWE-506,
 GHSA-8px5-2gfr-7ph6,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw has Windows Lobster shell fallback command injection in constrained fallback path",openclaw,2026.1.21,,2026.2.17,MODERATE,CWE-78,
 GHSA-8q2c-2396-hf7j,2020-09-03T17:34:55Z,"Malicious Package in appx-compiler",appx-compiler,0.0.0,,,CRITICAL,CWE-506,
+GHSA-8q49-2h5h-434x,2026-07-24T22:40:00Z,"FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller",@frontmcp/adapters,0,1.5.6,,MODERATE,CWE-918,
 GHSA-8qm3-746x-r74r,2026-02-19T20:29:17Z,"devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed",devalue,0,5.6.3,,LOW,CWE-1321,
 GHSA-8qx4-r7fx-xc4v,2020-09-11T21:08:19Z,"Malicious Package in requst",requst,0,,,CRITICAL,CWE-506,
 GHSA-8r4g-cg4m-x23c,2021-09-22T18:22:02Z,"Denial of Service in node-static",node-static,0,,0.7.11,MODERATE,CWE-248;CWE-400,
 GHSA-8r69-3cvp-wxc3,2022-11-02T18:18:10Z,"Batched HTTP requests may set incorrect `cache-control` response header",@apollo/server,0,4.1.0,,MODERATE,CWE-524,
 GHSA-8r69-3cvp-wxc3,2022-11-02T18:18:10Z,"Batched HTTP requests may set incorrect `cache-control` response header",apollo-server-core,3.0.0,3.11.0,,MODERATE,CWE-524,
+GHSA-8r6m-32jq-jx6q,2026-07-21T22:06:36Z,"fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits",fast-xml-parser,5.9.3,5.10.1,,HIGH,CWE-776,
 GHSA-8rgj-285w-qcq4,2025-02-10T17:59:09Z,"Unknown vulnerability in Coinbase Wallet SDK",@coinbase/wallet-sdk,4.0.0-beta.0,4.3.0,,HIGH,,
 GHSA-8v5f-hp78-jgxq,2019-06-06T15:30:33Z,"Signature Verification Bypass in jwt-simple",jwt-simple,0,0.5.3,,HIGH,CWE-347,
 GHSA-8vj3-jgcf-77jv,2020-09-02T20:26:49Z,"Malicious Package in requeest",requeest,0,,,CRITICAL,CWE-506,
@@ -7799,7 +8017,6 @@ GHSA-93rg-2xm5-2p9v,2026-05-04T21:14:17Z,"OpenClaw's Gateway Control UI bootstra
 GHSA-943q-mwmv-hhvh,2026-03-02T23:32:22Z,"OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval",openclaw,0,2026.2.14,,HIGH,CWE-78,
 GHSA-95cg-3r4g-7w6j,2020-09-03T23:01:29Z,"Malicious Package in js-rha3",js-rha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-96qw-h329-v5rg,2026-01-08T21:13:37Z,"Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles",shakapacker,0,9.5.0,,HIGH,CWE-200,
-GHSA-9752-mhqh-h34f,2026-06-18T14:26:42Z,"npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation",praisonai,1.6.0,1.7.2,,CRITICAL,CWE-306,
 GHSA-97mg-3cr6-3x4c,2020-09-04T17:27:23Z,"Remote Code Execution in mongodb-query-parser",mongodb-query-parser,0,2.0.0,,CRITICAL,,
 GHSA-97mp-9g5c-6c93,2020-09-04T16:50:48Z,"Malicious Package in bs58chcek",bs58chcek,0.0.0,,,CRITICAL,CWE-506,
 GHSA-97pr-9hgg-3p8r,2026-06-19T21:42:48Z,"parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change",parse-server,0,8.6.83,,LOW,CWE-200,
@@ -7810,9 +8027,11 @@ GHSA-98ch-45wp-ch47,2026-04-07T18:15:48Z,"OpenClaw: Windows-compatible env overr
 GHSA-98pf-gfh3-x3mp,2022-11-10T16:02:51Z,"Read the Docs vulnerable to Cross-Site Scripting (XSS)",readthedocs,0,8.8.1,,MODERATE,CWE-79,
 GHSA-992f-wf4w-x36v,2020-09-01T21:16:13Z,"Prototype Pollution in merge-objects",merge-objects,0.0.0,,,LOW,CWE-1321,
 GHSA-9959-c6q6-6qp3,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects validator",validator,0,2.0.0,,MODERATE,,
-GHSA-99pg-hqvx-r4gf,2025-09-15T20:00:39Z,"Flowise has an Arbitrary File Read",flowise,3.0.5,3.0.6,,CRITICAL,,
+GHSA-99pg-hqvx-r4gf,2025-09-15T20:00:39Z,"Flowise has an Arbitrary File Read",flowise,3.0.5,3.0.6,,CRITICAL,CWE-22,
 GHSA-9c3v-684m-579c,2026-07-01T22:09:28Z,"OpenClaw MCP SSE redirects could forward Authorization headers",openclaw,0,2026.6.5,,MODERATE,CWE-200;CWE-522;CWE-601,
-GHSA-9c83-rr99-vfwj,2026-06-19T21:42:24Z,"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested",@bitbonsai/mcpvault,0,0.11.5,,MODERATE,CWE-22;CWE-538,
+GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,0,1.123.67,,MODERATE,CWE-20,
+GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-20,
+GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,2.32.0,2.32.1,,MODERATE,CWE-20,
 GHSA-9cph-cqqh-36pw,2020-09-04T15:29:25Z,"Malicious Package in babel-loqder",babel-loqder,0.0.0,,,CRITICAL,CWE-506,
 GHSA-9f72-qcpw-2hxc,2026-03-03T19:08:08Z,"OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs",openclaw,0,2026.2.24,,HIGH,CWE-200;CWE-284,
 GHSA-9f79-7pw8-3fj8,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf",openclaw,0,,2026.2.25,HIGH,CWE-22,
@@ -7831,6 +8050,7 @@ GHSA-9m65-766c-r333,2026-05-14T16:37:10Z,"TanStack Start - Server Core: Inbound
 GHSA-9mjp-gv34-3jcf,2020-09-02T18:37:35Z,"Malicious Package in aasync",aasync,0,,,CRITICAL,CWE-506,
 GHSA-9mmw-3fmh-96g3,2020-09-02T20:23:38Z,"Malicious Package in calk",calk,0,,,CRITICAL,CWE-506,
 GHSA-9mph-4f7v-fmvh,2026-03-04T19:02:59Z,"OpenClaw has agent avatar symlink traversal in gateway session metadata",openclaw,0,2026.2.22,,MODERATE,CWE-59,
+GHSA-9mqv-5hh9-4cgg,2026-07-21T22:04:27Z,"Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake",@hono/node-server,2.0.0,2.0.10,,MODERATE,CWE-401;CWE-770,
 GHSA-9p64-h5q4-phpm,2020-09-02T15:44:58Z,"Remote Code Execution in office-converter",office-converter,0.0.0,,,HIGH,CWE-20,
 GHSA-9p93-7j67-5pc2,2026-03-27T22:28:25Z,"OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding",openclaw,0,,2026.3.24,HIGH,CWE-226;CWE-863,
 GHSA-9pcf-h8q9-63f6,2020-09-03T17:12:41Z,"Sandbox Breakout / Arbitrary Code Execution in safe-eval",safe-eval,0.0.0,,,HIGH,,
@@ -7882,6 +8102,7 @@ GHSA-c27r-x354-4m68,2020-10-27T20:39:46Z,"xml-crypto's HMAC-SHA1 signatures can
 GHSA-c29c-2q9c-pc86,2026-07-02T16:43:38Z,"OpenClaw: Slack allowFrom could bind to mutable display names",openclaw,0,2026.5.3,,HIGH,CWE-290,
 GHSA-c2fv-2fmj-9xrx,2025-07-28T06:30:23Z,"Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability",ssrfcheck,0,1.2.0,,HIGH,CWE-918,
 GHSA-c2g6-57fp-22wp,2020-09-03T22:48:35Z,"Malicious Package in fuffer-xor",fuffer-xor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-c2j3-45gr-mqc4,2026-07-21T19:41:07Z,"DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",dompurify,0,3.4.12,,LOW,CWE-184;CWE-693;CWE-79,
 GHSA-c35v-qwqg-87jc,2019-06-06T15:32:32Z,"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison",express-basic-auth,0,1.1.7,,LOW,CWE-208,
 GHSA-c3hq-7mxh-mqxf,2020-09-04T14:59:50Z,"Sandbox Breakout / Arbitrary Code Execution in lighter-vm",lighter-vm,0.0.0,,,CRITICAL,,
 GHSA-c3m8-x3cg-qm2c,2020-09-03T20:39:53Z,"Configuration Override in helmet-csp",helmet-csp,1.2.2,2.9.1,,MODERATE,,
@@ -7898,6 +8119,7 @@ GHSA-c6h2-mpc6-232h,2020-08-27T22:26:15Z,"Command Injection in dns-sync",dns-syn
 GHSA-c6m7-q6pr-c64r,2025-12-12T16:41:58Z,"Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components",@vitejs/plugin-rsc,0,0.5.7,,MODERATE,CWE-1395;CWE-497;CWE-502,
 GHSA-c7pp-x73h-4m2v,2020-09-02T15:53:46Z,"Cross-Site Scripting in bootstrap-vue",bootstrap-vue,0,2.0.0-rc.12,,HIGH,CWE-79,
 GHSA-c7w3-x93f-qmm8,2026-03-26T22:26:46Z,"Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter",nodemailer,0,8.0.4,,LOW,CWE-93,
+GHSA-c8vc-7pv3-g98p,2026-07-24T21:14:49Z," Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)",@budibase/server,0,,3.38.1,HIGH,CWE-639,
 GHSA-c8w7-9w9h-x69q,2026-06-16T21:31:58Z,"Duplicate Advisory: Slack reaction events could ignore reaction notification settings",openclaw,0,,2026.5.7,MODERATE,CWE-862,
 GHSA-cc4f-hjpj-g9p8,2026-04-16T21:21:12Z,"Flowise: Weak Default JWT Secrets",flowise,0,3.1.0,,MODERATE,CWE-327,
 GHSA-ccq6-3qx5-vmqx,2018-07-31T22:54:14Z,"Moderate severity vulnerability that affects is-my-json-valid",is-my-json-valid,0,2.12.4,,MODERATE,,
@@ -7920,12 +8142,12 @@ GHSA-chgg-rrmv-5q7x,2020-08-03T18:05:48Z,Withdrawn,jwt-simple,0,0.3.1,,MODERATE,
 GHSA-chh2-rvhg-wqwr,2020-09-03T21:02:10Z,"Malicious Package in json-serializer",json-serializer,2.0.10,2.0.11,,CRITICAL,,
 GHSA-chm2-m3w2-wcxm,2026-02-17T22:56:39Z,"OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch",clawdbot,0,,2026.1.24-3,LOW,CWE-290;CWE-863,
 GHSA-chm2-m3w2-wcxm,2026-02-17T22:56:39Z,"OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch",openclaw,0,2026.2.14,,LOW,CWE-290;CWE-863,
-GHSA-cj63-jhhr-wcxv,2026-04-03T03:45:08Z,"DOMPurify USE_PROFILES prototype pollution allows event handlers",dompurify,0,3.3.2,,MODERATE,CWE-1321,
+GHSA-cj9h-qx8g-pq2g,2026-07-22T22:11:22Z,"n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON",n8n,0,1.123.67,,HIGH,CWE-863,
+GHSA-cj9h-qx8g-pq2g,2026-07-22T22:11:22Z,"n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-863,
+GHSA-cj9h-qx8g-pq2g,2026-07-22T22:11:22Z,"n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON",n8n,2.32.0,2.32.1,,HIGH,CWE-863,
 GHSA-cjg8-85gj-v9q2,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: Feishu webhook and card-action validation now fail closed",openclaw,0,2026.4.15,,CRITICAL,CWE-1188,
-GHSA-cjmm-f4jc-qw8r,2026-04-03T03:46:07Z,"DOMPurify ADD_ATTR predicate skips URI validation",dompurify,0,3.3.2,,MODERATE,CWE-183,
 GHSA-cjq8-m7wj-xmq9,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows",openclaw,0,,,LOW,CWE-863,
 GHSA-cjv3-m589-v3rx,2026-03-03T23:17:06Z,"OpenClaw has Canvas route hardening for mixed-trust deployments",openclaw,0,2026.2.21,,MODERATE,CWE-1021;CWE-79,
-GHSA-cmwh-pvxp-8882,2026-06-18T14:27:37Z,"DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)",dompurify,0,3.4.11,,MODERATE,CWE-471;CWE-665;CWE-79,
 GHSA-cp47-r258-q626,2023-03-02T23:36:22Z," Vega vulnerable to arbitrary code execution when clicking href links",vega,0,4.5.1,,MODERATE,,
 GHSA-cp47-r258-q626,2023-03-02T23:36:22Z," Vega vulnerable to arbitrary code execution when clicking href links",vega,5.0.0,5.4.1,,MODERATE,,
 GHSA-cpgr-wmr9-qxv4,2020-09-11T21:20:14Z,"Cross-Site Scripting in serve",serve,0,10.0.2,,MODERATE,CWE-79,
@@ -7937,6 +8159,7 @@ GHSA-cr4x-w2v7-4mmf,2020-09-03T22:26:13Z,"Malicious Package in bufver-xor",bufve
 GHSA-cr56-66mx-293v,2020-09-03T15:53:50Z,"Cross-Site Scripting in @toast-ui/editor",@toast-ui/editor,0,2.2.0,,HIGH,CWE-79,
 GHSA-cr5w-6rv4-r2qg,2020-09-03T02:37:45Z,"Malicious Package in maleficent",maleficent,0,,,CRITICAL,CWE-506,
 GHSA-cr67-78jr-j94p,2020-09-03T18:14:47Z,"Local File Inclusion in domokeeper",domokeeper,0.0.0,,,MODERATE,,
+GHSA-cr7p-cr3q-h5cm,2026-07-24T21:43:11Z," Budibase: Account Enumeration via Login Lockout Response Differential",@budibase/server,0,,3.38.1,MODERATE,CWE-204,
 GHSA-crf7-fvjx-863q,2020-09-03T17:09:26Z,"Path Traversal in zero",zero,0,1.0.6,,HIGH,CWE-22,
 GHSA-crfh-jmv2-2f9v,2020-09-03T17:03:11Z,"Malicious Package in singale",singale,0.0.0,,,CRITICAL,CWE-506,
 GHSA-crfx-5phg-hmw9,2019-06-13T18:59:12Z,"Cross-Site Scripting in ids-enterprise",ids-enterprise,0,4.18.2,,HIGH,CWE-79,
@@ -7958,6 +8181,8 @@ GHSA-f3h5-h452-vp3j,2026-04-17T22:00:59Z,"OpenClaw: Nostr profile mutation route
 GHSA-f3pc-c2gf-hvgw,2020-09-02T21:13:14Z,"Malicious Package in requets",requets,0,,,CRITICAL,CWE-506,
 GHSA-f3vw-587g-r29g,2020-09-03T15:50:38Z,"Path Traversal in sapper",sapper,0,0.27.11,,CRITICAL,CWE-22,
 GHSA-f478-xwv9-p93q,2022-05-24T17:18:00Z,"Duplicate Advisory: Kerberos for NodeJS allows DLL Injection",kerberos,0,1.0.0,,HIGH,CWE-427,
+GHSA-f4gw-2p7v-4548,2026-07-20T22:20:18Z,"Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",axios,0.31.0,0.33.0,,MODERATE,CWE-183;CWE-918,
+GHSA-f4gw-2p7v-4548,2026-07-20T22:20:18Z,"Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",axios,1.15.0,1.18.0,,MODERATE,CWE-183;CWE-918,
 GHSA-f52g-6jhx-586p,2020-09-03T23:20:12Z,"Denial of Service in handlebars",handlebars,4.0.0,4.4.5,,MODERATE,CWE-400,
 GHSA-f5cv-xrv9-r8w7,2020-09-01T21:17:16Z,"NoSQL injection in express-cart",express-cart,0,1.1.8,,HIGH,CWE-89,
 GHSA-f5fm-9jmp-c88r,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: Trailing-dot localhost CDP hosts could bypass remote loopback protections",openclaw,0,2026.4.2,,MODERATE,CWE-639,
@@ -7974,6 +8199,7 @@ GHSA-f7gc-6hcj-wc42,2020-09-03T17:05:06Z,"Malicious Package in path-to-regxep",p
 GHSA-f7qw-5pvg-mmwp,2019-06-13T18:58:44Z,"Prototype Pollution in lutils-merge",lutils-merge,0,,0.2.6,MODERATE,CWE-400,
 GHSA-f7r3-p866-q9qr,2019-06-03T17:27:49Z,"ircdkit vulnerable to Denial of Service due to unhandled connection end event",ircdkit,0,1.0.4,,LOW,CWE-400,
 GHSA-f7xj-rg7h-mc87,2023-07-07T20:32:55Z,"Stylelint has vulnerability in semver dependency",stylelint,8.0.0,15.10.1,,LOW,,
+GHSA-f88m-g3jw-g9cj,2026-07-21T22:07:17Z,"sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",sharp,0,0.35.0,,HIGH,CWE-1395,
 GHSA-f8h3-rqrm-47v9,2020-09-02T16:02:40Z,"Prototype Pollution in smart-extend",smart-extend,0,,,MODERATE,CWE-1321,
 GHSA-f8jj-45fj-44r6,2020-09-03T23:05:43Z,"Malicious Package in js-she3",js-she3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-f8pq-3926-8gx5,2023-08-09T20:59:14Z,"Unsanitized user controlled input in module generation","@opentelemetry/instrumentation",0.40.0,0.41.2,,HIGH,,
@@ -7984,6 +8210,7 @@ GHSA-f934-5rqf-xx47,2026-04-17T22:33:33Z,"OpenClaw: QMD memory_get restricts rea
 GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/auth,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
 GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/mcp,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
 GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/plugin-core,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
+GHSA-fcrw-f7gg-6g9f,2026-07-24T21:14:31Z," Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users",@budibase/server,0,3.39.25,,MODERATE,CWE-200,
 GHSA-ff5x-w9wg-h275,2020-03-06T01:15:46Z,"Holder can generate proof of ownership for credentials it does not control in vp-toolkit",vp-toolkit,0,0.2.2,,HIGH,,
 GHSA-ff6g-gm92-rf32,2020-09-03T19:42:06Z,"Malicious Package in coinstirng",coinstirng,0.0.0,,,CRITICAL,CWE-506,
 GHSA-ff98-w8hj-qrxf,2026-03-03T21:39:26Z,"OpenClaw plugin runtime command execution is part of trusted plugin boundary",openclaw,0,2026.2.19,,MODERATE,CWE-78,
@@ -7999,16 +8226,13 @@ GHSA-fm7r-2pr7-rw2p,2020-09-02T21:45:02Z,"Malicious Package in yeoman-genrator",
 GHSA-fm93-fhh2-cg2c,2022-01-27T14:21:53Z,"Duplicate Advisory: Prototype Pollution in min-dash",min-dash,0,3.8.1,,HIGH,CWE-1321,
 GHSA-fmh4-wr37-44fp,2025-12-03T19:07:52Z,"React Server Components are Vulnerable to RCE",@vitejs/plugin-rsc,0,0.5.3,,CRITICAL,CWE-502,
 GHSA-fmr4-7g9q-7hc7,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects handlebars",handlebars,0,4.0.0,,MODERATE,,
+GHSA-fmvg-vhqq-r2mj,2026-07-22T12:32:17Z,"Duplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data",n8n,0,,,MODERATE,CWE-532,
 GHSA-fp4x-ggrf-wmc6,2026-03-23T21:48:24Z,"H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation",h3,2.0.1-rc.17,2.0.1-rc.18,,MODERATE,CWE-601,
 GHSA-fpf2-pr3j-4cm3,2020-09-03T17:06:06Z,"Malicious Package in ecruve",ecruve,0.0.0,,,CRITICAL,CWE-506,
 GHSA-fpg4-jhqr-589c,2026-02-28T02:04:39Z,"SvelteKit  has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)",@sveltejs/kit,2.49.0,2.53.3,,LOW,CWE-770,
 GHSA-fpgg-r39h-3x5x,2020-09-03T17:06:22Z,"Malicious Package in cxt",cxt,0.0.0,,,CRITICAL,CWE-506,
 GHSA-fpw3-x4xq-6vxq,2020-09-02T18:32:13Z,"Malicious Package in wepack-cli",wepack-cli,0,,,CRITICAL,CWE-506,
 GHSA-fpw4-p57j-hqmq,2026-04-16T22:49:13Z,"Paperclip: Stored XSS via javascript: URLs in MarkdownBody — urlTransform override disables react-markdown sanitization",@paperclipai/ui,0,2026.416.0,,MODERATE,CWE-79,
-GHSA-fq4x-789w-jg5h,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/claudecode,0,0.2.39,,HIGH,CWE-306,
-GHSA-fq4x-789w-jg5h,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/codex,0,0.1.33,,HIGH,CWE-306,
-GHSA-fq4x-789w-jg5h,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/core,0,0.9.43,,HIGH,CWE-306,
-GHSA-fq4x-789w-jg5h,2026-06-18T17:21:27Z,"AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)",@agenticmail/openclaw,0,0.5.71,,HIGH,CWE-306,
 GHSA-fqrj-m88p-qf3v,2026-04-07T18:14:50Z,"OpenClaw: Zalo replay dedupe cache could suppress events across authenticated webhook targets",openclaw,2026.2.19,2026.3.31,,LOW,CWE-287,
 GHSA-fqw4-mph7-2vr8,2026-03-27T22:29:47Z,"OpenClaw: Silent privilege escalation via gateway shared-auth reconnect",openclaw,0,,2026.3.24,CRITICAL,CWE-863,
 GHSA-fqw7-8v6m-2f86,2020-09-02T21:37:39Z,"Malicious Package in hulp",hulp,0,,,CRITICAL,CWE-506,
@@ -8017,6 +8241,7 @@ GHSA-fr4h-3cph-29xv,2026-06-27T00:02:51Z,"pnpm: Hoisted install imports lockfile
 GHSA-fr4j-65pv-gjjj,2026-01-13T20:28:16Z,"Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration",renovate,35.63.0,40.33.0,,MODERATE,CWE-77,
 GHSA-fr9g-2m2h-c27j,2023-08-16T06:30:24Z,"Duplicate Advisory: @excalidraw/excalidraw Cross-site Scripting vulnerability",@excalidraw/excalidraw,0,0.15.3,,MODERATE,CWE-79,
 GHSA-frr5-j3mh-h9ch,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes",openclaw,0,2026.4.22,,MODERATE,CWE-367,
+GHSA-frvp-7c67-39w9,2026-07-21T18:17:25Z,"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",@hono/node-server,0,2.0.5,,MODERATE,CWE-22,
 GHSA-frxq-v7fm-m4pv,2020-09-02T20:27:53Z,"Malicious Package in requuest",requuest,0,,,CRITICAL,CWE-506,
 GHSA-fvfv-ppw4-7h2w,2026-02-26T22:46:42Z,"n8n has a Guardrail Node Bypass",n8n,0,2.10.0,,MODERATE,CWE-20;CWE-693,
 GHSA-fvh2-gm75-j4j7,2026-05-18T17:00:25Z,"dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport",dynoxide,0.9.3,0.9.13,,HIGH,CWE-346;CWE-350;CWE-352,
@@ -8041,6 +8266,7 @@ GHSA-g485-8j3v-p6x8,2026-05-05T18:28:32Z,"@tdurieux/anonymous_github Vulnerable
 GHSA-g49q-jw42-6x85,2024-05-09T21:31:35Z,"thelounge may publicly disclose of all usernames/idents via port 113",thelounge,0,,4.4.3,LOW,,
 GHSA-g4m3-rpxr-h7vg,2020-09-03T19:52:25Z,"Malicious Package in mogodb-core",mogodb-core,0.0.0,,,CRITICAL,CWE-506,
 GHSA-g5q2-fcg9-j526,2020-09-03T17:40:18Z,"Malicious Package in hsf-clients",hsf-clients,0.0.0,,,CRITICAL,CWE-506,
+GHSA-g5vv-q72c-7j78,2026-07-24T21:47:29Z,"@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion",@anephenix/hub,0,0.2.16,,HIGH,CWE-400,
 GHSA-g64q-3vg8-8f93,2020-09-03T15:47:10Z,"Prototype Pollution in pez",pez,0.0.0,,,HIGH,CWE-1321,
 GHSA-g6f4-j6c2-w3p3,2018-10-09T00:39:43Z,"High severity vulnerability that affects uglify-js",uglify-js,0,2.4.24,,HIGH,,
 GHSA-g6w6-h933-4rc5,2023-08-03T19:44:52Z,"Soketi was exposed to Sandbox Escape vulnerability via vm2",@soketi/soketi,0,1.6.0,,CRITICAL,,
@@ -8069,7 +8295,12 @@ GHSA-g9wg-wq4f-2x5w,2020-09-03T19:00:10Z,"Cross-Site Scripting in console-feed",
 GHSA-gc25-3vc5-2jf9,2020-09-04T15:00:58Z,"Sandbox Breakout / Arbitrary Code Execution in sandbox",sandbox,0.0.0,,,CRITICAL,,
 GHSA-gc94-6w89-hpqr,2019-06-12T16:37:07Z,"Command Injection in fs-path",fs-path,0,0.0.25,,HIGH,CWE-77,
 GHSA-gcfc-mgg3-8j2c,2020-09-03T18:11:29Z,"Malicious Package in sdfjghlkfjdshlkjdhsfg",sdfjghlkfjdshlkjdhsfg,0.0.0,,,CRITICAL,CWE-506,
+GHSA-gcfj-64vw-6mp9,2026-07-20T22:40:07Z,"Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning",axios,0.31.1,0.33.0,,HIGH,CWE-1321;CWE-200,
+GHSA-gcfj-64vw-6mp9,2026-07-20T22:40:07Z,"Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning",axios,1.15.2,1.18.0,,HIGH,CWE-1321;CWE-200,
 GHSA-gcj7-r3hg-m7w6,2026-03-03T22:25:37Z,"OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity",openclaw,0,2026.2.26,,LOW,CWE-294;CWE-345,
+GHSA-gf29-4f56-r2jf,2026-07-22T22:06:45Z,"n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction",n8n,0,1.123.67,,HIGH,CWE-22,
+GHSA-gf29-4f56-r2jf,2026-07-22T22:06:45Z,"n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-22,
+GHSA-gf29-4f56-r2jf,2026-07-22T22:06:45Z,"n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction",n8n,2.32.0,2.32.1,,HIGH,CWE-22,
 GHSA-gf8q-jrpm-jvxq,2022-01-08T00:22:02Z,"URL parsing in node-forge could lead to undesired behavior.",node-forge,0,1.0.0,,LOW,CWE-601,
 GHSA-gfg9-5357-hv4c,2026-04-29T21:34:39Z,"OpenClaw: Webchat audio embedding could read local files without local-root containment",openclaw,0,2026.4.15,,MODERATE,CWE-200;CWE-22,
 GHSA-gfj6-p24g-6hpm,2020-09-03T22:55:06Z,"Malicious Package in jc-sha3",jc-sha3,0.0.0,,,CRITICAL,CWE-506,
@@ -8078,10 +8309,13 @@ GHSA-gfm8-g3vm-53jh,2020-09-03T17:21:19Z,"Malicious Package in leetlog",leetlog,
 GHSA-gfmx-pph7-g46x,2026-04-09T14:22:14Z,"OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade",openclaw,0,2026.4.8,,HIGH,CWE-501,
 GHSA-gfp8-mp24-5vxg,2026-05-21T20:43:27Z,"@hulumi/baseline: CloudTrail selector tampering events were not fully detected",@hulumi/baseline,0,1.3.2,,MODERATE,CWE-778,
 GHSA-ggm6-h3mx-cmmp,2026-03-19T03:30:57Z,"Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags",openclaw,0,,2026.2.17,LOW,CWE-78,
+GHSA-gh4h-34gr-87r7,2026-07-24T21:25:20Z," Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders",@budibase/server,0,,3.38.1,MODERATE,CWE-200,
 GHSA-gj2h-2fpw-fhv9,2026-07-02T20:16:12Z,"@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration",@nuxt/ui,0,,4.7.1,MODERATE,CWE-200;CWE-598,
 GHSA-gjhc-6xm7-mc8q,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,5.9.0,,MODERATE,CWE-79,
 GHSA-gjph-xf5q-6mfq,2020-09-03T15:46:02Z,"Denial of Service in @hapi/ammo",@hapi/ammo,0,3.1.2,,HIGH,,
 GHSA-gjph-xf5q-6mfq,2020-09-03T15:46:02Z,"Denial of Service in @hapi/ammo",@hapi/ammo,4.0.0,5.0.1,,HIGH,,
+GHSA-gm3r-q2wp-hw87,2026-07-24T22:35:08Z,"Shescape: Quadratic-time denial of service in the flag-protection",shescape,2.1.11,2.1.14,,HIGH,CWE-400;CWE-407,
+GHSA-gm3r-q2wp-hw87,2026-07-24T22:35:08Z,"Shescape: Quadratic-time denial of service in the flag-protection",shescape,3.0.0,3.0.1,,HIGH,CWE-400;CWE-407,
 GHSA-gm68-572p-q28r,2023-07-06T15:30:51Z,"@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability",@vendure/admin-ui-plugin,0,2.0.3,,MODERATE,CWE-79,
 GHSA-gm9g-2g8v-fvxj,2019-06-06T15:32:28Z,"Prototype Pollution in upmerge",upmerge,0,,0.1.8,MODERATE,CWE-345;CWE-400,
 GHSA-gm9m-x74r-8whg,2026-03-31T15:31:56Z,"Duplicate Advisory: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication",openclaw,0,2026.3.28,,MODERATE,CWE-307,
@@ -8092,18 +8326,19 @@ GHSA-gp79-m99v-gjmh,2026-07-02T16:45:14Z,"OpenClaw: Mattermost handlers could fa
 GHSA-gpg2-7r7j-4pm9,2020-09-03T22:09:56Z,"Malicious Package in buffer-xob",buffer-xob,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gpv5-7x3g-ghjv,2023-06-15T19:05:13Z,"fast-xml-parser regex vulnerability patch could be improved from a safety perspective",fast-xml-parser,4.2.4,4.2.5,,LOW,,
 GHSA-gq3j-xvxp-8hrf,2026-02-19T20:15:59Z,"Hono added timing comparison hardening in basicAuth and bearerAuth",hono,0,4.11.10,,LOW,CWE-208,
+GHSA-gqcv-rfj6-r29g,2026-07-08T15:32:01Z,"Duplicate Advisory: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects",n8n,0,,,MODERATE,CWE-639,
 GHSA-gqf6-75v8-vr26,2020-09-04T16:56:11Z,"Arbitrary File Write in bin-links",bin-links,0,1.1.5,,LOW,,
-GHSA-gqmf-56h7-rrpf,2026-06-18T14:26:28Z,"npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients",praisonai,1.2.3,1.7.2,,HIGH,CWE-653;CWE-693,
 GHSA-gqq4-937c-2282,2020-09-03T22:49:42Z,"Malicious Package in juffer-xor",juffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-gqqj-85qm-8qhf,2026-04-16T22:47:40Z,"Paperclip: codex_local inherited ChatGPT/OpenAI-connected Gmail and was able to send real email",paperclipai,0,,2026.403.0,HIGH,CWE-284,
 GHSA-gr4j-r575-g665,2020-08-25T14:04:47Z,"Cross-Site Scripting in highcharts",highcharts,0,7.2.2,,HIGH,CWE-79,
 GHSA-gr4j-r575-g665,2020-08-25T14:04:47Z,"Cross-Site Scripting in highcharts",highcharts,8.0.0,8.1.1,,HIGH,CWE-79,
 GHSA-grc3-2j34-p6gm,2026-07-02T16:53:15Z,"OpenClaw: message.action forwarding could send Gateway credentials to model-supplied loopback URLs",openclaw,0,2026.5.2,,MODERATE,CWE-522,
 GHSA-gv2f-q4wp-fvh5,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: CLI Remote Onboarding Persists Unauthenticated Discovery Endpoint and Exfiltrates Gateway Credentials",openclaw,0,2026.3.28,,HIGH,CWE-346,
+GHSA-gv7g-jm28-cr3m,2026-07-22T22:10:15Z,"n8n: Expression sandbox escape via arrow-function bodies enabling command execution",n8n,0,2.31.5,,HIGH,CWE-94,
+GHSA-gv7g-jm28-cr3m,2026-07-22T22:10:15Z,"n8n: Expression sandbox escape via arrow-function bodies enabling command execution",n8n,2.32.0,2.32.1,,HIGH,CWE-94,
 GHSA-gv7w-rqvm-qjhr,2026-06-12T20:08:59Z,"Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY",esbuild,0.17.0,0.28.1,,HIGH,CWE-426;CWE-494,
 GHSA-gvff-25cc-4f66,2020-09-03T17:15:56Z,"Path Traversal in restify-swagger-jsdoc",restify-swagger-jsdoc,0,3.2.1,,HIGH,CWE-22,
 GHSA-gvm7-8fq3-qjj2,2020-09-03T19:43:18Z,"Malicious Package in bs85",bs85,0.0.0,,,CRITICAL,CWE-506,
-GHSA-gvmj-g25r-r7wr,2026-06-15T20:02:40Z,"DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes",dompurify,3.0.0,3.4.8,,LOW,CWE-79,
 GHSA-gw2c-6hcg-5g52,2026-06-16T21:31:58Z,"Duplicate Advisory: Focus command could miss controlScope enforcement",openclaw,0,,2026.4.24,MODERATE,CWE-862,
 GHSA-gw32-9rmw-qwww,2026-01-16T21:02:56Z,"svelte is vulnerable to XSS with textarea bind:value",svelte,3.0.0,3.59.2,,HIGH,CWE-79,
 GHSA-h232-fpqx-mqgr,2020-09-03T21:03:15Z,"Malicious Package in log-symboles",log-symboles,0.0.0,,,CRITICAL,CWE-506,
@@ -8120,12 +8355,13 @@ GHSA-h25m-26qc-wcjf,2026-01-28T15:38:01Z,"Next.js HTTP request deserialization c
 GHSA-h26f-j4mv-84g7,2020-09-02T18:39:43Z,"Malicious Package in asycn",asycn,0,,,CRITICAL,CWE-506,
 GHSA-h29r-4vqp-8jxf,2020-08-20T17:21:46Z,"Cross-Site Scripting in keystone",keystone,0,4.0.0,,MODERATE,,
 GHSA-h2j3-gg8w-4858,2020-09-03T22:12:09Z,"Malicious Package in buffer-xos",buffer-xos,0.0.0,,,CRITICAL,CWE-506,
-GHSA-h2w2-v7j6-xqm4,2026-06-18T14:26:51Z,"npm PraisonAI AgentLoop onToolCall approval runs after tool execution",praisonai,1.4.0,1.7.2,,HIGH,CWE-693;CWE-862;CWE-863,
 GHSA-h36m-2vh5-x699,2026-03-19T03:30:57Z,"Duplicate Advisory: ACPX Windows wrapper shell fallback allowed cwd injection in specific paths",openclaw,2026.2.26,,,MODERATE,CWE-78,
 GHSA-h3hw-29fv-2x75,2026-01-21T16:36:27Z,"@envelop/graphql-modules has a Race Condition vulnerability",@envelop/graphql-modules,0,9.1.0,,HIGH,CWE-362,
 GHSA-h3jj-5f3v-3685,2026-06-16T22:40:06Z,"n8n: Public API Execution Retry Authorization Bypass",n8n,0,2.25.7,,MODERATE,CWE-863,
 GHSA-h3jj-5f3v-3685,2026-06-16T22:40:06Z,"n8n: Public API Execution Retry Authorization Bypass",n8n,2.26.0,2.26.2,,MODERATE,CWE-863,
 GHSA-h3m2-h22h-695r,2020-09-03T17:29:31Z,"Malicious Package in ali-contributor",ali-contributor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-h3rm-78g3-j7cp,2026-07-24T15:43:22Z,"@better-auth/stripe: cross-organization billing tampering in organization subscription actions",@better-auth/stripe,1.4.11,1.6.21,,HIGH,CWE-639;CWE-863,
+GHSA-h3rm-78g3-j7cp,2026-07-24T15:43:22Z,"@better-auth/stripe: cross-organization billing tampering in organization subscription actions",@better-auth/stripe,1.7.0-beta.0,1.7.0-beta.10,,HIGH,CWE-639;CWE-863,
 GHSA-h42x-xx2q-6v6g,2025-03-13T22:38:03Z,"Flowise Pre-auth Arbitrary File Upload",flowise,0,,2.2.7,CRITICAL,CWE-434,
 GHSA-h44f-769q-j6px,2020-09-02T20:33:14Z,"Malicious Package in requet",requet,0,,,CRITICAL,CWE-506,
 GHSA-h45p-w933-jxh3,2021-06-01T21:20:22Z,"Improper Verification of Cryptographic Signature in aws-encryption-sdk-javascript ","@aws-crypto/client-browser",0,1.9.0,,MODERATE,CWE-347,
@@ -8138,21 +8374,25 @@ GHSA-h5mp-5q4p-ggf5,2020-09-03T18:07:05Z,"Prototype Pollution in lodash.defaults
 GHSA-h5vj-f7r9-w564,2020-09-01T21:22:35Z,"Entropy Backdoor in text-qrcode",text-qrcode,0.0.0,,,HIGH,CWE-506,
 GHSA-h5vm-jhq7-w647,2020-09-02T20:17:13Z,"Malicious Package in momen",momen,0,,,CRITICAL,CWE-506,
 GHSA-h5x8-xp6m-x6q4,2026-06-19T22:10:37Z,"@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing","@jhb.software/payload-cloudinary-plugin",0.3.0,0.4.0,,HIGH,CWE-347,
+GHSA-h5xr-fqvj-253p,2026-07-22T12:32:17Z,"Duplicate Advisory: Stored DOM XSS via Resource Locator `cachedResultUrl`",n8n,0,,,HIGH,CWE-79,
 GHSA-h656-5vcf-cm23,2026-03-03T19:08:30Z,"OpenClaw: Unauthorized Telegram Senders Trigger Media Download and Disk Write Before Access Check",openclaw,0,2026.2.24,,MODERATE,"CWE-208;CWE-404;CWE-406;CWE-770",
 GHSA-h6ch-v84p-w6p9,2019-06-13T18:58:54Z,"Regular Expression Denial of Service (ReDoS)",diff,0,3.5.0,,HIGH,CWE-400,
 GHSA-h6m3-cx24-9626,2020-09-03T23:11:45Z,"Malicious Package in js-sla3",js-sla3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-h6mq-3cj6-h738,2020-09-03T23:21:16Z,"Reverse Tabnabbing in showdown",showdown,0,1.9.1,,LOW,CWE-1022,
 GHSA-h726-x36v-rx45,2020-09-03T18:04:54Z,"Prototype Pollution in lodash.merge",lodash.merge,0,4.6.2,,HIGH,CWE-1321,
 GHSA-h87q-g2wp-47pj,2022-02-09T22:41:19Z,"Signatures are mistakenly recognized to be valid in jsrsasign",jsrsasign,0,10.2.0,,MODERATE,CWE-347,
-GHSA-h8r8-wccr-v5f2,2026-03-27T20:41:29Z,"DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",dompurify,0,3.3.2,,MODERATE,CWE-79,
 GHSA-h96f-fc7c-9r55,2021-01-06T19:25:46Z,"Regex denial of service vulnerability in codesample plugin",tinymce,0,5.6.0,,LOW,CWE-400,
 GHSA-h97f-6pqj-q452,2026-03-03T21:48:55Z,"OpenClaw has a IPv6 multicast SSRF classifier bypass",openclaw,0,2026.2.25,,MODERATE,CWE-918,
 GHSA-h97g-4mx7-5p2p,2020-09-03T17:11:36Z,"Open Redirect in apostrophe",apostrophe,0,2.92.0,,MODERATE,CWE-601,
+GHSA-h9fm-xcv2-qfw3,2026-07-22T12:32:17Z,"Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook",n8n,0,,,MODERATE,CWE-306,
 GHSA-h9h6-pwqv-j9hv,2026-06-16T21:32:00Z,"Duplicate Advisory: Bootstrap token replay could widen pending pairing scopes",openclaw,0,,2026.5.10-beta.2,LOW,CWE-266,
 GHSA-h9wq-xcqx-mqxm,2023-07-11T22:46:19Z,"Vendure Cross Site Request Forgery vulnerability impacting all API requests",@vendure/core,0,2.0.3,,LOW,,
 GHSA-h9wr-xr4r-66fh,2020-09-03T18:20:20Z,"Cross-Site Scripting in dmn-js-properties-panel",dmn-js-properties-panel,0,0.3.0,,HIGH,CWE-79,
 GHSA-hc4w-hm59-9w88,2026-06-16T21:31:59Z,"Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment",openclaw,0,,2026.4.24,LOW,CWE-636,
 GHSA-hcm3-8f6r-6xwg,2026-07-02T16:54:44Z,"OpenClaw: Browser debug/export routes could reuse already-open blocked tabs",openclaw,0,2026.4.29,,MODERATE,CWE-862,
+GHSA-hcpx-6fm6-wx23,2026-07-20T22:38:04Z,"Axios form serializer maxDepth bypass via {} metatoken",axios,0.31.1,0.33.0,,MODERATE,CWE-674,
+GHSA-hcpx-6fm6-wx23,2026-07-20T22:38:04Z,"Axios form serializer maxDepth bypass via {} metatoken",axios,1.15.1,1.18.0,,MODERATE,CWE-674,
+GHSA-hfhx-w8p8-4hc7,2026-07-24T21:44:44Z,"Budibase: SSRF via bare fetch() in uploadUrl during AI table generation",@budibase/server,0,,3.38.1,MODERATE,CWE-918,
 GHSA-hfpr-jhpq-x4rm,2026-03-09T19:54:41Z,"OpenClaw: `operator.write` chat.send could reach admin-only config writes",openclaw,0,2026.3.7,,MODERATE,CWE-863,
 GHSA-hfwx-c7q6-g54c,2021-03-12T23:04:46Z,"Vulnerability allowing for reading internal HTTP resources",highcharts-export-server,0,2.1.0,,HIGH,CWE-552,
 GHSA-hfxh-rjv7-2369,2023-11-27T17:25:11Z,"Uptime Kuma Authenticated remote code execution via TailscalePing",uptime-kuma,1.23.0,1.23.7,,MODERATE,,
@@ -8167,14 +8407,16 @@ GHSA-hgwr-wr8h-rxm7,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: Google C
 GHSA-hgxv-3497-3hhj,2023-07-04T18:30:58Z,"Duplicate Advisory: @fastify/oauth2 Oauth2 state parameter reuse",@fastify/oauth2,0,7.2.0,,MODERATE,,
 GHSA-hh43-q692-2xmq,2026-03-29T15:30:19Z,"Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state",openclaw,0,,2026.3.8,CRITICAL,CWE-863,
 GHSA-hj5w-xgw9-w4rj,2020-09-03T19:41:44Z,"Malicious Package in coinstrng",coinstrng,0.0.0,,,CRITICAL,CWE-506,
-GHSA-hjwc-26pj-v3pm,2026-06-18T17:20:55Z,"AgenticMail: Cross-agent task authorization bypass in AgenticMail API",@agenticmail/api,0,0.9.64,,HIGH,CWE-639;CWE-862,
 GHSA-hm63-vwj4-mj2q,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure",openclaw,0,2026.3.22,,MODERATE,CWE-789,
 GHSA-hmfr-rx46-4jx2,2025-08-26T18:42:37Z,"GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation","@escape.tech/graphql-armor-max-depth",0,2.4.2,,MODERATE,CWE-400,
+GHSA-hp3v-mfqw-h74c,2026-07-20T23:24:34Z,"@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped",@astrojs/netlify,0,8.1.2,,LOW,CWE-185,
+GHSA-hp6v-6jw7-gv2f,2026-07-24T21:17:39Z," Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified",@budibase/server,0,,3.38.1,CRITICAL,CWE-287,
 GHSA-hpfq-8wx8-cgqw,2019-06-13T18:59:18Z,"Cross-Site Scripting in ids-enterprise",ids-enterprise,0,4.18.2,,HIGH,CWE-79,
 GHSA-hpr5-wp7c-hh5q,2020-09-01T19:37:29Z,"Cross-Site Scripting in mrk.js",mrk.js,0,2.0.1,,HIGH,CWE-79,
 GHSA-hq75-xg7r-rx6c,2025-07-11T17:09:53Z,"Better Call routing bug can lead to Cache Deception",better-call,0,1.0.12,,MODERATE,CWE-525,
 GHSA-hq8g-qq57-5275,2020-09-11T21:24:33Z,"SQL Injection in untitled-model",untitled-model,0,,,HIGH,CWE-89,
 GHSA-hqf9-8xv5-x8xw,2026-01-05T19:57:46Z,"ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.","@openzeppelin/confidential-contracts",0,0.3.1,,MODERATE,CWE-190,
+GHSA-hr66-5mqr-8mpx,2026-07-24T21:25:00Z," Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint",@budibase/server,0,,3.38.1,HIGH,CWE-200,
 GHSA-hrpp-f84w-xhfg,2020-09-04T16:55:06Z,"Outdated Static Dependency in vue-moment",vue-moment,0,4.1.0,,MODERATE,CWE-1104,
 GHSA-hv4w-jhcj-6wfw,2020-09-03T20:34:23Z,"Cross-Site Scripting in snekserve",snekserve,0.0.0,,,HIGH,CWE-79,
 GHSA-hv7x-3x78-gx53,2026-06-16T18:59:58Z,"n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint",n8n,0,1.123.55,,MODERATE,CWE-284,
@@ -8187,6 +8429,9 @@ GHSA-hvqh-jw65-wcpq,2026-06-22T23:00:50Z,"devbridge-autocomplete has XSS in its
 GHSA-hvxq-j2r4-4jm8,2020-09-03T20:31:04Z,"Regular Expression Denial of Service in sql-injection",sql-injection,0.0.0,,,HIGH,,
 GHSA-hw9r-h9mr-4jff,2026-07-02T16:06:00Z,"OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
 GHSA-hwh3-fhf6-73x9,2020-09-04T15:36:09Z,"Malicious Package in bictoinjs-lib",bictoinjs-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,0,1.123.67,,MODERATE,CWE-1321,
+GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-1321,
+GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,2.32.0,2.32.1,,MODERATE,CWE-1321,
 GHSA-hx4v-668p-g2qr,2026-05-29T18:31:33Z,"Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity",openclaw,0,2026.5.18,,HIGH,CWE-862,
 GHSA-hx5x-49mm-vmhw,2020-09-03T02:36:43Z,"SQL Injection in sails-mysql",sails-mysql,0,0.10.8,,HIGH,CWE-89,
 GHSA-hx78-272p-mqqh,2020-09-03T19:21:11Z,"Authorization Bypass in graphql-shield",graphql-shield,0,6.0.6,,LOW,CWE-285,
@@ -8205,7 +8450,6 @@ GHSA-j44m-5v8f-gc9c,2025-10-10T22:55:09Z,"Flowise is vulnerable to arbitrary fil
 GHSA-j44m-5v8f-gc9c,2025-10-10T22:55:09Z,"Flowise is vulnerable to arbitrary file exposure through its ReadFileTool",flowise-components,0,3.0.8,,HIGH,CWE-22,
 GHSA-j472-gf56-x589,2026-07-02T17:22:52Z,"OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks",openclaw,0,2026.5.12,,HIGH,CWE-184,
 GHSA-j4c5-89f5-f3pm,2026-04-25T23:49:42Z,"OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks",openclaw,0,2026.4.20,,LOW,CWE-918,
-GHSA-j4f3-55x4-r6q2,2026-06-18T14:26:48Z,"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call",praisonai,1.5.0,1.7.2,,CRITICAL,CWE-1188;CWE-306;CWE-862,
 GHSA-j4mr-9xw3-c9jx,2019-05-31T23:47:01Z,"Out-of-bounds Read in base64-url",base64-url,0,2.0.0,,HIGH,CWE-125,
 GHSA-j4vm-hg8g-g9qv,2020-09-03T17:33:50Z,"Malicious Package in antd-cloud",antd-cloud,0.0.0,,,CRITICAL,CWE-506,
 GHSA-j56c-wpqm-h24x,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants",openclaw,0,2026.3.23,,HIGH,CWE-294,
@@ -8227,8 +8471,8 @@ GHSA-j8r2-2x94-2q67,2020-09-11T21:19:09Z,"Cross-Site Scripting in diagram-js-dir
 GHSA-j8v8-g9cx-5qf4,2026-07-07T20:57:05Z,"@better-auth/scim: Account/provider takeover via missing owner binding on non-org SCIM providers",@better-auth/scim,1.5.0,1.7.0-beta.4,,HIGH,CWE-639;CWE-862,
 GHSA-j95h-wmx9-4279,2021-02-25T17:15:39Z,"Denial of Service",sails,0,0.12.0,,HIGH,,
 GHSA-j965-2qgj-vjmq,2026-01-08T22:04:26Z,"JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3",aws-sdk,2.0.0,,3.0.0,LOW,CWE-20,
-GHSA-j99q-93c9-h869,2026-06-18T14:30:43Z,"MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence",@bitbonsai/mcpvault,0,0.11.4,,MODERATE,CWE-178;CWE-41,
 GHSA-j9f8-8h89-j69x,2019-06-11T16:16:34Z,"Remote Code Execution in node-os-utils",node-os-utils,0,1.1.0,,HIGH,CWE-94,
+GHSA-j9fc-w3mr-x6mv,2026-07-24T21:12:40Z," Budibase: Privilege escalation via public role assignment API missing app-level authorization",@budibase/server,0,,3.38.1,HIGH,CWE-269;CWE-862;CWE-863,
 GHSA-j9pv-rrcj-6pfx,2026-04-02T21:01:57Z,"OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes",openclaw,0,2026.3.31,,MODERATE,CWE-212,
 GHSA-jc5m-wrp2-qq38,2026-03-05T21:58:02Z,"Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint",flowise,0,3.0.13,,MODERATE,CWE-200,
 GHSA-jccr-rrw2-vc8h,2026-03-31T23:56:13Z,"OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure",openclaw,0,2026.3.28,,HIGH,CWE-185;CWE-200,
@@ -8258,9 +8502,13 @@ GHSA-jp99-5h8w-gmxc,2020-09-04T15:03:13Z,"Sandbox Breakout / Arbitrary Code Exec
 GHSA-jp9g-5x75-ccp8,2020-09-02T21:34:30Z,"Malicious Package in colro-name",colro-name,0,,,CRITICAL,CWE-506,
 GHSA-jpvj-wpmj-h7rv,2026-06-04T19:37:04Z,"Supply chain compromise via malicious @cap-js/openapi",@cap-js/openapi,1.4.1,1.4.2,,CRITICAL,CWE-506,
 GHSA-jq4x-98m3-ggq6,2026-03-02T22:32:23Z,"OpenClaw Canvas Path Traversal Information Disclosure Vulnerability",openclaw,0,2026.2.21,,HIGH,CWE-22,
+GHSA-jqh4-m9w3-8hp9,2026-07-20T22:27:12Z,"Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`",axios,1.7.0,1.18.0,,MODERATE,CWE-770,
 GHSA-jqjg-v355-hr9q,2020-09-03T22:11:02Z,"Malicious Package in buffer-xop",buffer-xop,0.0.0,,,CRITICAL,CWE-506,
 GHSA-jqpf-vj28-9v7r,2026-03-19T03:30:57Z,"Duplicate Advisory: Synology Chat dmPolicy=allowlist failed open on empty allowedUserIds, allowing unauthorized agent dispatch",openclaw,2026.2.22,,2026.2.23,HIGH,CWE-863,
 GHSA-jqvv-r4w3-8f7w,2020-09-04T15:35:00Z,"Malicious Package in bictoind-rpc",bictoind-rpc,0.0.0,,,CRITICAL,CWE-506,
+GHSA-jqwr-vx3p-r266,2026-07-22T23:20:03Z,"n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances",n8n,0,1.123.67,,MODERATE,CWE-89,
+GHSA-jqwr-vx3p-r266,2026-07-22T23:20:03Z,"n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-89,
+GHSA-jqwr-vx3p-r266,2026-07-22T23:20:03Z,"n8n: PostgresTrigger Node SQL Injection Allows Authenticated Users to Execute Arbitrary SQL on Connected PostgreSQL Instances",n8n,2.32.0,2.32.1,,MODERATE,CWE-89,
 GHSA-jqx4-9gpq-rppm,2025-05-06T16:44:22Z,"@misskey-dev/summaly allows IP Filter Bypass via Redirect",@misskey-dev/summaly,5.1.0,5.2.1,,MODERATE,CWE-346,
 GHSA-jr6x-2q95-fh2g,2026-03-02T21:59:51Z,"OpenClaw's authorization mismatch allowed write-scope agent runs to reach owner-only tools",openclaw,0,2026.3.1,,HIGH,CWE-269;CWE-862,
 GHSA-jrj9-5qp6-2v8q,2020-09-03T23:22:19Z,"Machine-In-The-Middle in airtable",airtable,0.1.19,0.7.2,,HIGH,,
@@ -8297,6 +8545,7 @@ GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect A
 GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior",@openzeppelin/contracts,4.3.0,4.4.2,,MODERATE,,
 GHSA-m734-r4g6-34f9,2019-06-04T19:36:17Z,"NoSQL Injection in loopback-connector-mongodb","loopback-connector-mongodb",0,3.6.0,,HIGH,CWE-89,
 GHSA-m794-qv59-gj7c,2020-09-03T17:03:22Z,"Malicious Package in signqle",signqle,0.0.0,,,CRITICAL,CWE-506,
+GHSA-m7jc-p4hf-xhwq,2026-07-22T12:32:17Z,"Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,0,,,HIGH,CWE-917,
 GHSA-m7qm-r2r5-f77q,2020-09-01T20:43:48Z,"Cross-Site Scripting in react-marked-markdown",react-marked-markdown,0.0.0,,,HIGH,CWE-79,
 GHSA-m837-xvxr-vqwg,2026-05-20T15:38:02Z,"Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage",flowise,0,3.1.2,,MODERATE,CWE-942,
 GHSA-m852-866j-69j8,2020-09-01T20:47:01Z,"Malicious Package in eslint-config-airbnb-standard","eslint-config-airbnb-standard",2.0.0,2.1.0,,CRITICAL,CWE-506,
@@ -8327,25 +8576,31 @@ GHSA-mh5c-679w-hh4r,2020-09-03T21:12:01Z,"Denial of Service in mongodb",mongodb,
 GHSA-mh6f-8j2x-4483,2018-11-26T23:58:21Z,"Critical severity vulnerability that affects event-stream and flatmap-stream",event-stream,3.3.6,4.0.0,,CRITICAL,CWE-506,
 GHSA-mh6f-8j2x-4483,2018-11-26T23:58:21Z,"Critical severity vulnerability that affects event-stream and flatmap-stream",flatmap-stream,0,,,CRITICAL,CWE-506,
 GHSA-mhq8-78pj-5j79,2026-07-02T16:05:38Z,"OpenClaw's POSIX node system.run safe-bin allowlist could be widened by shell expansion",openclaw,0,2026.5.18,,HIGH,CWE-200;CWE-284;CWE-78,
+GHSA-mhvh-gwhr-76pw,2026-07-22T12:32:18Z,"Duplicate Advisory: Google Service Account Private Key Exposed in JWT Header",n8n,0,,,MODERATE,CWE-312,
 GHSA-mhwj-73qx-jqxm,2026-05-11T16:10:12Z,"@theecryptochad/merge-guard has Prototype Pollution in its deepMerge() function","@theecryptochad/merge-guard",0,1.0.1,,HIGH,CWE-1321,
 GHSA-mhxg-pr3j-v9gr,2020-09-03T19:41:22Z,"Malicious Package in colne",colne,0.0.0,,,CRITICAL,CWE-506,
 GHSA-mj4p-rc52-m843,2026-03-13T15:48:16Z,"OpenClaw: Sandbox staged writes could escape the verified parent directory before commit",openclaw,0,2026.3.11,,HIGH,CWE-367;CWE-59,
 GHSA-mjjq-c88q-qhr6,2020-09-03T21:22:00Z,"Cross-Site Scripting in dompurify",dompurify,0,2.0.7,,CRITICAL,CWE-79,
 GHSA-mmph-wp49-r48h,2020-09-02T20:20:26Z,"Malicious Package in experss",experss,0,,,CRITICAL,CWE-506,
 GHSA-mmqv-m45h-q2hp,2020-09-04T15:22:40Z,"Sandbox Breakout / Arbitrary Code Execution in localeval",localeval,0,15.3.0,,CRITICAL,,
+GHSA-mmx7-hfxf-jppx,2026-07-20T22:25:07Z,"Axios: Prototype pollution gadgets can alter axios request construction",axios,0,0.33.0,,MODERATE,CWE-1321,
+GHSA-mmx7-hfxf-jppx,2026-07-20T22:25:07Z,"Axios: Prototype pollution gadgets can alter axios request construction",axios,1.0.0,1.18.0,,MODERATE,CWE-1321,
 GHSA-mp55-2274-4pj8,2020-09-03T21:54:09Z,"Malicious Package in buffer-xgr",buffer-xgr,0.0.0,,,CRITICAL,CWE-506,
 GHSA-mpcx-8qqw-rmcq,2020-08-19T21:51:20Z,"SQL Injection in waterline-sequel",waterline-sequel,0,0.5.1,,HIGH,,
 GHSA-mph8-9v29-pm42,2026-05-06T23:16:24Z,"axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification",@axonflow/sdk,0,6.0.0,,MODERATE,CWE-345;CWE-347,
 GHSA-mpjf-8cmf-p789,2020-09-01T21:25:46Z,"Cross-Site Scripting in jingo",jingo,0,1.9.2,,HIGH,CWE-79,
 GHSA-mq6v-w35g-3c97,2024-02-03T00:37:56Z,"Local File Inclusion vulnerability in zmarkdown",zmarkdown,0,10.1.3,,LOW,,
 GHSA-mq9h-cwc2-6j5r,2020-09-03T17:42:27Z,"Malicious Package in midway-dataproxy",midway-dataproxy,0.0.0,,,CRITICAL,CWE-506,
+GHSA-mqhr-6j6h-74p5,2026-07-24T21:22:51Z," Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak ",@budibase/server,0,,3.38.1,CRITICAL,CWE-200,
 GHSA-mrr8-v49w-3333,2023-07-10T19:08:10Z,"sweetalert2 contains potentially undesirable behavior",sweetalert2,11.6.14,11.22.4,,LOW,CWE-440,
 GHSA-mrvx-jmjw-vggc,2026-06-19T21:42:46Z," SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`",mcp-searxng,0,1.7.1,,HIGH,CWE-918,
 GHSA-mvch-rh6h-2m47,2020-09-11T21:10:29Z,"Malicious Package in equest",equest,0,,,CRITICAL,CWE-506,
 GHSA-mvrp-3cvx-c325,2023-10-04T14:46:06Z,"Zod denial of service vulnerability during email validation",express-zod-api,0,10.0.0-beta1,,HIGH,CWE-1333,
 GHSA-mvw6-62qv-vmqf,2025-07-25T06:30:30Z,"Duplicate Advisory: Koa Open Redirect via Referrer Header (User-Controlled)",koa,0,3.0.1,,LOW,CWE-601,
 GHSA-mw7w-g3mg-xqm7,2026-03-27T22:32:06Z,"OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events",openclaw,0,,2026.3.24,MODERATE,CWE-288;CWE-863,
+GHSA-mwf2-3pr3-8698,2026-07-20T22:37:03Z,"Axios: HTTP/2 streamed uploads bypass `maxBodyLength`",axios,1.13.0,1.18.0,,MODERATE,CWE-400,
 GHSA-mwp6-j9wf-968c,2019-09-13T21:33:25Z,"Critical severity vulnerability that affects generator-jhipster",generator-jhipster,0,6.3.0,,CRITICAL,CWE-338,
+GHSA-mwq7-vcmc-cm4q,2026-07-22T12:32:17Z,"Duplicate Advisory: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner",n8n,0,,,HIGH,CWE-639,
 GHSA-mwv6-3258-q52c,2025-12-11T22:49:27Z,"Next Vulnerable to Denial of Service with Server Components",next,13.3.0,14.2.34,,HIGH,CWE-1395;CWE-400;CWE-502,
 GHSA-mwv6-3258-q52c,2025-12-11T22:49:27Z,"Next Vulnerable to Denial of Service with Server Components",next,15.0.0-canary.0,15.0.6,,HIGH,CWE-1395;CWE-400;CWE-502,
 GHSA-mwv6-3258-q52c,2025-12-11T22:49:27Z,"Next Vulnerable to Denial of Service with Server Components",next,15.1.1-canary.0,15.1.10,,HIGH,CWE-1395;CWE-400;CWE-502,
@@ -8375,7 +8630,9 @@ GHSA-p4mf-4qvh-w8g5,2020-09-04T15:41:42Z,"Malicious Package in bitcionjslib",bit
 GHSA-p56r-jr4p-4wgh,2020-08-03T18:16:37Z,Withdrawn,whereis,0,0.4.1,,HIGH,,
 GHSA-p5p2-rhc3-wmf3,2020-09-03T17:03:31Z,"Malicious Package in siganle",siganle,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p62r-jf56-h429,2020-09-03T20:29:58Z,"Malicious Package in evil-package",evil-package,0.0.0,,,CRITICAL,CWE-506,
-GHSA-p69m-4f92-2v84,2026-06-18T14:26:37Z,"PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool",praisonai,0,1.7.2,,CRITICAL,CWE-94,
+GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,0,3.2.7,,CRITICAL,CWE-22;CWE-552;CWE-862,
+GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,4.0.0,4.1.10,,CRITICAL,CWE-22;CWE-552;CWE-862,
+GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,5.0.0-beta.1,5.0.0-beta.6,,CRITICAL,CWE-22;CWE-552;CWE-862,
 GHSA-p6gq-j5cr-w38f,2026-06-18T14:28:05Z,"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message",nodemailer,0,9.0.1,,HIGH,CWE-73;CWE-918,
 GHSA-p6j4-wvmc-vx2h,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete",openclaw,0,2026.3.22,,MODERATE,CWE-696,
 GHSA-p72p-rjr2-r439,2019-05-29T20:24:02Z,"Server-Side Request Forgery in terriajs-server",terriajs-server,0,2.7.4,,HIGH,CWE-918,
@@ -8391,6 +8648,8 @@ GHSA-p9g3-vpvp-hcj5,2020-09-03T21:41:55Z,"Malicious Package in bufber-xor",bufbe
 GHSA-p9vv-3945-x93h,2020-09-02T15:47:10Z,"Cross-Site Scripting in semantic-ui-search",semantic-ui-search,0,,,HIGH,CWE-79,
 GHSA-pc5p-h8pf-mvwp,2020-04-16T03:14:56Z,"Machine-In-The-Middle in https-proxy-agent",https-proxy-agent,0,2.2.3,,MODERATE,CWE-300,
 GHSA-pc7q-c837-3wjq,2020-09-03T17:02:58Z,"Malicious Package in wallet-address-validtaor",wallet-address-validtaor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-pf2q-pxhf-hgmw,2026-07-22T22:13:36Z,"n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory",n8n,0,2.31.5,,MODERATE,CWE-22,
+GHSA-pf2q-pxhf-hgmw,2026-07-22T22:13:36Z,"n8n: Path-Confinement Bypass in computer-use search_files Allows Reading Files Outside the Base Directory",n8n,2.32.0,2.32.1,,MODERATE,CWE-22,
 GHSA-pf56-h9qf-rxq4,2024-10-07T15:14:40Z,"Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page",@saltcorn/server,0,1.0.0-beta.16,,MODERATE,CWE-79,
 GHSA-pfq2-hh62-7m96,2026-01-13T19:54:29Z,"Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl`",renovate,32.124.0,42.68.5,,MODERATE,CWE-78,
 GHSA-pfv5-rpcw-x34x,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw's allow-always wrapper persistence could bypass future approvals and enable command execution",openclaw,0,,,HIGH,CWE-78,
@@ -8406,10 +8665,15 @@ GHSA-phgf-3849-rgjq,2026-03-31T12:31:35Z,"Duplicate Advisory: OpenClaw: Plugin s
 GHSA-phph-xpj4-wvcv,2020-09-03T21:13:07Z,"Cross-Site Scripting in hexo-admin",hexo-admin,0.0.0,,,HIGH,CWE-79,
 GHSA-pj97-j597-ppm7,2020-09-02T21:15:22Z,"Malicious Package in rqeuest",rqeuest,0,,,CRITICAL,CWE-506,
 GHSA-pjvx-rx66-r3fg,2026-03-09T19:54:08Z,"OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping",openclaw,0,2026.3.7,,MODERATE,CWE-639;CWE-863,
+GHSA-pm4m-ph32-ghv5,2026-07-24T16:47:36Z,"js-yaml: Exponential parsing time in flow collections leads to denial of service",js-yaml,5.0.0,5.2.2,,HIGH,CWE-407,
 GHSA-pm52-wwrw-c282,2019-06-13T18:59:06Z,"Command Injection in wiki-plugin-datalog",wiki-plugin-datalog,0,0.1.6,,HIGH,CWE-94,
 GHSA-pm9v-325f-5g74,2020-09-02T21:30:11Z,"Malicious Package in saync",saync,0,,,CRITICAL,CWE-506,
 GHSA-pmf3-2q63-jmp6,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)",openclaw,0,,2026.2.22,MODERATE,CWE-61,
 GHSA-pmgv-94f5-6w7w,2020-09-02T20:21:30Z,"Malicious Package in eact",eact,0,,,CRITICAL,CWE-506,
+GHSA-pmpg-2mxq-6xwr,2026-07-24T21:43:34Z," Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete",@budibase/server,0,,3.38.1,HIGH,CWE-89,
+GHSA-pmv8-rq9r-6j72,2026-07-20T17:48:18Z,"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",axios,0.28.0,0.33.0,,MODERATE,CWE-400;CWE-770,
+GHSA-pmv8-rq9r-6j72,2026-07-20T17:48:18Z,"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",axios,1.0.0,1.18.0,,MODERATE,CWE-400;CWE-770,
+GHSA-ppr4-5f46-j9c6,2026-07-24T21:16:41Z," Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile",@budibase/server,0,,3.38.1,HIGH,CWE-209,
 GHSA-ppwq-6v66-5m6j,2026-03-26T21:15:59Z,"OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status",openclaw,0,2026.3.22,,MODERATE,CWE-200;CWE-212;CWE-522,
 GHSA-pqhp-25j4-6hq9,2024-11-22T20:40:49Z,"smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables",smol-toml,0,1.3.1,,MODERATE,CWE-674,
 GHSA-pqhr-mp3f-hrpp,2026-03-31T23:26:29Z,"Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters",nuxt-og-image,0,6.2.5,,MODERATE,CWE-918,
@@ -8417,6 +8681,7 @@ GHSA-pqpp-2363-649v,2020-09-02T18:22:30Z,"Cross-Site Scripting in buttle",buttle
 GHSA-pr66-whqj-rq5p,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message",openclaw,0,2026.3.31,,LOW,CWE-351,
 GHSA-prmc-5v5w-c465,2021-04-06T17:32:38Z,"Client TLS credentials sent raw to server in npm package nats",nats,2.0.0-201,2.0.0-209,,CRITICAL,CWE-522,
 GHSA-pv6r-vchh-cxg9,2020-09-03T20:42:09Z,"Denial of Service in apostrophe",apostrophe,0,2.97.1,,LOW,CWE-400,
+GHSA-pvcr-8mvp-w8qr,2026-07-24T21:42:51Z," Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)",@budibase/server,0,,3.38.1,HIGH,CWE-285;CWE-345;CWE-352,
 GHSA-pxmp-fwjc-4x7q,2020-09-03T15:45:23Z,"HTML Injection in marky-markdown",marky-markdown,0.0.0,,,MODERATE,CWE-79,
 GHSA-pxqp-mv67-g528,2020-09-03T21:38:34Z,"Malicious Package in bqffer-xor",bqffer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-q2c6-c6pm-g3gh,2020-09-04T15:07:38Z,"Arbitrary Code Execution in handlebars",handlebars,0,3.0.8,,HIGH,,
@@ -8439,10 +8704,14 @@ GHSA-q4gf-8mx6-v5v3,2026-04-10T15:35:47Z,"Next.js has a Denial of Service with S
 GHSA-q4h9-46xg-m3x9,2021-09-15T20:22:13Z,"UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable","@openzeppelin/contracts-upgradeable",4.1.0,4.3.2,,CRITICAL,,
 GHSA-q4pp-j36h-3gqg,2023-08-24T12:53:06Z,"Minimal `basti` IAM Policy Allows Shell Access",basti-cdk,0,1.0.1,,LOW,,
 GHSA-q4xx-mc3q-23x8,2025-08-14T12:30:22Z,"Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection",flowise,0,,3.0.5,CRITICAL,CWE-94,
+GHSA-q53c-4prm-w95q,2026-07-24T22:34:39Z,"Shescape: Home-directory disclosure in assignment context on Unix with Dash",shescape,0,2.1.14,,MODERATE,CWE-116;CWE-200,
+GHSA-q53c-4prm-w95q,2026-07-24T22:34:39Z,"Shescape: Home-directory disclosure in assignment context on Unix with Dash",shescape,3.0.0,3.0.1,,MODERATE,CWE-116;CWE-200,
 GHSA-q5pp-5q2h-g8rv,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,,,MODERATE,CWE-79,
 GHSA-q5pr-72pq-83v3,2026-03-23T21:44:55Z,"H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,2.0.1-rc.18,,MODERATE,CWE-400,
 GHSA-q643-w9jp-q2qg,2020-09-04T17:34:59Z,"Hardcoded Initialization Vector in parsel",parsel,0.0.0,,,HIGH,,
 GHSA-q67q-549q-p849,2025-09-15T20:11:39Z,"Flowise has arbitrary file access due to missing chat flow id validation",flowise,2.2.8,3.0.6,,CRITICAL,CWE-22,
+GHSA-q6mx-qvhp-fqmg,2026-07-15T12:32:03Z,"Duplicate Advisory: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,0,,,MODERATE,CWE-639,
+GHSA-q6x4-v3qx-85qw,2026-07-24T21:15:02Z," Budibase: SQL Injection via `multipleStatements: true`",@budibase/server,0,,3.38.1,CRITICAL,CWE-89,
 GHSA-q7jf-gf43-6x6p,2025-10-24T19:15:13Z,"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,4.10.3,,MODERATE,CWE-444,
 GHSA-q83v-hq3j-4pq3,2024-08-15T06:32:22Z,"Duplicate Advisory: Improper access control in Directus",directus,0,,10.13.0,MODERATE,CWE-639,
 GHSA-q849-wxrc-vqrp,2024-12-02T20:11:39Z,"hull.js Code Injection Vulnerability",hull.js,0.2.2,1.0.10,,CRITICAL,CWE-94,
@@ -8489,6 +8758,8 @@ GHSA-qpw2-xchm-655q,2022-01-06T20:31:01Z,"Out-of-Bounds read in stringstream",st
 GHSA-qq4x-c6h6-rfxh,2025-03-31T22:37:42Z,"aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct",aws-cdk-lib,2.37.0,2.187.0,,MODERATE,,
 GHSA-qq6h-5g6j-q3cm,2022-11-23T15:26:43Z,"sweetalert2 v11.4.9 and above contains hidden functionality",sweetalert2,11.4.9,11.22.4,,LOW,CWE-912,
 GHSA-qq9g-96v4-m3cj,2026-03-18T16:10:16Z,"Cross-Site Scripting (XSS) via Select Schema Option Value Injection in @pdfme/schemas",@pdfme/schemas,0,5.5.9,,MODERATE,CWE-79,
+GHSA-qq9h-g4jm-xgf3,2026-07-24T15:44:01Z,"Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in",better-auth,1.1.3,1.6.22,,HIGH,CWE-287;CWE-345,
+GHSA-qq9h-g4jm-xgf3,2026-07-24T15:44:01Z,"Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in",better-auth,1.7.0-beta.0,1.7.0-beta.10,,HIGH,CWE-287;CWE-345,
 GHSA-qqf5-x7mj-v43p,2026-06-18T17:24:47Z,"budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL",budibase,0,3.39.19,,HIGH,CWE-89,
 GHSA-qr2g-p6q7-w82m,2026-03-07T02:37:47Z,"x402 SDK Security Advisory",@x402/svm,0,2.6.0,,HIGH,,
 GHSA-qrg3-f6h6-vq8q,2020-08-19T22:15:57Z,"Denial of Service in https-proxy-agent",https-proxy-agent,0,2.2.0,,HIGH,,
@@ -8501,10 +8772,14 @@ GHSA-qrv3-253h-g69c,2026-06-27T00:13:18Z,"pnpm: Path traversal in configDependen
 GHSA-qv2g-99x4-45x6,2021-01-29T18:12:07Z,"Malicious npm package: discord-fix",discord-fix,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qv78-398w-cxp7,2020-09-11T21:08:19Z,"Malicious Package in shrugging-logging",shrugging-logging,0,,,CRITICAL,CWE-506,
 GHSA-qvmw-h675-h7qg,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw validates Zalo outbound photo URLs through the SSRF guard",openclaw,0,2026.4.22,,MODERATE,CWE-918,
+GHSA-qw6m-8fw2-2v64,2026-07-24T21:25:51Z," Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution",@budibase/server,0,,3.38.1,HIGH,CWE-943,
 GHSA-qwmf-95r9-gx9x,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's gateway tokenless Tailscale auth applied to HTTP routes",openclaw,0,,,HIGH,CWE-290,
+GHSA-qwww-vcr4-c8h2,2026-07-24T16:44:43Z,"React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response",react-router,7.12.0,8.3.0,,HIGH,CWE-352,
 GHSA-qx4v-6gc5-f2vv,2019-06-20T14:32:56Z,"Regular Expression Denial of Service",esm,0,3.1.0,,MODERATE,CWE-400,
 GHSA-qxrj-x7rm-2h49,2020-09-03T17:05:59Z,"Malicious Package in dhkey",dhkey,0.0.0,,,CRITICAL,CWE-506,
 GHSA-r27j-894h-3w3p,2026-05-06T17:32:01Z,"mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`",icu-minify,0,4.9.2,,LOW,CWE-1321,
+GHSA-r28c-9q8g-f849,2026-07-24T16:24:55Z,"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",postcss,0,8.5.18,,HIGH,CWE-22,
+GHSA-r292-9mhp-454m,2026-07-24T16:26:16Z,"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection",tar,0,7.5.21,,MODERATE,CWE-400;CWE-674,
 GHSA-r294-2894-92j3,2026-03-03T22:09:26Z,"OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering",openclaw,0,2026.2.23,,MODERATE,CWE-79,
 GHSA-r2c6-8jc8-g32w,2026-02-02T00:30:23Z,"Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl",clawdbot,0,2026.1.29,,HIGH,CWE-669,
 GHSA-r2fx-hp6p-pgrm,2026-06-16T21:31:59Z,"Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state",openclaw,0,,2026.4.24,MODERATE,CWE-863,
@@ -8553,6 +8828,9 @@ GHSA-rc4v-99cr-pjcm,2023-10-17T14:21:16Z,"Prototype Pollution in ali-security/mo
 GHSA-rc8f-r29c-chr6,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing",openclaw,0,,2026.3.24,MODERATE,CWE-307,
 GHSA-rch7-f4h5-x9rj,2019-08-23T00:04:52Z,"Identity Spoofing in libp2p-secio",libp2p-secio,0,0.9.0,,CRITICAL,CWE-290,
 GHSA-rchv-x836-w7xp,2026-03-09T19:52:29Z,"OpenClaw's dashboard leaked gateway auth material via browser URL/query and localStorage",openclaw,0,2026.3.7,,HIGH,CWE-200,
+GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,0,1.123.67,,HIGH,CWE-78,
+GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-78,
+GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,2.32.0,2.32.1,,HIGH,CWE-78,
 GHSA-rcv7-4w2m-gj9v,2020-09-03T23:24:26Z,"Malicious Package in sj-tw-test-security",sj-tw-test-security,0.0.0,,,CRITICAL,CWE-506,
 GHSA-rcx4-77x4-hjx5,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata",openclaw,0,,2026.2.22-2,MODERATE,CWE-807,
 GHSA-rf75-g96h-j3rm,2026-04-02T21:32:52Z,"Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation",openclaw,0,2026.4.2,,MODERATE,CWE-184,
@@ -8561,6 +8839,8 @@ GHSA-rggc-m335-3wvj,2026-07-02T16:03:10Z,"OpenClaw: Same-host trusted-proxy depl
 GHSA-rggq-f2wf-m6cp,2020-09-02T18:31:08Z,"Malicious Package in jajajejejiji",jajajejejiji,0,,,CRITICAL,CWE-506,
 GHSA-rhc3-76jw-4f2x,2020-09-04T17:58:46Z,"Denial of Service in @commercial/ammo",@commercial/ammo,0,2.1.1,,HIGH,,
 GHSA-rj39-33v7-9xrq,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's shell startup env injection bypasses system.run allowlist intent (RCE class)",openclaw,0,,,HIGH,CWE-78,
+GHSA-rjg6-39jm-rgg4,2026-07-24T15:40:54Z,"@better-auth/scim: account takeover and stale access via SCIM provider-id collision",@better-auth/scim,1.4.0-beta.27,1.6.22,,CRITICAL,CWE-20;CWE-639;CWE-862,
+GHSA-rjg6-39jm-rgg4,2026-07-24T15:40:54Z,"@better-auth/scim: account takeover and stale access via SCIM provider-id collision",@better-auth/scim,1.7.0-beta.0,1.7.0-beta.10,,CRITICAL,CWE-20;CWE-639;CWE-862,
 GHSA-rjhc-w3fj-j6x9,2020-09-03T17:32:45Z,"Malicious Package in alipayjsapi",alipayjsapi,0.0.0,,,CRITICAL,CWE-506,
 GHSA-rjvj-673q-4hfw,2020-09-04T17:54:31Z,"Command Injection in traceroute",traceroute,0.0.0,,,CRITICAL,CWE-77,
 GHSA-rm5c-4rmf-vvhw,2026-04-03T03:01:57Z,"OpenClaw: Sandbox file operations use check-then-act, bypassing fd-based TOCTOU defenses",openclaw,0,2026.3.31,,MODERATE,CWE-367,
@@ -8587,6 +8867,7 @@ GHSA-v3f4-w7r7-v3hm,2026-06-19T21:43:09Z,"Uni-CLI: Legacy HTTP MCP transport acc
 GHSA-v3qc-wrwx-j3pw,2026-04-03T03:03:18Z,"OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`",openclaw,0,2026.3.28,,HIGH,CWE-285,
 GHSA-v3rj-xjv7-4jmq,2026-03-25T21:03:56Z,"smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines",smol-toml,0,1.6.1,,MODERATE,CWE-674,
 GHSA-v3wr-67px-44xg,2022-03-03T19:11:14Z,"Execution with Unnecessary Privileges in arc-electron","@advanced-rest-client/base",0,0.1.10,,HIGH,,
+GHSA-v42f-v8xc-j435,2026-07-24T21:44:27Z,"Budibase: SSRF via DNS rebinding in the REST datasource integration",@budibase/server,0,,3.38.1,HIGH,CWE-367;CWE-918,
 GHSA-v457-wxvj-p9w9,2026-04-10T15:36:00Z,"@vitejs/plugin-rsc has a Denial of Service with React Server Components",@vitejs/plugin-rsc,0,0.5.23,,HIGH,CWE-400,
 GHSA-v45m-2wcp-gg98,2020-09-04T17:18:44Z,"Global node_modules Binary Overwrite in bin-links",bin-links,0,1.1.6,,LOW,,
 GHSA-v4x8-gw49-7hv4,2020-09-03T20:37:42Z,"Path Traversal in swagger-injector",swagger-injector,0.0.0,,,CRITICAL,CWE-22,
@@ -8615,15 +8896,18 @@ GHSA-vf5m-q45w-8mh9,2020-09-03T23:00:25Z,"Malicious Package in js-qha3",js-qha3,
 GHSA-vf8q-pw7h-r2x2,2020-09-11T21:15:54Z,"Malicious Package in epress",epress,0,,,CRITICAL,CWE-506,
 GHSA-vg44-fw64-cpjx,2020-03-24T15:08:59Z,"Incorrect Account Used for Signing","@metamask/eth-ledger-bridge-keyring",0,0.2.2,,HIGH,CWE-287,
 GHSA-vg44-fw64-cpjx,2020-03-24T15:08:59Z,"Incorrect Account Used for Signing","eth-ledger-bridge-keyring",0,0.2.1,,HIGH,CWE-287,
+GHSA-vh45-f885-3848,2026-07-24T21:50:45Z,"sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock",sm-crypto,0,0.5.0,,CRITICAL,CWE-338,
 GHSA-vh4c-j2xv-9pv9,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)",openclaw,0,,,MODERATE,CWE-306,
 GHSA-vh4h-fvqf-q9wv,2025-05-01T03:31:17Z,"Duplicate Advisory: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack","@cloudflare/workers-oauth-provider",0,0.0.5,,MODERATE,CWE-287,
 GHSA-vh5j-5fhq-9xwg,2025-06-27T22:06:48Z,"Taylor has race condition in /get-patch that allows purchase token replay",taylored,0,8.1.3,,LOW,CWE-362,
+GHSA-vhcw-f978-xjjg,2026-07-22T12:32:18Z,"Duplicate Advisory: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview",n8n,0,,,HIGH,CWE-79,
+GHSA-vhf8-cg2h-cg3p,2026-07-22T22:07:04Z,"n8n: SSRF Protection Bypass via MCP Client Node",n8n,0,2.31.5,,MODERATE,CWE-918,
+GHSA-vhf8-cg2h-cg3p,2026-07-22T22:07:04Z,"n8n: SSRF Protection Bypass via MCP Client Node",n8n,2.32.0,2.32.1,,MODERATE,CWE-918,
 GHSA-vj2p-7pgw-g2wf,2026-03-27T15:46:53Z,"Postiz App has a High-Severity SSRF Vulnerability via Next.js",postiz,0,,2.0.12,HIGH,CWE-1395;CWE-918,
 GHSA-vjc7-jrh9-9j86,2026-07-06T21:22:10Z,"9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats",9router,0,,0.4.41,CRITICAL,CWE-200;CWE-306;CWE-862,
 GHSA-vjf3-2gpj-233v,2026-02-26T22:45:13Z,"n8n has an SSO Enforcement Bypass in its Self-Service Settings API",n8n,0,2.8.0,,MODERATE,CWE-269;CWE-284;CWE-287,
 GHSA-vjh7-7g9h-fjfh,2025-02-12T19:47:52Z,"Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)",elliptic,0,6.6.1,,CRITICAL,CWE-200,
 GHSA-vjqw-w5jr-g9w5,2026-03-29T15:30:19Z,"Duplicate Advisory: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configured",openclaw,0,2026.3.12,,HIGH,CWE-347,
-GHSA-vjv9-7m7j-h833,2026-06-18T14:26:34Z,"npm PraisonAI SandboxExecutor allowedCommands bypass via shell chaining",praisonai,1.2.3,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
 GHSA-vjvw-wcmw-pr26,2020-09-04T17:37:08Z,"Insufficient Entropy in parsel",parsel,0.0.0,,,CRITICAL,CWE-331,
 GHSA-vm29-7mq3-9jrg,2026-03-31T12:31:35Z,"Duplicate Advisory: OpenClaw: Unavailable local auth SecretRefs could fall through to remote credentials in local mode",OpenClaw,0,2026.3.11,,LOW,CWE-636,
 GHSA-vm67-mh96-95mq,2020-09-03T21:40:48Z,"Malicious Package in bubfer-xor",bubfer-xor,0.0.0,,,CRITICAL,CWE-506,
@@ -8632,7 +8916,6 @@ GHSA-vm7j-4rj6-mw2p,2020-09-03T21:08:42Z,"Malicious Package in ember_cli_babe",e
 GHSA-vmh4-322v-cfpc,2020-09-03T18:18:06Z,"Cross-Site Scripting in cmmn-js-properties-panel",cmmn-js-properties-panel,0,0.8.0,,HIGH,CWE-79,
 GHSA-vmhq-cqm9-6p7q,2026-03-13T20:54:25Z,"OpenClaw: `browser.request` let `operator.write` persist admin-only browser profile changes",openclaw,0,2026.3.11,,HIGH,CWE-863,
 GHSA-vmhw-fhj6-m3g5,2019-05-31T23:46:33Z,"Path Traversal in angular-http-server",angular-http-server,0,1.4.4,,HIGH,CWE-22,
-GHSA-vmmj-pfw7-fjwp,2026-06-18T14:26:32Z,"npm PraisonAI codeMode sandbox escape via Function constructor",praisonai,1.4.0,1.7.2,,CRITICAL,CWE-184;CWE-693,
 GHSA-vp58-j275-797x,2025-02-24T20:49:50Z,"Better Auth allows bypassing the trustedOrigins Protection which leads to ATO",better-auth,0,1.1.21,,HIGH,CWE-601,
 GHSA-vp93-gcx5-4w52,2020-09-11T21:21:19Z,"Cross-Site Scripting in swagger-ui",swagger-ui,0,2.2.1,,MODERATE,CWE-79,
 GHSA-vpgc-7h78-gx8f,2020-09-04T18:05:14Z,"personnummer/js vulnerable to Improper Input Validation",personnummer,0,3.1.0,,LOW,,
@@ -8663,7 +8946,8 @@ GHSA-vxp4-25qp-86qh,2017-10-24T18:33:36Z,"Moderate severity vulnerability that a
 GHSA-vxp4-25qp-86qh,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects ember",ember,2.0.0,2.0.3,,MODERATE,,
 GHSA-vxp4-25qp-86qh,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects ember",ember,2.1.0,2.1.2,,MODERATE,,
 GHSA-vxp4-25qp-86qh,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects ember",ember,2.2.0,2.2.1,,MODERATE,,
-GHSA-vxr8-fq34-vvx9,2026-06-15T20:12:53Z,"DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output",dompurify,0,3.4.9,,LOW,CWE-693,
+GHSA-w28w-gp39-m4p6,2026-07-24T16:23:59Z,"Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer",@prompty/core,0,0.1.5,,CRITICAL,CWE-1336;CWE-94,
+GHSA-w28w-gp39-m4p6,2026-07-24T16:23:59Z,"Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer",@prompty/core,2.0.0-alpha.1,2.0.0-beta.5,,CRITICAL,CWE-1336;CWE-94,
 GHSA-w2fm-25vw-vh7f,2026-04-01T23:58:50Z,"mcp-handler has a tool response leak across concurrent client sessions ('Race Condition')",mcp-handler,0,1.1.0,,HIGH,CWE-1395;CWE-362,
 GHSA-w32g-5hqp-gg6q,2020-09-02T15:41:41Z,"Cross-Site Scripting in mermaid",mermaid,0,8.2.3,,HIGH,CWE-79,
 GHSA-w37m-7fhw-fmv9,2025-12-11T22:49:56Z,"Next Server Actions Source Code Exposure ",next,15.0.0-canary.0,15.0.6,,MODERATE,CWE-1395;CWE-497;CWE-502,
@@ -8690,9 +8974,12 @@ GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-koa,0,2.14.2,,MODERATE,,
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-lambda,0,2.14.2,,MODERATE,,
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-micro,0,2.14.2,,MODERATE,,
+GHSA-w46p-w7w2-fr9g,2026-07-22T12:32:17Z,"Duplicate Advisory:  AI Agents Project Viewer Privilege Escalation via run_node_tool",n8n,0,,,HIGH,CWE-863,
 GHSA-w48f-fwg7-ww6p,2026-04-04T04:24:27Z,"@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding",@stablelib/cbor,0,2.0.3,,HIGH,CWE-1321,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/core,0,,0.1.142,HIGH,,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/server,0,,0.56.0,HIGH,,
+GHSA-w4hw-qcx7-56pr,2026-07-24T22:34:23Z,"Shescape: Shell injection via unescaped parentheses on Windows with CMD",shescape,0,2.1.14,,CRITICAL,CWE-150;CWE-78,
+GHSA-w4hw-qcx7-56pr,2026-07-24T22:34:23Z,"Shescape: Shell injection via unescaped parentheses on Windows with CMD",shescape,3.0.0,3.0.1,,CRITICAL,CWE-150;CWE-78,
 GHSA-w4v6-g3wm-w36c,2026-07-02T16:48:45Z,"OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy",openclaw,0,2026.4.29,,CRITICAL,CWE-863,
 GHSA-w4vp-3mq7-7v82,2020-09-03T15:49:48Z,"Cross-Site Scripting in lazysizes",lazysizes,0,5.2.1-rc1,,HIGH,CWE-79,
 GHSA-w5c7-9qqw-6645,2026-02-18T00:56:51Z,"OpenClaw inter-session prompts could be treated as direct user instructions",openclaw,0,2026.2.13,,HIGH,CWE-345,
@@ -8758,10 +9045,12 @@ GHSA-wp2p-q35g-3rjj,2020-09-01T21:13:01Z,"Malicious Package in soket.io",soket.i
 GHSA-wpfc-3w63-g4hm,2020-09-01T21:09:48Z,"Malicious Package in axois",axois,0,,,CRITICAL,CWE-506,
 GHSA-wpqr-6v78-jr5g,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0,0.39.1,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
 GHSA-wpqr-6v78-jr5g,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0.40.0-preview.2,0.40.0-preview.3,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
+GHSA-wq64-hcrf-8m56,2026-07-22T12:32:17Z,"Duplicate Advisory: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",n8n,0,,,HIGH,CWE-269,
 GHSA-wq95-wr7m-26h4,2025-10-06T03:31:38Z,"Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot",flowise,0,3.0.5,,HIGH,CWE-79,
 GHSA-wqgq-mfvj-6qxp,2020-09-03T19:49:03Z,"Malicious Package in koa-body-parse",koa-body-parse,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wqgx-4q47-j2w5,2020-09-04T17:36:04Z,"Insecure Cryptography Algorithm in parsel",parsel,0.0.0,,,CRITICAL,CWE-327,
 GHSA-wqhw-frpx-5mmp,2020-09-02T16:01:33Z,"Command Injection in tomato",tomato,0,,,HIGH,CWE-77,
+GHSA-wqjv-9729-c5q2,2026-07-24T15:50:40Z,"SvelteKit: Big remote form function payloads can cause Node process to crash",@sveltejs/kit,0,2.69.1,,MODERATE,CWE-248,
 GHSA-wqvq-jvpq-h66f,2026-06-15T17:35:10Z,"Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization",nodemailer,0,8.0.9,,MODERATE,CWE-862,
 GHSA-wr4h-v87w-p3r7,2026-03-18T16:18:32Z,"h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read",h3,0,1.15.6,,MODERATE,CWE-116;CWE-22,
 GHSA-wr4h-v87w-p3r7,2026-03-18T16:18:32Z,"h3 has a Path Traversal via Percent-Encoded Dot Segments in serveStatic Allows Arbitrary File Read",h3,2.0.0,2.0.1-rc.15,,MODERATE,CWE-116;CWE-22,
@@ -8789,11 +9078,15 @@ GHSA-wxj2-777f-vxmf,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripti
 GHSA-wxrm-2h86-v95f,2020-09-03T21:04:20Z,"Malicious Package in pizza-pasta",pizza-pasta,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wxvm-fh75-mpgr,2018-07-26T16:24:34Z,"Critical severity vulnerability that affects dns-sync",dns-sync,0,0.1.1,,CRITICAL,,
 GHSA-wxw3-q3m9-c3jr,2026-05-15T17:33:40Z,"Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE",better-auth,0,1.6.2,,MODERATE,CWE-287;CWE-345;CWE-352,
+GHSA-x27w-589x-frm2,2026-07-20T23:25:07Z,"Astro: Unauthenticated path override in the @astrojs/vercel ISR function",@astrojs/vercel,10.0.3,11.0.3,,MODERATE,CWE-441;CWE-862,
 GHSA-x39m-3393-3qp4,2025-11-14T20:56:02Z,"Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)",flowise-ui,0,3.0.10,,HIGH,CWE-306;CWE-620,
 GHSA-x3ff-w252-2g7j,2026-04-01T22:13:35Z,"StableLib Ed25519 Signature Malleability via Missing S < L Check",@stablelib/ed25519,0,,2.0.2,MODERATE,CWE-347,
 GHSA-x3h8-jrgh-p8jx,2026-05-04T20:23:35Z,"OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs",openclaw,0,2026.4.22,,MODERATE,CWE-200,
 GHSA-x3m6-rprw-862w,2020-09-03T17:43:31Z,"Malicious Package in node-buc",node-buc,0.0.0,,,CRITICAL,CWE-506,
 GHSA-x3w4-mrmv-cw2x,2020-09-03T22:19:44Z,"Malicious Package in buffev-xor",buffev-xor,0.0.0,,,CRITICAL,CWE-506,
+GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",@auth/core,0,0.41.3,,MODERATE,CWE-345;CWE-346;CWE-940,
+GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",next-auth,0,4.24.15,,MODERATE,CWE-345;CWE-346;CWE-940,
+GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",next-auth,5.0.0-beta.1,5.0.0-beta.32,,MODERATE,CWE-345;CWE-346;CWE-940,
 GHSA-x45v-pvpg-hcrh,2020-09-03T19:54:36Z,"Malicious Package in mysql-koa",mysql-koa,0.0.0,,,CRITICAL,CWE-506,
 GHSA-x48m-gp6r-gp4v,2020-09-03T18:21:26Z,"Malicious Package in rate-map",rate-map,1.0.3,1.0.5,,CRITICAL,CWE-506,
 GHSA-x49q-fhhm-r9jf,2026-03-20T15:31:14Z,"Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes",openclaw,0,2026.3.12,,CRITICAL,CWE-862,
@@ -8801,7 +9094,6 @@ GHSA-x4hg-hfwf-p9mw,2026-07-02T20:20:04Z,"@asymmetric-effort/nogginlessdom vulne
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,0,2.2.2,,MODERATE,,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,3.0.0,3.3.2,,MODERATE,,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,4.0.0,4.1.2,,MODERATE,,
-GHSA-x4vx-rjvf-j5p4,2026-06-15T20:00:02Z,"DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects",dompurify,0,,3.4.6,LOW,CWE-79,
 GHSA-x565-32qp-m3vf,2024-04-11T21:30:30Z,"phin may include sensitive headers in subsequent requests after redirect",phin,0,3.7.1,,MODERATE,CWE-200,
 GHSA-x6ch-c6rv-f7wh,2020-09-02T18:34:22Z,"Malicious Package in asymc",asymc,0,,,CRITICAL,CWE-506,
 GHSA-x6gq-467r-hwcc,2020-09-01T21:14:05Z,"Malicious Package in soket.js",soket.js,0,,,CRITICAL,CWE-506,
@@ -8819,6 +9111,7 @@ GHSA-x9p2-fxq6-2m5f,2019-06-20T14:33:07Z,"Reverse Tabnapping in swagger-ui",swag
 GHSA-xc7v-wxcw-j472,2019-06-03T17:08:26Z,"Memory Exposure in tunnel-agent",tunnel-agent,0,0.6.0,,MODERATE,CWE-200,
 GHSA-xcgx-27q5-7634,2020-09-03T19:41:05Z,"Malicious Package in commanedr",commanedr,0.0.0,,,CRITICAL,CWE-506,
 GHSA-xcqx-9jf5-w339,2026-06-19T21:42:43Z," SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`",mcp-searxng,0,1.7.1,,HIGH,CWE-400,
+GHSA-xcx6-4f2g-hhgx,2026-07-24T21:17:03Z," Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs",@budibase/server,0,,3.38.1,HIGH,CWE-863,
 GHSA-xcxh-6cv4-q8p8,2025-08-12T00:13:03Z,"HFS user adding a ""web link"" in HFS is vulnerable to ""target=_blank"" exploit",hfs,0,0.57.10,,LOW,CWE-1022,
 GHSA-xf5p-87ch-gxw2,2019-06-05T14:10:03Z,"Marked ReDoS due to email addresses being evaluated in quadratic time",marked,0.3.14,0.6.2,,MODERATE,CWE-400,
 GHSA-xf64-2f9p-6pqq,2020-09-04T17:24:08Z,"Information Exposure in type-graphql",type-graphql,0,0.17.6,,LOW,CWE-209,
@@ -8826,6 +9119,7 @@ GHSA-xffm-g5w8-qvg7,2025-07-18T20:39:12Z,"@eslint/plugin-kit is vulnerable to Re
 GHSA-xfqj-r5qw-8g4j,2026-04-16T22:47:05Z,"Paperclip: Unauthenticated Access to Multiple API Endpoints in Authenticated Mode",@paperclipai/server,0,2026.416.0,,HIGH,CWE-306,
 GHSA-xfrc-7mj2-5xh9,2020-09-03T17:14:51Z,"Undefined Behavior in zencashjs",zencashjs,0,1.2.0,,CRITICAL,,
 GHSA-xg59-f45v-9r9j,2026-03-31T12:31:36Z,"Duplicate Advisory: OpenClaw's MS Teams sender allowlist bypass when route allowlist is configured and sender allowlist is empty",openclaw,0,2026.3.8,,LOW,CWE-863,
+GHSA-xg5g-26x8-cvf4,2026-07-24T21:17:25Z," Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution",@budibase/server,0,,3.38.1,HIGH,CWE-918,
 GHSA-xg6x-h9c9-2m83,2026-04-03T03:29:59Z,"Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)",better-auth,0,1.4.9,,CRITICAL,CWE-288,
 GHSA-xgh6-85xh-479p,2020-10-16T18:56:26Z,"Regular Expression Denial of Service in npm-user-validate",npm-user-validate,0,1.0.1,,LOW,,
 GHSA-xgp2-cc4r-7vf6,2020-09-03T20:44:21Z,"Denial of Service in http-live-simulator",http-live-simulator,0,1.0.8,,MODERATE,,
@@ -8835,10 +9129,17 @@ GHSA-xh2p-7p87-fhgh,2021-08-05T16:56:58Z,"Incorrect TCR calculation in batchLiqu
 GHSA-xh8g-j88w-6v59,2020-09-03T19:42:16Z,"Malicious Package in cionstring",cionstring,0.0.0,,,CRITICAL,CWE-506,
 GHSA-xh9j-mpc9-2m9p,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw has a Trusted-proxy Control UI pairing bypass which allows unpaired node sessions",openclaw,0,,2026.2.24,MODERATE,CWE-807,
 GHSA-xhjx-mfr6-9rr4,2020-09-01T21:20:28Z,"Command Injection in samsung-remote",samsung-remote,0,1.3.5,,CRITICAL,CWE-77,
+GHSA-xj6q-8x83-jv6g,2026-07-20T17:51:17Z,"Axios: Prototype pollution auth subfields can inject Basic auth",axios,1.15.2,1.18.0,,MODERATE,CWE-1321,
 GHSA-xjj9-2w6f-jg55,2026-03-12T12:30:29Z," Duplicate Advisory: OpenClaw safeBins file-existence oracle information disclosure",openclaw,0,2026.2.19,,MODERATE,CWE-200,
 GHSA-xjr7-3c3g-m763,2026-01-13T20:29:00Z,"Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml file",renovate,39.53.0,40.33.0,,MODERATE,CWE-77,
 GHSA-xm28-fw2x-fqv2,2019-05-31T23:08:14Z,"Denial of Service in foreman",foreman,0,3.0.1,,HIGH,CWE-400,
 GHSA-xm7f-x4wx-wmgv,2019-06-04T15:47:43Z,"Out-of-bounds Read in byte",byte,0,1.4.1,,MODERATE,CWE-125,
+GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,0,1.123.67,,HIGH,CWE-73,
+GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-73,
+GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,2.32.0,2.32.1,,HIGH,CWE-73,
+GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",@auth/core,0.1.0,0.41.3,,HIGH,CWE-20,
+GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",next-auth,4.0.6,4.24.15,,HIGH,CWE-20,
+GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",next-auth,5.0.0-beta.0,5.0.0-beta.32,,HIGH,CWE-20,
 GHSA-xmh9-rg6f-j3mr,2021-03-12T22:39:01Z,"Verification flaw in Solid identity-token-verifier","@solid/identity-token-verifier",0,0.5.2,,MODERATE,CWE-290,
 GHSA-xmmp-hrmx-x5g7,2020-09-02T21:32:22Z,"Malicious Package in bowe",bowe,0,,,CRITICAL,CWE-506,
 GHSA-xmv6-r34m-62p4,2026-03-03T22:08:54Z,"OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot",openclaw,0,2026.2.25,,HIGH,CWE-22;CWE-59,
@@ -8864,5 +9165,8 @@ GHSA-xw79-hhv6-578c,2020-09-11T21:16:59Z,"Cross-Site Scripting in serve",serve,0
 GHSA-xwcj-hwhf-h378,2026-03-16T20:40:13Z,"OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLs",openclaw,0,2026.3.13,,MODERATE,CWE-532,
 GHSA-xwqw-rf2q-xmhf,2020-09-01T21:23:38Z,"Cross-Site Scripting in buefy",buefy,0,0.7.2,,HIGH,CWE-79,
 GHSA-xww8-gqvh-92x9,2026-07-02T15:40:36Z,"OpenClaw: Exec approval display truncation could hide the command being approved",openclaw,0,2026.5.18,,HIGH,CWE-284;CWE-863,
+GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service",n8n,0,1.123.67,,HIGH,CWE-1321,
+GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-1321,
+GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service",n8n,2.32.0,2.32.1,,HIGH,CWE-1321,
 GHSA-xx4c-jj58-r7x6,2021-11-19T20:14:23Z,"Inefficient Regular Expression Complexity in Validator.js",validator,11.1.0,13.7.0,,MODERATE,CWE-1333,
 GHSA-xxj4-96ph-g6j6,2026-03-31T12:31:36Z,"Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path",openclaw,0,2026.3.11,,MODERATE,CWE-367,