@openrewrite/recipes-nodejs 0.48.0 → 0.48.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"util-type-checking.d.ts","sourceRoot":"","sources":["../../src/migrate/util-type-checking.ts"],"names":[],"mappings":"AAKA,OAAO,
|
|
1
|
+
{"version":3,"file":"util-type-checking.d.ts","sourceRoot":"","sources":["../../src/migrate/util-type-checking.ts"],"names":[],"mappings":"AAKA,OAAO,EAAQ,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAC,MAAM,sBAAsB,CAAC;AAWlF,qBAAa,4BAA6B,SAAQ,MAAM;IACpD,QAAQ,CAAC,IAAI,wEAAuE;IACpF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAoE;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,CAA6E;IACzG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAyK;IAE1L,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;CAuH9D"}
|
|
@@ -49,29 +49,25 @@ class UseNativeTypeCheckingMethods extends rewrite_1.Recipe {
|
|
|
49
49
|
});
|
|
50
50
|
return __awaiter(this, void 0, void 0, function* () {
|
|
51
51
|
const unaryAfter = yield _super.visitUnary.call(this, unary, p);
|
|
52
|
-
if (unary.expression.kind
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
}
|
|
64
|
-
}
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
markers: rewrite_1.emptyMarkers,
|
|
72
|
-
tree: (0, java_1.rightPadded)(draft.expression, java_1.emptySpace, rewrite_1.emptyMarkers)
|
|
73
|
-
};
|
|
74
|
-
});
|
|
52
|
+
if (unary.expression.kind !== java_1.J.Kind.MethodInvocation
|
|
53
|
+
|| unaryAfter.expression.kind === java_1.J.Kind.MethodInvocation
|
|
54
|
+
|| unaryAfter.operator.element !== "Not") {
|
|
55
|
+
return unaryAfter;
|
|
56
|
+
}
|
|
57
|
+
const replaced = unaryAfter.expression.kind === java_1.J.Kind.Parentheses
|
|
58
|
+
? unaryAfter.expression.tree.element
|
|
59
|
+
: unaryAfter.expression;
|
|
60
|
+
if (replaced.kind === javascript_1.JS.Kind.Binary) {
|
|
61
|
+
const binary = replaced;
|
|
62
|
+
if (binary.operator.element === "IdentityEquals") {
|
|
63
|
+
return Object.assign(Object.assign({}, binary), { prefix: unaryAfter.prefix, operator: Object.assign(Object.assign({}, binary.operator), { element: "IdentityNotEquals" }) });
|
|
64
|
+
}
|
|
65
|
+
}
|
|
66
|
+
else if (replaced.kind === java_1.J.Kind.Binary) {
|
|
67
|
+
const binary = replaced;
|
|
68
|
+
if (binary.operator.element === "Equal") {
|
|
69
|
+
return Object.assign(Object.assign({}, binary), { prefix: unaryAfter.prefix, operator: Object.assign(Object.assign({}, binary.operator), { element: "NotEqual" }) });
|
|
70
|
+
}
|
|
75
71
|
}
|
|
76
72
|
return unaryAfter;
|
|
77
73
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"util-type-checking.js","sourceRoot":"","sources":["../../src/migrate/util-type-checking.ts"],"names":[],"mappings":";;;;;;;;;;;;AAKA,
|
|
1
|
+
{"version":3,"file":"util-type-checking.js","sourceRoot":"","sources":["../../src/migrate/util-type-checking.ts"],"names":[],"mappings":";;;;;;;;;;;;AAKA,kDAAkF;AAClF,gEAOyC;AACzC,oDAAwD;AAExD,MAAa,4BAA6B,SAAQ,gBAAM;IAAxD;;QACa,SAAI,GAAG,oEAAoE,CAAA;QAC3E,gBAAW,GAAW,gEAAgE,CAAC;QACvF,gBAAW,GAAW,yEAAyE,CAAC;QAChG,SAAI,GAAa,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAyHpM,CAAC;IAvHS,MAAM;;YACR,OAAO,IAAA,eAAK,EAAC,IAAA,uBAAU,EAAC,cAAc,CAAC,EAAE,IAAI,KAAM,SAAQ,8BAAmC;gBAAjD;;oBACzC,WAAM,GAAG,IAAI,0BAAa,CAAC,cAAc,CAAC,CAAC;oBAC3C,YAAO,GAAG,IAAI,0BAAa,CAAC,kBAAkB,CAAC,CAAC;oBAChD,cAAS,GAAG,IAAI,0BAAa,CAAC,oBAAoB,CAAC,CAAC;oBACpD,aAAQ,GAAG,IAAI,0BAAa,CAAC,mBAAmB,CAAC,CAAC;oBAClD,WAAM,GAAG,IAAI,0BAAa,CAAC,iBAAiB,CAAC,CAAC;oBAC9C,YAAO,GAAG,IAAI,0BAAa,CAAC,kBAAkB,CAAC,CAAC;oBAChD,eAAU,GAAG,IAAI,0BAAa,CAAC,qBAAqB,CAAC,CAAC;oBACtD,WAAM,GAAG,IAAI,0BAAa,CAAC,iBAAiB,CAAC,CAAC;oBAC9C,sBAAiB,GAAG,IAAI,0BAAa,CAAC,4BAA4B,CAAC,CAAC;oBACpE,aAAQ,GAAG,IAAI,0BAAa,CAAC,mBAAmB,CAAC,CAAC;oBAClD,aAAQ,GAAG,IAAI,0BAAa,CAAC,mBAAmB,CAAC,CAAC;oBAClD,gBAAW,GAAG,IAAI,0BAAa,CAAC,sBAAsB,CAAC,CAAC;oBACxD,aAAQ,GAAG,IAAI,0BAAa,CAAC,mBAAmB,CAAC,CAAC;oBAClD,aAAQ,GAAG,IAAI,0BAAa,CAAC,mBAAmB,CAAC,CAAC;oBAClD,aAAQ,GAAG,IAAI,0BAAa,CAAC,mBAAmB,CAAC,CAAC;oBAClD,gBAAW,GAAG,IAAI,0BAAa,CAAC,sBAAsB,CAAC,CAAC;gBAoG5D,CAAC;gBAlGmB,UAAU,CAAC,KAAc,EAAE,CAAmB;;;;;wBAC1D,MAAM,UAAU,GAAG,MAAM,OAAM,UAAU,YAAC,KAAK,EAAE,CAAC,CAAY,CAAC;wBAC/D,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,QAAC,CAAC,IAAI,CAAC,gBAAgB;+BAC9C,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,QAAC,CAAC,IAAI,CAAC,gBAAgB;+BACtD,UAAU,CAAC,QAAQ,CAAC,OAAO,UAAqB,EAAE,CAAC;4BACtD,OAAO,UAAU,CAAC;wBACtB,CAAC;wBAGD,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,QAAC,CAAC,IAAI,CAAC,WAAW;4BAC9D,CAAC,CAAE,UAAU,CAAC,UAAwC,CAAC,IAAI,CAAC,OAAO;4BACnE,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;wBAE5B,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;4BACnC,MAAM,MAAM,GAAG,QAAqB,CAAC;4BACrC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,qBAAkC,EAAE,CAAC;gCAC5D,OAAO,gCACA,MAAM,KACT,MAAM,EAAE,UAAU,CAAC,MAAM,EACzB,QAAQ,kCACD,MAAM,CAAC,QAAQ,KAClB,OAAO,2BAED,CAAC;4BACnB,CAAC;wBACL,CAAC;6BAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;4BAEzC,MAAM,MAAM,GAAG,QAAoB,CAAC;4BACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,YAAwB,EAAE,CAAC;gCAClD,OAAO,gCACA,MAAM,KACT,MAAM,EAAE,UAAU,CAAC,MAAM,EACzB,QAAQ,kCACD,MAAM,CAAC,QAAQ,KAClB,OAAO,kBAEF,CAAC;4BAClB,CAAC;wBACL,CAAC;wBAGD,OAAO,UAAU,CAAC;oBACtB,CAAC;iBAAA;gBAEe,qBAAqB,CAAC,MAA0B,EAAE,CAAmB;;;;;wBACjF,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;4BACzC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;4BAEjD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;4BAChC,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAC1C,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;gCAC3C,OAAO,MAAM,IAAA,qBAAQ,EAAA,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BAC5E,CAAC;iCAAM,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCACnD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;gCAC7C,OAAO,MAAM,IAAA,qBAAQ,EAAA,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BAClF,CAAC;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAClD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gCAC5C,OAAO,MAAM,IAAA,qBAAQ,EAAA,mBAAmB,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BAC9E,CAAC;iCAAM,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAChD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gCAC1C,OAAO,MAAM,IAAA,qBAAQ,EAAA,GAAG,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BAC7E,CAAC;iCAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCACjD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;gCAC3C,OAAO,MAAM,IAAA,qBAAQ,EAAA,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BAC9E,CAAC;iCAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCACpD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;gCAC9C,OAAO,MAAM,IAAA,qBAAQ,EAAA,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BACrF,CAAC;iCAAM,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAChD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gCAC1C,OAAO,MAAM,IAAA,qBAAQ,EAAA,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BACtE,CAAC;iCAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAC3D,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,CAAC;gCACrD,OAAO,MAAM,IAAA,qBAAQ,EAAA,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BACrE,CAAC;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAClD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gCAC5C,OAAO,MAAM,IAAA,qBAAQ,EAAA,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BACjF,CAAC;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAClD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gCAC5C,OAAO,MAAM,IAAA,qBAAQ,EAAA,UAAU,GAAG,oBAAoB,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BACpG,CAAC;iCAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCACrD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;gCAC/C,OAAO,MAAM,IAAA,qBAAQ,EAAA,GAAG,GAAG,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BAChF,CAAC;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAClD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gCAC5C,OAAO,MAAM,IAAA,qBAAQ,EAAA,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BAC/E,CAAC;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAClD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gCAC5C,OAAO,MAAM,IAAA,qBAAQ,EAAA,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BACjF,CAAC;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCAClD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;gCAC5C,OAAO,MAAM,IAAA,qBAAQ,EAAA,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BACjF,CAAC;iCAAM,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gCACrD,IAAA,8BAAiB,EAAC,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;gCAC/C,OAAO,MAAM,IAAA,qBAAQ,EAAA,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;4BAC3E,CAAC;wBACL,CAAC;wBACD,OAAO,OAAM,qBAAqB,YAAC,MAAM,EAAE,CAAC,EAAE;oBAClD,CAAC;iBAAA;aACJ,CAAC,CAAC;QACP,CAAC;KAAA;CACJ;AA7HD,oEA6HC"}
|
|
@@ -3601,6 +3601,7 @@ CVE-2024-6484,2024-07-11T18:31:14Z,"Withdrawn Advisory: Bootstrap Cross-Site Scr
|
|
|
3601
3601
|
CVE-2024-6484,2024-07-11T18:31:14Z,"Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability",bootstrap-sass,2.0.0,,3.4.3,MODERATE,CWE-79,
|
|
3602
3602
|
CVE-2024-6485,2024-07-11T18:31:14Z,"Bootstrap Cross-Site Scripting (XSS) vulnerability for data-* attributes",bootstrap,1.4.0,,3.4.1,MODERATE,CWE-79,
|
|
3603
3603
|
CVE-2024-6531,2024-07-11T18:31:14Z,"Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability",bootstrap,4.0.0,5.0.0,,MODERATE,CWE-79,
|
|
3604
|
+
CVE-2024-6533,2025-01-23T22:36:50Z,"Directus has a DOM-Based cross-site scripting (XSS) via layout_options",directus,0,11.3.3,,LOW,CWE-79,
|
|
3604
3605
|
CVE-2024-6534,2024-08-27T19:54:29Z,"Directus has an insecure object reference via PATH presets",directus,0,10.13.2,,MODERATE,CWE-639,
|
|
3605
3606
|
CVE-2024-6582,2024-09-13T18:31:48Z,"Withdrawn Advisory: Lunary Improper Authentication vulnerability",lunary,0,1.4.9,,HIGH,CWE-287;CWE-306,
|
|
3606
3607
|
CVE-2024-6783,2024-07-23T15:31:09Z,"vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)",vue-template-compiler,2.0.0,,,MODERATE,CWE-79,
|
|
@@ -4538,7 +4539,7 @@ CVE-2026-10281,2026-06-01T21:30:42Z,"Claw Orchestrator is missing authentication
|
|
|
4538
4539
|
CVE-2026-10291,2026-06-02T00:31:57Z,"Claw Orchestrator has inefficient regular expression complexity via validateRegex()","@enderfga/claw-orchestrator",0,3.7.1,,MODERATE,CWE-1333;CWE-400,
|
|
4539
4540
|
CVE-2026-10690,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to SSRF","@wonderwhy-er/desktop-commander",0,,0.2.37,LOW,CWE-918,
|
|
4540
4541
|
CVE-2026-10691,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption","@wonderwhy-er/desktop-commander",0,0.2.39,,LOW,CWE-400,
|
|
4541
|
-
CVE-2026-10732,2026-06-05T09:33:46Z,"decompress: Arbitrary File Write via Archive Extraction (Zip Slip)",decompress,0,,4.2.1,MODERATE,CWE-
|
|
4542
|
+
CVE-2026-10732,2026-06-05T09:33:46Z,"decompress: Arbitrary File Write via Archive Extraction (Zip Slip)",decompress,0,,4.2.1,MODERATE,CWE-22;CWE-29,
|
|
4542
4543
|
CVE-2026-10802,2026-06-04T12:30:26Z,"Keystone: GraphQL API Endpoint Lacks Query Depth Limits",@keystone-6/core,0,,6.5.3,LOW,CWE-400,
|
|
4543
4544
|
CVE-2026-11330,2026-06-05T15:32:23Z,"claude-mem: The computeObservationContentHash Function is Vulnerable to Hash Collision",claude-mem,0,12.0.0,,LOW,CWE-327,
|
|
4544
4545
|
CVE-2026-11393,2026-07-29T16:10:46Z,"AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping",@aws/agentcore,0.3.0-preview.7.0,,0.3.0-preview.9.0,HIGH,CWE-94,
|
|
@@ -5789,6 +5790,7 @@ CVE-2026-35209,2026-04-04T06:17:53Z,"defu: Prototype pollution via `__proto__` k
|
|
|
5789
5790
|
CVE-2026-35213,2026-04-04T04:23:03Z,"@hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsing",@hapi/content,0,6.0.1,,HIGH,CWE-1333,
|
|
5790
5791
|
CVE-2026-35214,2026-04-04T06:04:19Z,"Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and file write",@budibase/server,0,3.33.4,,HIGH,CWE-22,
|
|
5791
5792
|
CVE-2026-35216,2026-04-04T06:04:58Z,"Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation Step",@budibase/server,0,3.33.4,,CRITICAL,CWE-78,
|
|
5793
|
+
CVE-2026-35219,2026-08-14T19:18:47Z,"Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist",@budibase/server,0,3.41.3,,HIGH,CWE-918,
|
|
5792
5794
|
CVE-2026-35394,2026-04-04T05:37:10Z,"@mobilenext/mobile-mcp: Arbitrary Android Intent Execution via mobile_open_url",@mobilenext/mobile-mcp,0,0.0.50,,HIGH,CWE-939,
|
|
5793
5795
|
CVE-2026-35408,2026-04-04T06:06:00Z,"Directus: Missing Cross-Origin Opener Policy",directus,0,11.17.0,,HIGH,CWE-346;CWE-693,
|
|
5794
5796
|
CVE-2026-35409,2026-04-04T06:10:53Z,"Directus: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in File Import",directus,0,11.16.0,,HIGH,CWE-20;CWE-918,
|
|
@@ -5854,6 +5856,7 @@ CVE-2026-35669,2026-03-27T22:30:57Z,"OpenClaw: Gateway Plugin HTTP Auth Grants U
|
|
|
5854
5856
|
CVE-2026-35670,2026-03-26T19:08:16Z,"OpenClaw: Synology Chat reply delivery could be rebound through username-based user resolution.",openclaw,0,2026.3.22,,MODERATE,CWE-639;CWE-706;CWE-807,
|
|
5855
5857
|
CVE-2026-3635,2026-03-25T19:32:28Z,"fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",fastify,0,5.8.3,,MODERATE,CWE-348,
|
|
5856
5858
|
CVE-2026-38728,2026-05-15T15:30:45Z,"smtp-server's command parser memory exhaustion denial-of-service",smtp-server,0,3.18.3,,HIGH,CWE-400,
|
|
5859
|
+
CVE-2026-39243,2026-07-10T00:31:25Z,"decompress allows arbitrary hardlink creation during archive extraction",decompress,0,,4.2.1,MODERATE,CWE-59,
|
|
5857
5860
|
CVE-2026-39244,2026-07-10T18:32:19Z,"adm-zip: Crafted ZIP file triggers 4GB memory allocation",adm-zip,0,0.6.0,,HIGH,CWE-400;CWE-789,
|
|
5858
5861
|
CVE-2026-39313,2026-04-16T20:44:32Z,"MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport",mcp-framework,0,0.2.22,,HIGH,CWE-770,
|
|
5859
5862
|
CVE-2026-39315,2026-04-09T20:28:05Z,"Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()",unhead,0,2.1.13,,MODERATE,CWE-184,
|
|
@@ -5919,6 +5922,7 @@ CVE-2026-40255,2026-04-14T20:01:28Z,"@adonisjs/http-server has an Open Redirect
|
|
|
5919
5922
|
CVE-2026-40255,2026-04-14T20:01:28Z,"@adonisjs/http-server has an Open Redirect vulnerability",@adonisjs/http-server,0,7.8.1,,MODERATE,CWE-601,
|
|
5920
5923
|
CVE-2026-40255,2026-04-14T20:01:28Z,"@adonisjs/http-server has an Open Redirect vulnerability",@adonisjs/http-server,8.0.0-next.0,8.2.0,,MODERATE,CWE-601,
|
|
5921
5924
|
CVE-2026-40299,2026-04-10T21:03:55Z,"next-intl has an open redirect vulnerability",next-intl,0,4.9.1,,MODERATE,CWE-601,
|
|
5925
|
+
CVE-2026-40345,2026-08-17T13:32:13Z,"DeepmergeTS has stack exhaustion when merging recursive object graphs",deepmerge-ts,0,8.0.0,,HIGH,CWE-674,
|
|
5922
5926
|
CVE-2026-40346,2026-04-15T19:43:50Z,"NocoBase has SSRF in Workflow HTTP Request and Custom Request Plugins","@nocobase/plugin-workflow-request",0,2.0.37,,MODERATE,CWE-918,
|
|
5923
5927
|
CVE-2026-4039,2026-02-27T21:36:17Z,"OpenClaw: Skill env override host env injection via applySkillConfigEnvOverrides (defense-in-depth)",openclaw,0,2026.2.21,,MODERATE,CWE-1341;CWE-15;CWE-94,
|
|
5924
5928
|
CVE-2026-4040,2026-02-19T22:06:26Z,"OpenClaw safeBins file-existence oracle information disclosure",openclaw,0,2026.2.19,,MODERATE,CWE-203,
|
|
@@ -6754,8 +6758,8 @@ CVE-2026-47388,2026-06-05T16:22:28Z,"NocoDB: Missing Ownership Check in MCP Atta
|
|
|
6754
6758
|
CVE-2026-47423,2026-06-01T14:07:29Z,"DOMPurify XSS via selectedcontent re-clone",dompurify,3.4.4,3.4.5,,HIGH,CWE-79,
|
|
6755
6759
|
CVE-2026-47428,2026-06-01T14:12:18Z,"Vitest browser mode serves unsanitized otelCarrier query parameter as inline script",@vitest/browser,4.0.17,4.1.6,,CRITICAL,CWE-79,
|
|
6756
6760
|
CVE-2026-47428,2026-06-01T14:12:18Z,"Vitest browser mode serves unsanitized otelCarrier query parameter as inline script",@vitest/browser,5.0.0-beta.0,5.0.0-beta.3,,CRITICAL,CWE-79,
|
|
6757
|
-
CVE-2026-47429,2026-06-01T14:09:53Z,"When Vitest UI server is listening, arbitrary file can be read and executed",vitest,0,3.2.6,,CRITICAL,CWE-862,
|
|
6758
|
-
CVE-2026-47429,2026-06-01T14:09:53Z,"When Vitest UI server is listening, arbitrary file can be read and executed",vitest,4.0.0,4.1.0,,CRITICAL,CWE-862,
|
|
6761
|
+
CVE-2026-47429,2026-06-01T14:09:53Z,"When Vitest UI server is listening, arbitrary file can be read and executed",vitest,0,3.2.6,,CRITICAL,CWE-22;CWE-862,
|
|
6762
|
+
CVE-2026-47429,2026-06-01T14:09:53Z,"When Vitest UI server is listening, arbitrary file can be read and executed",vitest,4.0.0,4.1.0,,CRITICAL,CWE-22;CWE-862,
|
|
6759
6763
|
CVE-2026-47430,2026-06-08T12:30:29Z,"Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.","cordova-plugin-inappbrowser",0,6.0.1,,CRITICAL,CWE-20,
|
|
6760
6764
|
CVE-2026-47668,2026-06-05T16:25:23Z,"DbGate: Unauthenticated Remote Code Execution via JSON Script Runner",dbgate-serve,0,7.1.9,,CRITICAL,CWE-1188;CWE-20;CWE-94,
|
|
6761
6765
|
CVE-2026-47669,2026-06-05T16:26:01Z,"DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE",dbgate,0,7.1.9,,CRITICAL,CWE-22,
|
|
@@ -6764,7 +6768,10 @@ CVE-2026-47673,2026-06-04T17:52:04Z,"Hono: JWT middleware accepts any Authorizat
|
|
|
6764
6768
|
CVE-2026-47674,2026-06-04T18:00:22Z,"Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 ",hono,0,4.12.21,,MODERATE,CWE-1289;CWE-185,
|
|
6765
6769
|
CVE-2026-47675,2026-06-04T17:59:25Z,"Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection",hono,0,4.12.21,,MODERATE,CWE-113;CWE-1287,
|
|
6766
6770
|
CVE-2026-47676,2026-06-04T18:01:00Z,"Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths",hono,0,4.12.21,,MODERATE,CWE-444;CWE-693,
|
|
6771
|
+
CVE-2026-47683,2026-08-17T17:32:10Z,"vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike",vm2,0,3.11.6,,HIGH,CWE-770,
|
|
6767
6772
|
CVE-2026-47684,2026-06-05T16:34:59Z,"Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP",@sync-in/server,0,2.3.0,,HIGH,CWE-918,
|
|
6773
|
+
CVE-2026-47686,2026-08-17T17:32:34Z,"VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE",vm2,0,3.11.6,,CRITICAL,CWE-693,
|
|
6774
|
+
CVE-2026-47698,2026-08-17T17:32:41Z,"vm2: Sandbox Breakout Using Dangerous Host Proto Mutators",vm2,0,3.11.6,,CRITICAL,CWE-913,
|
|
6768
6775
|
CVE-2026-47717,2026-05-27T22:51:18Z,"FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations",fuxa-server,1.3.0,1.3.1,,HIGH,CWE-201,
|
|
6769
6776
|
CVE-2026-47718,2026-05-28T20:33:11Z,"FUXA provides guest and invalid-token access to protected read APIs in secure mode",fuxa-server,1.3.0-2773,1.3.1,,MODERATE,CWE-287;CWE-862,
|
|
6770
6777
|
CVE-2026-47719,2026-06-08T23:06:40Z,"FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading",fuxa-server,0,,1.1.14-1243,HIGH,CWE-918,
|
|
@@ -7030,15 +7037,18 @@ CVE-2026-53668,2026-07-23T19:36:31Z,"React Router: Open redirect leading to XSS"
|
|
|
7030
7037
|
CVE-2026-53669,2026-07-23T19:38:28Z,"React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)",react-router,6.0.0,7.18.0,,MODERATE,CWE-601,
|
|
7031
7038
|
CVE-2026-53721,2026-06-16T13:48:31Z,"Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher",nuxt,3.11.0,3.21.7,,HIGH,CWE-178;CWE-863,
|
|
7032
7039
|
CVE-2026-53721,2026-06-16T13:48:31Z,"Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcher",nuxt,4.0.0,4.4.7,,HIGH,CWE-178;CWE-863,
|
|
7033
|
-
CVE-2026-53722,2026-06-16T13:49:36Z,"Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL",nuxt,0,3.21.7,,MODERATE,CWE-79;CWE-83,
|
|
7040
|
+
CVE-2026-53722,2026-06-16T13:49:36Z,"Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL",nuxt,3.0.0,3.21.7,,MODERATE,CWE-79;CWE-83,
|
|
7034
7041
|
CVE-2026-53722,2026-06-16T13:49:36Z,"Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URL",nuxt,4.0.0,4.4.7,,MODERATE,CWE-79;CWE-83,
|
|
7035
7042
|
CVE-2026-53724,2026-06-19T19:35:11Z,"parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist",parse-server,0,8.6.79,,LOW,CWE-434;CWE-79,
|
|
7036
7043
|
CVE-2026-53724,2026-06-19T19:35:11Z,"parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist",parse-server,9.0.0,9.9.1-alpha.4,,LOW,CWE-434;CWE-79,
|
|
7037
7044
|
CVE-2026-53725,2026-06-19T19:35:15Z,"parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied",parse-server,9.8.0,9.9.1-alpha.5,,MODERATE,CWE-200,
|
|
7038
7045
|
CVE-2026-53726,2026-06-19T19:35:19Z,"parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL",parse-server,0,8.6.80,,MODERATE,CWE-639,
|
|
7039
7046
|
CVE-2026-53726,2026-06-19T19:35:19Z,"parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL",parse-server,9.0.0,9.9.1-alpha.6,,MODERATE,CWE-639,
|
|
7047
|
+
CVE-2026-53728,2026-08-17T13:36:17Z,"Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage",@medplum/core,0,5.1.6,,HIGH,CWE-345;CWE-601,
|
|
7040
7048
|
CVE-2026-53765,2026-06-17T14:01:04Z,"Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory",chrome-devtools-mcp,0.20.0,1.1.0,,MODERATE,CWE-59,
|
|
7049
|
+
CVE-2026-53766,2026-08-17T21:56:12Z,"chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots",chrome-devtools-mcp,0.24.0,1.1.0,,MODERATE,CWE-22;CWE-59,
|
|
7041
7050
|
CVE-2026-53781,2026-06-11T21:31:56Z,"@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses",@steipete/summarize-core,0,0.17.0,,MODERATE,CWE-770,
|
|
7051
|
+
CVE-2026-53782,2026-06-11T21:31:57Z,"@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch",@steipete/summarize,0,0.17.0,,MODERATE,CWE-918,
|
|
7042
7052
|
CVE-2026-53806,2026-07-02T17:11:43Z,"OpenClaw: Combined POSIX shell options could confuse exec revalidation",openclaw,0,2026.5.12,,HIGH,CWE-367,
|
|
7043
7053
|
CVE-2026-53809,2026-07-02T16:58:51Z,"OpenClaw: Embedded runner policy could be confused by provider aliases",openclaw,0,2026.4.25,,MODERATE,CWE-863,
|
|
7044
7054
|
CVE-2026-53810,2026-07-02T16:00:42Z,"OpenClaw's marketplace runtime extension metadata could point at unscanned payloads",openclaw,0,2026.5.18,,HIGH,"CWE-284;CWE-78;CWE-829;CWE-94",
|
|
@@ -7092,9 +7102,14 @@ CVE-2026-53947,2026-08-04T21:56:13Z,"Ghost: Member existence leak via magic link
|
|
|
7092
7102
|
CVE-2026-53948,2026-08-04T21:05:39Z,"Ghost: File Upload Content-Type Spoofing",ghost,6.19.4,6.21.1,,MODERATE,CWE-434,
|
|
7093
7103
|
CVE-2026-53949,2026-08-05T14:42:47Z,"Ghost Content API filter bypass reveals private fields",ghost,5.46.1,6.21.2,,MODERATE,CWE-200;CWE-693,
|
|
7094
7104
|
CVE-2026-53950,2026-08-04T21:54:01Z,"XSS in Ghost's ActivityPub client",@tryghost/activitypub,0,3.1.0,,HIGH,CWE-79,
|
|
7105
|
+
CVE-2026-53957,2026-08-19T19:17:00Z,"Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint",@contentful/mcp-server,0,1.7.19,,HIGH,CWE-918,
|
|
7106
|
+
CVE-2026-53957,2026-08-19T19:17:00Z,"Contentful MCP Server: export_space/import_space tools pass LLM-controlled `host`/`proxy` args to CMA client, redirecting server PAT to attacker-controlled endpoint",@contentful/mcp-tools,0,0.4.5,,HIGH,CWE-918,
|
|
7095
7107
|
CVE-2026-54051,2026-06-19T13:35:05Z,"Network-AI: Improper Neutralization of Special Elements used in an OS Command ",network-ai,0,5.9.1,,CRITICAL,CWE-78,
|
|
7096
7108
|
CVE-2026-54052,2026-07-14T19:07:14Z,"n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments",n8n-mcp,0,2.56.1,,CRITICAL,CWE-639;CWE-862,
|
|
7097
7109
|
CVE-2026-54074,2026-06-19T21:15:16Z,"@tinacms/cli: Remote Code Execution in @tinacms/cli via Forestry migration — unsanitised __TINA_INTERNAL__ marker in user-controlled YAML labels",@tinacms/cli,0,2.4.3,,HIGH,CWE-94,
|
|
7110
|
+
CVE-2026-54150,2026-08-20T18:35:11Z,"next-video: Unauthenticated arbitrary file read via /api/video request handler",next-video,0,2.8.1,,MODERATE,CWE-200,
|
|
7111
|
+
CVE-2026-54155,2026-08-20T18:35:33Z,"node-opcua missing nonce verification in UserNameIdentityToken authentication",node-opcua,0,,2.165.0,HIGH,CWE-347,
|
|
7112
|
+
CVE-2026-54156,2026-08-20T18:35:41Z,"node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS",node-opcua,0,2.168.0,,HIGH,CWE-770,
|
|
7098
7113
|
CVE-2026-54157,2026-06-16T20:15:57Z,"LobeHub: Unauthenticated SSRF in `/webapi/proxy`",@lobehub/lobehub,0,2.1.57,,CRITICAL,CWE-918,
|
|
7099
7114
|
CVE-2026-54257,2026-06-15T20:20:24Z,"Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow",electron,42.3.1,42.3.3,,CRITICAL,CWE-120,
|
|
7100
7115
|
CVE-2026-54264,2026-06-15T17:25:55Z,"@angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service Worker",@angular/service-worker,0,,19.2.25,HIGH,CWE-200;CWE-359,
|
|
@@ -7188,12 +7203,14 @@ CVE-2026-54639,2026-07-28T22:23:03Z,"Style Dictionary - Prototype Pollution in c
|
|
|
7188
7203
|
CVE-2026-54658,2026-07-28T22:19:23Z,"@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution",@hypequery/clickhouse,0,2.5.1,,CRITICAL,CWE-89,
|
|
7189
7204
|
CVE-2026-54660,2026-07-29T14:22:46Z,"swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`",swagger-typescript-api,0,13.12.2,,HIGH,"CWE-200;CWE-201;CWE-522;CWE-918",
|
|
7190
7205
|
CVE-2026-54661,2026-07-29T14:31:15Z,"swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template",swagger-typescript-api,0,13.12.2,,HIGH,CWE-1336;CWE-74;CWE-94,
|
|
7191
|
-
CVE-2026-54662,2026-07-29T14:26:38Z,"swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template",swagger-typescript-api,0,13.12.2,,HIGH,CWE-
|
|
7206
|
+
CVE-2026-54662,2026-07-29T14:26:38Z,"swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template",swagger-typescript-api,0,13.12.2,,HIGH,CWE-1336;CWE-74;CWE-94,
|
|
7192
7207
|
CVE-2026-54663,2026-07-29T14:28:58Z,"swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`",swagger-typescript-api,0,13.12.2,,MODERATE,CWE-20;CWE-441;CWE-918,
|
|
7193
7208
|
CVE-2026-54664,2026-07-29T14:33:00Z,"swagger-typescript-api vulnerable to code injection via unescaped enum string values",swagger-typescript-api,0,13.12.2,,HIGH,CWE-1336;CWE-74;CWE-94,
|
|
7194
7209
|
CVE-2026-54666,2026-07-29T14:35:02Z,"swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies",swagger-typescript-api,0,13.12.2,,HIGH,CWE-1336;CWE-74;CWE-94,
|
|
7195
7210
|
CVE-2026-54672,2026-07-24T14:00:59Z,"electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`",app-builder-lib,0,26.15.0,,HIGH,CWE-427,
|
|
7196
7211
|
CVE-2026-54673,2026-07-24T14:03:19Z,"electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`",builder-util-runtime,0,9.7.0,,HIGH,CWE-200,
|
|
7212
|
+
CVE-2026-54688,2026-08-19T19:23:08Z,"SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)",mcp-searxng,0,1.2.1,,MODERATE,CWE-918,
|
|
7213
|
+
CVE-2026-54689,2026-08-19T19:23:16Z,"SearXNG MCP Server: Additional hardened-mode SSRF bypasses",mcp-searxng,0,1.2.1,,MODERATE,CWE-200;CWE-918,
|
|
7197
7214
|
CVE-2026-54705,2026-07-29T17:21:26Z,"mathlive's Lack of Escaping of HTML allows for XSS",mathlive,0,0.110.0,,MODERATE,CWE-116,
|
|
7198
7215
|
CVE-2026-54722,2026-07-30T16:26:52Z,"dssrf has an SSRF bypass with remove_at_symbol_in_string",dssrf,0,1.0.4,,HIGH,CWE-76,
|
|
7199
7216
|
CVE-2026-54729,2026-07-31T16:58:42Z,"dssrf: any users using 1.1.1.1 DNS is impacted by SSRF",dssrf,0,1.0.5,,HIGH,CWE-918,
|
|
@@ -7201,14 +7218,25 @@ CVE-2026-54737,2026-07-31T17:49:08Z,"@phun-ky/defaults-deep Has a Prototype Poll
|
|
|
7201
7218
|
CVE-2026-54753,2026-07-31T16:50:24Z,"`nx graph` dev server permissive CORS policy",nx,17.0.4,22.7.2,,MODERATE,CWE-749;CWE-942,
|
|
7202
7219
|
CVE-2026-54753,2026-07-31T16:50:24Z,"`nx graph` dev server permissive CORS policy",nx,23.0.0-beta.0,23.0.0-beta.2,,MODERATE,CWE-749;CWE-942,
|
|
7203
7220
|
CVE-2026-54756,2026-07-31T19:10:16Z,"Jodit has prototype pollution via Jodit.configure() / ConfigMerge",jodit,0,4.12.18,,MODERATE,CWE-1321,
|
|
7221
|
+
CVE-2026-55086,2026-08-13T14:11:07Z,"ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite",ep_etherpad-lite,0,3.1.0,,MODERATE,CWE-377;CWE-59,
|
|
7222
|
+
CVE-2026-55087,2026-08-13T13:46:07Z,"ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header",ep_etherpad-lite,2.1.0,3.1.0,,MODERATE,CWE-444;CWE-601;CWE-79,
|
|
7223
|
+
CVE-2026-55088,2026-08-13T14:12:44Z,"ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token",ep_etherpad-lite,2.6.0,3.1.0,,MODERATE,CWE-200;CWE-294,
|
|
7224
|
+
CVE-2026-55090,2026-08-17T17:49:38Z,"Etherpad has stored XSS in HTML export via unescaped attribute-pool values",ep_etherpad-lite,0,3.3.0,,HIGH,CWE-79,
|
|
7204
7225
|
CVE-2026-55091,2026-06-19T20:47:52Z,"flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key",flat-to-nested,0,1.1.2,,HIGH,CWE-1321;CWE-915,
|
|
7205
7226
|
CVE-2026-55100,2026-07-31T17:03:27Z,"hashi-vault-js has a path traversal and query parameter injection",hashi-vault-js,0,0.5.2,,HIGH,CWE-23;CWE-74,
|
|
7227
|
+
CVE-2026-55102,2026-08-13T14:14:32Z,"hashi-vault-js: Vault token and secret values exposed in thrown errors",hashi-vault-js,0,0.5.2,,MODERATE,CWE-209;CWE-532,
|
|
7228
|
+
CVE-2026-55156,2026-08-14T21:43:54Z,"Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints","@ooples/token-optimizer-mcp",0,5.1.0,,MODERATE,CWE-22,
|
|
7229
|
+
CVE-2026-55157,2026-08-14T21:42:06Z,"Token Optimizer MCP: OS command injection in smart_user via username in get-user-info","@ooples/token-optimizer-mcp",0,5.1.0,,HIGH,CWE-78,
|
|
7206
7230
|
CVE-2026-55177,2026-07-17T21:35:10Z,"CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard",@tak-ps/cloudtak,0,13.10.0,,HIGH,CWE-918,
|
|
7231
|
+
CVE-2026-55178,2026-08-18T18:00:07Z,"GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data",@geolens/sdk,0,1.2.3,,HIGH,CWE-200;CWE-639;CWE-862,
|
|
7207
7232
|
CVE-2026-55180,2026-06-26T23:12:25Z,"pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",pnpm,0,10.34.2,,MODERATE,CWE-200;CWE-201;CWE-522,
|
|
7208
7233
|
CVE-2026-55180,2026-06-26T23:12:25Z,"pnpm: Repository config can expand victim environment secrets into registry requests before scripts run",pnpm,11.0.0,11.5.3,,MODERATE,CWE-200;CWE-201;CWE-522,
|
|
7209
7234
|
CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE via inherited options.filename",piscina,0,4.9.3,,HIGH,CWE-1321;CWE-94,
|
|
7210
7235
|
CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE via inherited options.filename",piscina,5.0.0-alpha.0,5.2.0,,HIGH,CWE-1321;CWE-94,
|
|
7211
7236
|
CVE-2026-55388,2026-06-18T13:05:11Z,"piscina: Prototype Pollution Gadget → RCE via inherited options.filename",piscina,6.0.0-rc.1,6.0.0-rc.2,,HIGH,CWE-1321;CWE-94,
|
|
7237
|
+
CVE-2026-55410,2026-08-20T18:30:15Z,"NocoBase backup restore schema name allows command injection",@nocobase/plugin-backups,0,2.1.19,,MODERATE,CWE-78,
|
|
7238
|
+
CVE-2026-55445,2026-08-20T18:36:59Z,"Qinglong has an incomplete fix for CVE-2026-3965: Improper Authentication",@whyour/qinglong,0,2.20.1,,CRITICAL,CWE-287,
|
|
7239
|
+
CVE-2026-55451,2026-08-20T20:11:13Z,"gettext-converter: Prototype pollution in js2i18next() via crafted translation keys",gettext-converter,0,1.3.3,,MODERATE,CWE-1321,
|
|
7212
7240
|
CVE-2026-55487,2026-06-26T23:18:13Z,"pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",pnpm,0,10.34.2,,HIGH,CWE-346;CWE-693;CWE-829,
|
|
7213
7241
|
CVE-2026-55487,2026-06-26T23:18:13Z,"pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle",pnpm,11.0.0,11.5.3,,HIGH,CWE-346;CWE-693;CWE-829,
|
|
7214
7242
|
CVE-2026-55500,2026-07-06T21:37:49Z,"9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database Takeover",9router,0,,0.4.71,CRITICAL,CWE-200,
|
|
@@ -7229,8 +7257,8 @@ CVE-2026-55660,2026-06-19T21:15:29Z,"TinaCMS: Cross-origin postMessage handlers
|
|
|
7229
7257
|
CVE-2026-55661,2026-06-18T13:07:05Z,"TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes",@tinacms/mdx,0,2.1.7,,MODERATE,CWE-79;CWE-87,
|
|
7230
7258
|
CVE-2026-55661,2026-06-18T13:07:05Z,"TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes",tinacms,0,3.9.3,,MODERATE,CWE-79;CWE-87,
|
|
7231
7259
|
CVE-2026-55685,2026-07-24T14:06:57Z,"React Router: Unauthenticated Denial of Service via Inefficient Route Matching",react-router,7.0.0,7.18.0,,HIGH,CWE-400;CWE-407,
|
|
7232
|
-
CVE-2026-55697,2026-06-26T23:20:47Z,"pnpm: Repository-controlled configDependencies can select a pacquet native install engine",pnpm,0,
|
|
7233
|
-
CVE-2026-55697,2026-06-26T23:20:47Z,"pnpm: Repository-controlled configDependencies can select a pacquet native install engine",pnpm,11.0.0,11.5.3,,HIGH,CWE-
|
|
7260
|
+
CVE-2026-55697,2026-06-26T23:20:47Z,"pnpm: Repository-controlled configDependencies can select a pacquet native install engine",pnpm,0,10.34.2,,HIGH,CWE-78;CWE-494;CWE-829,
|
|
7261
|
+
CVE-2026-55697,2026-06-26T23:20:47Z,"pnpm: Repository-controlled configDependencies can select a pacquet native install engine",pnpm,11.0.0,11.5.3,,HIGH,CWE-78;CWE-494;CWE-829,
|
|
7234
7262
|
CVE-2026-55698,2026-06-26T23:34:06Z,"pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes",pnpm,0,10.34.2,,HIGH,CWE-345;CWE-494;CWE-829,
|
|
7235
7263
|
CVE-2026-55698,2026-06-26T23:34:06Z,"pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes",pnpm,11.0.0,11.5.3,,HIGH,CWE-345;CWE-494;CWE-829,
|
|
7236
7264
|
CVE-2026-55699,2026-06-26T23:46:53Z,"pnpm: Reserved bin name deletes PNPM_HOME during global remove",pnpm,0,10.34.2,,MODERATE,CWE-22;CWE-73,
|
|
@@ -7246,15 +7274,17 @@ CVE-2026-56268,2026-05-20T15:45:19Z,"Flowise: Cross-Workspace Chatflow Disclosur
|
|
|
7246
7274
|
CVE-2026-56269,2026-04-16T21:22:36Z,"Flowise: Weak Default Token Hash Secret",flowise,0,3.1.0,,MODERATE,CWE-798,
|
|
7247
7275
|
CVE-2026-56270,2026-04-16T21:20:05Z,"Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request",flowise,0,3.1.0,,MODERATE,CWE-306;CWE-312,
|
|
7248
7276
|
CVE-2026-56272,2026-03-05T21:54:31Z,"Flowise has Insufficient Password Salt Rounds",flowise,0,3.0.13,,MODERATE,CWE-328;CWE-916,
|
|
7249
|
-
CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,0,3.21.7,,MODERATE,CWE-
|
|
7250
|
-
CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,4.0.0,4.4.7,,MODERATE,CWE-
|
|
7277
|
+
CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,3.5.0,3.21.7,,MODERATE,CWE-79;CWE-601,
|
|
7278
|
+
CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,4.0.0,4.4.7,,MODERATE,CWE-79;CWE-601,
|
|
7251
7279
|
CVE-2026-56348,2026-05-19T16:17:43Z,"n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass",n8n,0,2.20.0,,MODERATE,CWE-918,
|
|
7252
7280
|
CVE-2026-56351,2026-02-26T15:56:31Z,"n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes",n8n,0,2.4.0,,MODERATE,CWE-89,
|
|
7253
7281
|
CVE-2026-56357,2026-02-26T15:58:34Z,"n8n: Webhook Forgery on Github Webhook Trigger",n8n,0,1.123.15,,MODERATE,CWE-290,
|
|
7254
7282
|
CVE-2026-56357,2026-02-26T15:58:34Z,"n8n: Webhook Forgery on Github Webhook Trigger",n8n,2.0.0,2.5.0,,MODERATE,CWE-290,
|
|
7255
7283
|
CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,0,1.123.25,,MODERATE,CWE-79,
|
|
7256
7284
|
CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,2.0.0-rc.0,2.11.2,,MODERATE,CWE-79,
|
|
7285
|
+
CVE-2026-56677,2026-08-17T21:58:43Z,"9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint",9router,0,,0.5.4,HIGH,CWE-306;CWE-918,
|
|
7257
7286
|
CVE-2026-56761,2026-04-16T01:02:24Z,"hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR",hono,0,4.12.14,,MODERATE,CWE-79,
|
|
7287
|
+
CVE-2026-56876,2026-06-26T18:34:00Z,"extract-zip unvalidated symlink path traversal",extract-zip,0,,2.0.1,HIGH,CWE-22,
|
|
7258
7288
|
CVE-2026-57133,2026-06-18T14:26:54Z,"npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining",praisonai,1.5.1,1.7.2,,HIGH,CWE-693;CWE-78;CWE-863,
|
|
7259
7289
|
CVE-2026-57134,2026-06-18T14:25:17Z,"npm PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation",praisonai,1.5.1,1.7.2,,HIGH,CWE-287;CWE-288;CWE-863,
|
|
7260
7290
|
CVE-2026-57135,2026-06-18T14:26:28Z,"npm PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients",praisonai,1.2.3,1.7.2,,HIGH,CWE-653;CWE-693,
|
|
@@ -7323,8 +7353,8 @@ CVE-2026-59877,2026-07-20T22:03:00Z,"protobufjs: Denial of Service via infinite
|
|
|
7323
7353
|
CVE-2026-59877,2026-07-20T22:03:00Z,"protobufjs: Denial of Service via infinite loop in .proto option parsing",protobufjs,8.0.0,8.6.6,,MODERATE,CWE-835,
|
|
7324
7354
|
CVE-2026-59879,2026-07-21T18:36:27Z,"Immutable.js `List` 32-bit trie overflow → unrecoverable DoS",immutable,0,4.3.9,,HIGH,"CWE-1284;CWE-190;CWE-400;CWE-835",
|
|
7325
7355
|
CVE-2026-59879,2026-07-21T18:36:27Z,"Immutable.js `List` 32-bit trie overflow → unrecoverable DoS",immutable,5.0.0-beta.1,5.1.8,,HIGH,"CWE-1284;CWE-190;CWE-400;CWE-835",
|
|
7326
|
-
CVE-2026-59880,2026-07-21T19:02:33Z,"
|
|
7327
|
-
CVE-2026-59880,2026-07-21T19:02:33Z,"
|
|
7356
|
+
CVE-2026-59880,2026-07-21T19:02:33Z,"Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set",immutable,0,4.3.9,,HIGH,CWE-400;CWE-407,
|
|
7357
|
+
CVE-2026-59880,2026-07-21T19:02:33Z,"Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set",immutable,5.0.0-beta.1,5.1.8,,HIGH,CWE-400;CWE-407,
|
|
7328
7358
|
CVE-2026-59887,2026-07-21T19:06:09Z,"linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text",linkify-it,0,5.0.2,,HIGH,CWE-407,
|
|
7329
7359
|
CVE-2026-59891,2026-07-21T19:34:05Z,"Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry",@sigstore/oci,0,0.7.1,,CRITICAL,CWE-522,
|
|
7330
7360
|
CVE-2026-59892,2026-07-21T19:07:28Z,"OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header","@opentelemetry/propagator-jaeger",0,2.9.0,,HIGH,CWE-248,
|
|
@@ -7333,14 +7363,36 @@ CVE-2026-59896,2026-07-21T18:34:19Z,"hono/jsx does not isolate context per reque
|
|
|
7333
7363
|
CVE-2026-59897,2026-07-21T18:18:13Z,"Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication",hono,4.3.3,4.12.27,,MODERATE,CWE-348,
|
|
7334
7364
|
CVE-2026-59940,2026-07-24T16:14:05Z,"seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization",seroval,0,1.5.3,,CRITICAL,CWE-502;CWE-843,
|
|
7335
7365
|
CVE-2026-59952,2026-07-24T16:14:31Z,"Valibot: record() issue paths can make flatten() throw for inherited Object property names",valibot,0,1.4.2,,MODERATE,CWE-755,
|
|
7366
|
+
CVE-2026-59992,2026-08-19T21:56:30Z,"Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)",next-tinacms-azure,0,14.0.4,,MODERATE,CWE-639;CWE-862,
|
|
7367
|
+
CVE-2026-59992,2026-08-19T21:56:30Z,"Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)",next-tinacms-cloudinary,0,26.0.4,,MODERATE,CWE-639;CWE-862,
|
|
7368
|
+
CVE-2026-59992,2026-08-19T21:56:30Z,"Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)",next-tinacms-dos,0,23.0.4,,MODERATE,CWE-639;CWE-862,
|
|
7369
|
+
CVE-2026-59992,2026-08-19T21:56:30Z,"Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)",next-tinacms-s3,0,23.0.4,,MODERATE,CWE-639;CWE-862,
|
|
7336
7370
|
CVE-2026-6011,2026-04-10T06:31:38Z,"OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.ts",openclaw,0,2026.1.29,,LOW,CWE-918,
|
|
7371
|
+
CVE-2026-61824,2026-08-21T20:54:56Z,"Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors",defuddle,0,0.19.1,,HIGH,CWE-116;CWE-79,
|
|
7337
7372
|
CVE-2026-61835,2026-07-20T21:47:17Z,"Directus: SSRF Protection Bypass via 0.0.0.0 in File Import",directus,0,12.0.0,,HIGH,CWE-918,
|
|
7338
7373
|
CVE-2026-61836,2026-07-20T21:48:15Z,"Directus: Authorization-dependent response served from unsegmented cache key",directus,0,12.0.0,,HIGH,CWE-524;CWE-639,
|
|
7339
7374
|
CVE-2026-6216,2026-04-13T21:30:45Z,"DbGate has cross site scripting via the SVG Icon String Handler component",dbgate-web,0,7.1.5,,LOW,CWE-79,
|
|
7340
7375
|
CVE-2026-62324,2026-07-31T19:08:20Z,"Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSS",jodit,0,4.12.31,,MODERATE,CWE-79;CWE-83,
|
|
7341
7376
|
CVE-2026-6270,2026-04-16T22:29:04Z,"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes",@fastify/middie,0,9.3.2,,CRITICAL,CWE-436,
|
|
7342
|
-
CVE-2026-
|
|
7343
|
-
CVE-2026-
|
|
7377
|
+
CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,0,7.5.2,,MODERATE,CWE-918,
|
|
7378
|
+
CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,7.6.0,7.6.5,,MODERATE,CWE-918,
|
|
7379
|
+
CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,8.0.0,8.0.2,,MODERATE,CWE-918,
|
|
7380
|
+
CVE-2026-63123,2026-08-19T21:56:36Z,"Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root",@tinacms/cli,0,2.5.2,,MODERATE,CWE-352,
|
|
7381
|
+
CVE-2026-63188,2026-08-19T20:24:06Z,"logto-tunnel serves files outside --experience-path via path traversal",@logto/tunnel,0,0.3.9,,HIGH,CWE-22,
|
|
7382
|
+
CVE-2026-6321,2026-05-08T17:15:09Z,"fast-uri vulnerable to path traversal via percent-encoded dot segments",fast-uri,0,2.4.1,,HIGH,CWE-22,
|
|
7383
|
+
CVE-2026-6321,2026-05-08T17:15:09Z,"fast-uri vulnerable to path traversal via percent-encoded dot segments",fast-uri,3.0.0,3.1.1,,HIGH,CWE-22,
|
|
7384
|
+
CVE-2026-6322,2026-05-08T19:13:01Z,"fast-uri vulnerable to host confusion via percent-encoded authority delimiters",fast-uri,0,2.4.1,,HIGH,CWE-140;CWE-436,
|
|
7385
|
+
CVE-2026-6322,2026-05-08T19:13:01Z,"fast-uri vulnerable to host confusion via percent-encoded authority delimiters",fast-uri,3.0.0,3.1.2,,HIGH,CWE-140;CWE-436,
|
|
7386
|
+
CVE-2026-63397,2026-07-16T21:30:38Z,"Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema",@genql/cli,0,6.3.4,,HIGH,CWE-116,
|
|
7387
|
+
CVE-2026-63421,2026-08-21T20:55:11Z,"Keystone vulnerable to `graphql.maxTake` bypass with negative `take`",@keystone-6/core,0,6.5.3,,HIGH,CWE-20;CWE-480,
|
|
7388
|
+
CVE-2026-63462,2026-08-21T19:14:37Z,"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter",unleash-server,0,7.5.2,,HIGH,CWE-674,
|
|
7389
|
+
CVE-2026-63462,2026-08-21T19:14:37Z,"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter",unleash-server,7.6.0,7.6.5,,HIGH,CWE-674,
|
|
7390
|
+
CVE-2026-63462,2026-08-21T19:14:37Z,"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter",unleash-server,8.0.0,8.0.2,,HIGH,CWE-674,
|
|
7391
|
+
CVE-2026-63466,2026-08-21T19:14:52Z,"Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username",unleash-server,0,8.0.3,,MODERATE,CWE-116,
|
|
7392
|
+
CVE-2026-63640,2026-08-18T18:00:16Z,"MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables",magicmirror,0,2.37.0,,MODERATE,CWE-200,
|
|
7393
|
+
CVE-2026-63641,2026-08-18T17:26:41Z,"MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions",magicmirror,0,2.37.0,,LOW,CWE-284,
|
|
7394
|
+
CVE-2026-63642,2026-08-18T17:26:46Z,"MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery",magicmirror,0,2.37.0,,MODERATE,CWE-918,
|
|
7395
|
+
CVE-2026-63643,2026-08-18T17:26:51Z,"MagicMirror: ssrf calendar .js",magicmirror,0,2.37.0,,MODERATE,CWE-441;CWE-918,
|
|
7344
7396
|
CVE-2026-6402,2026-05-18T13:31:42Z,"webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins",webpack-dev-server,0,5.2.4,,MODERATE,CWE-749,
|
|
7345
7397
|
CVE-2026-6410,2026-04-16T22:34:30Z,"@fastify/static vulnerable to path traversal in directory listing",@fastify/static,8.0.0,9.1.1,,MODERATE,CWE-22,
|
|
7346
7398
|
CVE-2026-6414,2026-04-16T22:34:03Z,"@fastify/static vulnerable to route guard bypass via encoded path separators",@fastify/static,8.0.0,9.1.1,,MODERATE,CWE-177,
|
|
@@ -7409,7 +7461,7 @@ CVE-2026-65913,2026-04-03T03:45:08Z,"DOMPurify USE_PROFILES prototype pollution
|
|
|
7409
7461
|
CVE-2026-65914,2026-03-27T20:41:29Z,"DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",dompurify,0,3.3.2,,MODERATE,CWE-79,
|
|
7410
7462
|
CVE-2026-6594,2026-04-20T03:34:41Z,"Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization",@brikcss/merge,0,,1.3.1,MODERATE,CWE-1321;CWE-94,
|
|
7411
7463
|
CVE-2026-66062,2026-08-07T16:50:02Z,"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header",@sveltejs/kit,0,2.70.2,,MODERATE,CWE-1333,
|
|
7412
|
-
CVE-2026-67213,2026-07-29T15:31:12Z,"nanoid: custom generators can loop indefinitely when size is zero",nanoid,0,3.3.
|
|
7464
|
+
CVE-2026-67213,2026-07-29T15:31:12Z,"nanoid: custom generators can loop indefinitely when size is zero",nanoid,0,3.3.18,,HIGH,CWE-835,
|
|
7413
7465
|
CVE-2026-67213,2026-07-29T15:31:12Z,"nanoid: custom generators can loop indefinitely when size is zero",nanoid,4.0.0,5.1.6,,HIGH,CWE-835,
|
|
7414
7466
|
CVE-2026-67214,2026-07-29T15:31:12Z,"nanoid: non-secure generators can loop indefinitely with negative size",nanoid,0,3.3.16,,HIGH,CWE-835,
|
|
7415
7467
|
CVE-2026-67214,2026-07-29T15:31:12Z,"nanoid: non-secure generators can loop indefinitely with negative size",nanoid,4.0.0,5.1.16,,HIGH,CWE-835,
|
|
@@ -7426,6 +7478,8 @@ CVE-2026-68945,2026-08-03T15:59:13Z,"Angular: Cache-Key Ambiguity in HttpTransfe
|
|
|
7426
7478
|
CVE-2026-68945,2026-08-03T15:59:13Z,"Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning",@angular/common,20.0.0-next.0,20.3.27,,HIGH,CWE-345,
|
|
7427
7479
|
CVE-2026-68945,2026-08-03T15:59:13Z,"Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning",@angular/common,21.0.0-next.0,21.2.19,,HIGH,CWE-345,
|
|
7428
7480
|
CVE-2026-68945,2026-08-03T15:59:13Z,"Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning",@angular/common,22.0.0-next.0,22.0.2,,HIGH,CWE-345,
|
|
7481
|
+
CVE-2026-69146,2026-08-17T21:59:01Z,"MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth",mlflow,0,3.15.0,,MODERATE,CWE-862,
|
|
7482
|
+
CVE-2026-69148,2026-08-17T21:59:09Z,"MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id",mlflow,0,3.15.0,,HIGH,CWE-862,
|
|
7429
7483
|
CVE-2026-69149,2026-08-03T16:14:43Z,"Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)",@angular/platform-server,0,,19.2.25,HIGH,CWE-79,
|
|
7430
7484
|
CVE-2026-69149,2026-08-03T16:14:43Z,"Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)",@angular/platform-server,20.0.0-next.0,20.3.27,,HIGH,CWE-79,
|
|
7431
7485
|
CVE-2026-69149,2026-08-03T16:14:43Z,"Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)",@angular/platform-server,21.0.0-next.0,21.2.19,,HIGH,CWE-79,
|
|
@@ -7442,7 +7496,7 @@ CVE-2026-69152,2026-08-03T16:35:32Z,"brace-expansion: DoS via unbounded intermed
|
|
|
7442
7496
|
CVE-2026-69152,2026-08-03T16:35:32Z,"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",brace-expansion,2.0.0,2.1.4,,HIGH,CWE-400;CWE-770,
|
|
7443
7497
|
CVE-2026-69152,2026-08-03T16:35:32Z,"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",brace-expansion,3.0.0,3.0.6,,HIGH,CWE-400;CWE-770,
|
|
7444
7498
|
CVE-2026-69152,2026-08-03T16:35:32Z,"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation",brace-expansion,4.0.0,5.0.9,,HIGH,CWE-400;CWE-770,
|
|
7445
|
-
CVE-2026-69153,2026-08-03T17:11:39Z,"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",postcss,0,8.5.23,,MODERATE,CWE-
|
|
7499
|
+
CVE-2026-69153,2026-08-03T17:11:39Z,"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",postcss,0,8.5.23,,MODERATE,CWE-200;CWE-22,
|
|
7446
7500
|
CVE-2026-69185,2026-08-03T19:09:44Z,"Socket.IO: Zero-attachment Memory Exhaustion",socket.io-parser,0,3.3.6,,HIGH,CWE-20;CWE-754,
|
|
7447
7501
|
CVE-2026-69185,2026-08-03T19:09:44Z,"Socket.IO: Zero-attachment Memory Exhaustion",socket.io-parser,3.4.0,3.4.5,,HIGH,CWE-20;CWE-754,
|
|
7448
7502
|
CVE-2026-69185,2026-08-03T19:09:44Z,"Socket.IO: Zero-attachment Memory Exhaustion",socket.io-parser,4.0.0,4.2.7,,HIGH,CWE-20;CWE-754,
|
|
@@ -7462,7 +7516,7 @@ CVE-2026-69255,2026-08-04T15:40:28Z,"Flowise: CSV Agent Remote Code Execution vi
|
|
|
7462
7516
|
CVE-2026-69255,2026-08-04T15:40:28Z,"Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified",flowise-components,0,3.1.3,,CRITICAL,CWE-94,
|
|
7463
7517
|
CVE-2026-69256,2026-08-04T15:46:20Z,"Flowise: Remote Code Execution Vulnerability in CSVAgent",flowise,0,3.1.3,,CRITICAL,CWE-94,
|
|
7464
7518
|
CVE-2026-69256,2026-08-04T15:46:20Z,"Flowise: Remote Code Execution Vulnerability in CSVAgent",flowise-components,0,3.1.3,,CRITICAL,CWE-94,
|
|
7465
|
-
CVE-2026-69257,2026-08-04T15:51:58Z,"Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses",flowise,0,3.1.3,,HIGH,CWE-
|
|
7519
|
+
CVE-2026-69257,2026-08-04T15:51:58Z,"Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses",flowise,0,3.1.3,,HIGH,CWE-1389;CWE-918,
|
|
7466
7520
|
CVE-2026-69258,2026-08-04T15:56:11Z,"Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API",flowise,0,3.1.3,,HIGH,CWE-639;CWE-915,
|
|
7467
7521
|
CVE-2026-69259,2026-08-04T16:05:10Z,"Flowise RCE via SQLite Record Manager Node",flowise,0,3.1.3,,CRITICAL,CWE-94,
|
|
7468
7522
|
CVE-2026-69259,2026-08-04T16:05:10Z,"Flowise RCE via SQLite Record Manager Node",flowise-components,0,3.1.3,,CRITICAL,CWE-94,
|
|
@@ -7536,13 +7590,13 @@ CVE-2026-70607,2026-08-05T16:24:17Z,"Electron: window.open features string contr
|
|
|
7536
7590
|
CVE-2026-70607,2026-08-05T16:24:17Z,"Electron: window.open features string controls some window options considered privileged",electron,40.0.0-alpha.1,40.9.0,,MODERATE,CWE-20,
|
|
7537
7591
|
CVE-2026-70607,2026-08-05T16:24:17Z,"Electron: window.open features string controls some window options considered privileged",electron,41.0.0-alpha.1,41.2.1,,MODERATE,CWE-20,
|
|
7538
7592
|
CVE-2026-70607,2026-08-05T16:24:17Z,"Electron: window.open features string controls some window options considered privileged",electron,42.0.0-alpha.1,42.0.0-beta.3,,MODERATE,CWE-20,
|
|
7539
|
-
CVE-2026-70608,2026-08-05T17:27:18Z,"Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path",electron,0,39.8.10,,HIGH,CWE-
|
|
7540
|
-
CVE-2026-70608,2026-08-05T17:27:18Z,"Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path",electron,40.0.0-alpha.1,41.10.3,,HIGH,CWE-
|
|
7541
|
-
CVE-2026-70608,2026-08-05T17:27:18Z,"Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path",electron,42.0.0-alpha.1,42.0.1,,HIGH,CWE-
|
|
7542
|
-
CVE-2026-70609,2026-08-05T17:32:47Z,"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter",electron,0,39.8.7,,MODERATE,CWE-
|
|
7543
|
-
CVE-2026-70609,2026-08-05T17:32:47Z,"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter",electron,40.0.0-alpha.1,40.9.0,,MODERATE,CWE-
|
|
7544
|
-
CVE-2026-70609,2026-08-05T17:32:47Z,"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter",electron,41.0.0-alpha.1,41.2.0,,MODERATE,CWE-
|
|
7545
|
-
CVE-2026-70609,2026-08-05T17:32:47Z,"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter",electron,42.0.0-alpha.1,42.0.0-beta.1,,MODERATE,CWE-
|
|
7593
|
+
CVE-2026-70608,2026-08-05T17:27:18Z,"Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path",electron,0,39.8.10,,HIGH,CWE-1021;CWE-693,
|
|
7594
|
+
CVE-2026-70608,2026-08-05T17:27:18Z,"Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path",electron,40.0.0-alpha.1,41.10.3,,HIGH,CWE-1021;CWE-693,
|
|
7595
|
+
CVE-2026-70608,2026-08-05T17:27:18Z,"Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path",electron,42.0.0-alpha.1,42.0.1,,HIGH,CWE-1021;CWE-693,
|
|
7596
|
+
CVE-2026-70609,2026-08-05T17:32:47Z,"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter",electron,0,39.8.7,,MODERATE,CWE-116;CWE-94,
|
|
7597
|
+
CVE-2026-70609,2026-08-05T17:32:47Z,"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter",electron,40.0.0-alpha.1,40.9.0,,MODERATE,CWE-116;CWE-94,
|
|
7598
|
+
CVE-2026-70609,2026-08-05T17:32:47Z,"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter",electron,41.0.0-alpha.1,41.2.0,,MODERATE,CWE-116;CWE-94,
|
|
7599
|
+
CVE-2026-70609,2026-08-05T17:32:47Z,"Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter",electron,42.0.0-alpha.1,42.0.0-beta.1,,MODERATE,CWE-116;CWE-94,
|
|
7546
7600
|
CVE-2026-70610,2026-08-05T17:41:20Z,"Electron: contextBridge object copy honors prototype setters",electron,0,39.8.9,,MODERATE,CWE-1321,
|
|
7547
7601
|
CVE-2026-70610,2026-08-05T17:41:20Z,"Electron: contextBridge object copy honors prototype setters",electron,40.0.0-alpha.1,40.9.2,,MODERATE,CWE-1321,
|
|
7548
7602
|
CVE-2026-70610,2026-08-05T17:41:20Z,"Electron: contextBridge object copy honors prototype setters",electron,41.0.0-alpha.1,41.2.2,,MODERATE,CWE-1321,
|
|
@@ -7563,7 +7617,7 @@ CVE-2026-71315,2026-08-05T21:05:18Z,"Nuxt route rules silently dropped for mixed
|
|
|
7563
7617
|
CVE-2026-71316,2026-08-05T21:14:33Z,"Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients",nuxt,4.4.0,4.5.1,,HIGH,CWE-524;CWE-862,
|
|
7564
7618
|
CVE-2026-71318,2026-08-05T21:21:33Z,"Nuxt: Unauthorized Component Instantiation via Server Island Props",nuxt,3.1.0,3.21.10,,MODERATE,CWE-20,
|
|
7565
7619
|
CVE-2026-71318,2026-08-05T21:21:33Z,"Nuxt: Unauthorized Component Instantiation via Server Island Props",nuxt,4.0.0,4.5.1,,MODERATE,CWE-20,
|
|
7566
|
-
CVE-2026-71319,2026-08-05T21:27:39Z,"Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host",@nuxt/devtools,0,3.3.1,,CRITICAL,CWE-
|
|
7620
|
+
CVE-2026-71319,2026-08-05T21:27:39Z,"Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host",@nuxt/devtools,0,3.3.1,,CRITICAL,CWE-306;CWE-94,
|
|
7567
7621
|
CVE-2026-71320,2026-08-05T21:29:55Z,"Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props",nuxt,3.4.0,3.21.10,,HIGH,CWE-74;CWE-94,
|
|
7568
7622
|
CVE-2026-71320,2026-08-05T21:29:55Z,"Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props",nuxt,4.0.0,4.5.1,,HIGH,CWE-74;CWE-94,
|
|
7569
7623
|
CVE-2026-71321,2026-08-05T21:43:03Z,"Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation",nuxt,3.1.0,3.21.10,,HIGH,CWE-407;CWE-770,
|
|
@@ -7591,10 +7645,79 @@ CVE-2026-71849,2026-08-07T18:38:48Z,"Hono: Proxy Helper does not remove response
|
|
|
7591
7645
|
CVE-2026-71850,2026-08-07T18:42:01Z,"Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure",hono,3.8.0,4.12.34,,MODERATE,CWE-488,
|
|
7592
7646
|
CVE-2026-71851,2026-08-07T18:48:59Z,"crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain",crypto-js,0,4.0.0,,CRITICAL,CWE-331;CWE-334;CWE-338,
|
|
7593
7647
|
CVE-2026-7223,2026-04-28T06:30:29Z,"BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue",@dadigua/hyperchat,0,,2.0.0-alpha.63,MODERATE,CWE-918,
|
|
7648
|
+
CVE-2026-72744,2026-08-07T16:45:21Z,"Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint",nuxt,3.21.7,3.21.10,,MODERATE,CWE-200,
|
|
7649
|
+
CVE-2026-72744,2026-08-07T16:45:21Z,"Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint",nuxt,4.4.7,4.5.1,,MODERATE,CWE-200,
|
|
7650
|
+
CVE-2026-73300,2026-07-24T21:15:02Z," Budibase: SQL Injection via `multipleStatements: true`",@budibase/server,0,,3.38.1,CRITICAL,CWE-89,
|
|
7651
|
+
CVE-2026-73301,2026-07-24T21:13:07Z," Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings",@budibase/server,0,,3.38.1,MODERATE,CWE-862,
|
|
7652
|
+
CVE-2026-73302,2026-07-24T21:17:39Z," Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified",@budibase/server,0,,3.38.1,CRITICAL,CWE-287,
|
|
7653
|
+
CVE-2026-73303,2026-07-24T21:14:49Z," Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)",@budibase/server,0,,3.38.1,HIGH,CWE-639,
|
|
7654
|
+
CVE-2026-73304,2026-07-24T21:14:31Z," Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users",@budibase/server,0,3.39.25,,MODERATE,CWE-200,
|
|
7655
|
+
CVE-2026-73305,2026-07-24T21:12:40Z," Budibase: Privilege escalation via public role assignment API missing app-level authorization",@budibase/server,0,,3.38.1,HIGH,CWE-269;CWE-862;CWE-863,
|
|
7656
|
+
CVE-2026-73306,2026-07-24T21:43:11Z," Budibase: Account Enumeration via Login Lockout Response Differential",@budibase/server,0,,3.38.1,MODERATE,CWE-204,
|
|
7657
|
+
CVE-2026-73307,2026-07-24T21:44:44Z,"Budibase: SSRF via bare fetch() in uploadUrl during AI table generation",@budibase/server,0,,3.38.1,MODERATE,CWE-918,
|
|
7658
|
+
CVE-2026-73308,2026-07-24T21:25:20Z," Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders",@budibase/server,0,,3.38.1,MODERATE,CWE-200,
|
|
7659
|
+
CVE-2026-73406,2026-07-24T21:25:00Z," Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint",@budibase/server,0,,3.38.1,HIGH,CWE-200,
|
|
7660
|
+
CVE-2026-73409,2026-07-24T21:16:41Z," Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile",@budibase/server,0,,3.38.1,HIGH,CWE-209,
|
|
7661
|
+
CVE-2026-73410,2026-07-24T21:44:27Z,"Budibase: SSRF via DNS rebinding in the REST datasource integration",@budibase/server,0,,3.38.1,HIGH,CWE-367;CWE-918,
|
|
7662
|
+
CVE-2026-73411,2026-07-24T22:34:39Z,"Shescape: Home-directory disclosure in assignment context on Unix with Dash",shescape,0,2.1.14,,MODERATE,CWE-116;CWE-200,
|
|
7663
|
+
CVE-2026-73411,2026-07-24T22:34:39Z,"Shescape: Home-directory disclosure in assignment context on Unix with Dash",shescape,3.0.0,3.0.1,,MODERATE,CWE-116;CWE-200,
|
|
7664
|
+
CVE-2026-73412,2026-07-24T22:33:38Z,"Shescape: Path disclosure on Unix with Zsh",shescape,0,2.1.14,,MODERATE,CWE-78;CWE-155,
|
|
7665
|
+
CVE-2026-73412,2026-07-24T22:33:38Z,"Shescape: Path disclosure on Unix with Zsh",shescape,3.0.0,3.0.1,,MODERATE,CWE-78;CWE-155,
|
|
7666
|
+
CVE-2026-73413,2026-07-24T22:35:08Z,"Shescape: Quadratic-time denial of service in the flag-protection",shescape,2.1.11,2.1.14,,HIGH,CWE-400;CWE-407,
|
|
7667
|
+
CVE-2026-73413,2026-07-24T22:35:08Z,"Shescape: Quadratic-time denial of service in the flag-protection",shescape,3.0.0,3.0.1,,HIGH,CWE-400;CWE-407,
|
|
7668
|
+
CVE-2026-73414,2026-07-24T22:34:23Z,"Shescape: Shell injection via unescaped parentheses on Windows with CMD",shescape,0,2.1.14,,CRITICAL,CWE-150;CWE-78,
|
|
7669
|
+
CVE-2026-73414,2026-07-24T22:34:23Z,"Shescape: Shell injection via unescaped parentheses on Windows with CMD",shescape,3.0.0,3.0.1,,CRITICAL,CWE-150;CWE-78,
|
|
7670
|
+
CVE-2026-73418,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",@auth/core,0.1.0,0.41.3,,HIGH,CWE-20,
|
|
7671
|
+
CVE-2026-73418,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",next-auth,4.0.6,4.24.15,,HIGH,CWE-20,
|
|
7672
|
+
CVE-2026-73418,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",next-auth,5.0.0-beta.0,5.0.0-beta.32,,HIGH,CWE-20,
|
|
7673
|
+
CVE-2026-73419,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",@auth/core,0,0.41.3,,MODERATE,CWE-345;CWE-346;CWE-940,
|
|
7674
|
+
CVE-2026-73419,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",next-auth,0,4.24.15,,MODERATE,CWE-345;CWE-346;CWE-940,
|
|
7675
|
+
CVE-2026-73419,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",next-auth,5.0.0-beta.1,5.0.0-beta.32,,MODERATE,CWE-345;CWE-346;CWE-940,
|
|
7676
|
+
CVE-2026-73420,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",@auth/core,0.1.0,0.41.3,,CRITICAL,CWE-180,
|
|
7677
|
+
CVE-2026-73420,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",next-auth,4.10.3,4.24.15,,CRITICAL,CWE-180,
|
|
7678
|
+
CVE-2026-73420,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",next-auth,5.0.0-beta.1,5.0.0-beta.32,,CRITICAL,CWE-180,
|
|
7679
|
+
CVE-2026-73421,2026-07-23T14:52:23Z,"Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)",next-auth,5.0.0-beta.0,5.0.0-beta.32,,CRITICAL,CWE-285;CWE-636,
|
|
7680
|
+
CVE-2026-73422,2026-07-20T21:08:16Z,"Astro: Reflected XSS via unescaped View Transition animation properties",astro,2.9.0,7.1.0,,MODERATE,CWE-79,
|
|
7681
|
+
CVE-2026-73423,2026-07-20T23:26:27Z,"Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered",astro,7.0.0,7.0.6,,MODERATE,CWE-352,
|
|
7682
|
+
CVE-2026-73424,2026-07-20T23:25:07Z,"Astro: Unauthenticated path override in the @astrojs/vercel ISR function",@astrojs/vercel,10.0.3,11.0.3,,MODERATE,CWE-441;CWE-862,
|
|
7683
|
+
CVE-2026-73425,2026-07-20T23:24:34Z,"@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped",@astrojs/netlify,0,8.1.2,,LOW,CWE-185,
|
|
7684
|
+
CVE-2026-73426,2026-03-12T17:29:30Z,"Trix has a Stored XSS vulnerability through serialized attributes",trix,0,2.1.17,,MODERATE,CWE-79,
|
|
7685
|
+
CVE-2026-73427,2026-03-29T15:22:17Z,"Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)",trix,0,2.1.18,,LOW,CWE-79,
|
|
7686
|
+
CVE-2026-73428,2026-07-24T16:18:01Z,"Trix: Stored XSS via HTMLParser attribute injection on paste",trix,0,2.1.18,,MODERATE,CWE-79,
|
|
7687
|
+
CVE-2026-73561,2026-07-24T21:47:29Z,"@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion",@anephenix/hub,0,0.2.16,,HIGH,CWE-400,
|
|
7688
|
+
CVE-2026-73562,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,0,6.13.10,,MODERATE,CWE-1321,
|
|
7689
|
+
CVE-2026-73562,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,7.0.0,7.8.10,,MODERATE,CWE-1321,
|
|
7690
|
+
CVE-2026-73562,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,8.0.0,8.24.1,,MODERATE,CWE-1321,
|
|
7691
|
+
CVE-2026-73562,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,9.0.0,9.7.2,,MODERATE,CWE-1321,
|
|
7692
|
+
CVE-2026-73563,2026-07-24T16:20:59Z,"@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass","@backstage/plugin-auth-backend",0,0.29.2,,MODERATE,CWE-601,
|
|
7693
|
+
CVE-2026-73565,2026-07-21T22:04:27Z,"Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake",@hono/node-server,2.0.0,2.0.10,,MODERATE,CWE-401;CWE-770,
|
|
7694
|
+
CVE-2026-73566,2026-07-24T16:26:16Z,"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection",tar,0,7.5.21,,HIGH,CWE-400;CWE-674,
|
|
7695
|
+
CVE-2026-73567,2026-07-24T21:50:45Z,"sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock",sm-crypto,0,0.5.0,,CRITICAL,CWE-338,
|
|
7696
|
+
CVE-2026-73569,2026-07-21T22:06:36Z,"fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits",fast-xml-parser,5.9.3,5.10.1,,HIGH,CWE-776,
|
|
7697
|
+
CVE-2026-73643,2026-07-24T16:47:36Z,"js-yaml: Exponential parsing time in flow collections leads to denial of service",js-yaml,5.0.0,5.2.2,,HIGH,CWE-407,
|
|
7698
|
+
CVE-2026-73645,2026-01-05T19:57:46Z,"ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.","@openzeppelin/confidential-contracts",0,0.3.1,,MODERATE,CWE-190,
|
|
7699
|
+
CVE-2026-73646,2026-07-24T16:24:55Z,"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",postcss,0,8.5.18,,HIGH,CWE-22,
|
|
7700
|
+
CVE-2026-73647,2026-07-24T22:36:45Z,"Quasar: Prototype pollution in the extend() utility",quasar,0,2.22.0,,MODERATE,CWE-1321,
|
|
7701
|
+
CVE-2026-73649,2026-07-24T16:21:22Z,"Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)",velocityjs,0,2.1.7,,CRITICAL,CWE-94,
|
|
7702
|
+
CVE-2026-73650,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,1.0.0,2.8.3,,HIGH,CWE-79;CWE-184,
|
|
7703
|
+
CVE-2026-73650,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,3.0.0,3.3.4,,HIGH,CWE-79;CWE-184,
|
|
7704
|
+
CVE-2026-73650,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,4.0.0,4.0.2,,HIGH,CWE-79;CWE-184,
|
|
7705
|
+
CVE-2026-73651,2026-07-21T21:59:23Z," TypeORM: migration:generate template-literal code injection",typeorm,0,0.3.31,,MODERATE,CWE-94,
|
|
7706
|
+
CVE-2026-73651,2026-07-21T21:59:23Z," TypeORM: migration:generate template-literal code injection",typeorm,1.0.0,1.1.0,,MODERATE,CWE-94,
|
|
7707
|
+
CVE-2026-73653,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,0,3.2.7,,CRITICAL,CWE-22;CWE-552;CWE-862,
|
|
7708
|
+
CVE-2026-73653,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,4.0.0,4.1.10,,CRITICAL,CWE-22;CWE-552;CWE-862,
|
|
7709
|
+
CVE-2026-73653,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,5.0.0-beta.1,5.0.0-beta.6,,CRITICAL,CWE-22;CWE-552;CWE-862,
|
|
7710
|
+
CVE-2026-73654,2026-08-13T20:54:11Z,"Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS",@trigger.dev/core,3.3.8,4.5.6,,HIGH,CWE-1321,
|
|
7594
7711
|
CVE-2026-7446,2026-04-30T00:31:22Z,"mcp-server-semgrep has a Command Injection issue",mcp-server-semgrep,0,1.0.1,,MODERATE,CWE-77,
|
|
7595
7712
|
CVE-2026-7600,2026-05-02T03:31:13Z,"yii2-mcp-server has a Command Injection Issue",yii2-mcp-server,0,,1.0.2,LOW,CWE-77,
|
|
7596
7713
|
CVE-2026-7645,2026-05-02T18:30:27Z,"sublinear-time-solver has a Path Traversal Issue",sublinear-time-solver,0,,1.5.0,MODERATE,CWE-22,
|
|
7597
7714
|
CVE-2026-7738,2026-05-04T09:31:09Z,"@puchunjie/doc-tools-mcp has a Path Traversal Issue",@puchunjie/doc-tools-mcp,0,,1.0.18,LOW,CWE-22,
|
|
7715
|
+
CVE-2026-77413,2026-08-21T20:57:07Z,"JSONata: Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
|
|
7716
|
+
CVE-2026-77413,2026-08-21T20:57:07Z,"JSONata: Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.0,,CRITICAL,CWE-94,
|
|
7717
|
+
CVE-2026-77414,2026-08-21T20:58:01Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
|
|
7718
|
+
CVE-2026-77414,2026-08-21T20:58:01Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.1,,CRITICAL,CWE-94,
|
|
7719
|
+
CVE-2026-77415,2026-08-21T21:04:19Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
|
|
7720
|
+
CVE-2026-77415,2026-08-21T21:04:19Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.1,,CRITICAL,CWE-94,
|
|
7598
7721
|
CVE-2026-7768,2026-05-08T17:13:38Z,"@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth","@fastify/accepts-serializer",0,6.0.4,,HIGH,CWE-770,
|
|
7599
7722
|
CVE-2026-8026,2026-05-06T15:32:41Z,"Flowise: Bcrypt Password Hash Exposure",flowise,0,,3.0.12,MODERATE,CWE-200;CWE-312,
|
|
7600
7723
|
CVE-2026-8115,2026-05-08T00:31:35Z,"short-video-maker has a path traversal vulnerability",short-video-maker,0,,1.3.4,MODERATE,CWE-22,
|
|
@@ -7676,13 +7799,15 @@ GHSA-2j8v-hwgc-x698,2026-07-02T15:57:49Z,"OpenClaw: Shell wrapper argv could cha
|
|
|
7676
7799
|
GHSA-2jm5-2cqf-6vw9,2020-09-04T15:30:32Z,"Malicious Package in baes-x",baes-x,0.0.0,,,CRITICAL,CWE-506,
|
|
7677
7800
|
GHSA-2m96-9w4j-wgv7,2020-09-03T18:06:00Z,"Prototype Pollution in lodash.merge",lodash.merge,0,4.6.1,,HIGH,CWE-1321,
|
|
7678
7801
|
GHSA-2mc2-g238-722j,2026-03-03T21:35:21Z,"OpenClaw affected by iMessage remote attachment SCP hardening (strict host-key checks and remoteHost validation)",openclaw,0,2026.2.19,,MODERATE,CWE-295;CWE-78,
|
|
7802
|
+
GHSA-2mf3-mr2r-r4vf,2026-08-18T16:31:16Z,"@rhinostone/swig: arbitrary local file read via include/extends path traversal",@rhinostone/swig,0,2.7.1,,HIGH,CWE-22,
|
|
7803
|
+
GHSA-2mf3-mr2r-r4vf,2026-08-18T16:31:16Z,"@rhinostone/swig: arbitrary local file read via include/extends path traversal",@rhinostone/swig-core,0,2.7.1,,HIGH,CWE-22,
|
|
7804
|
+
GHSA-2mf3-mr2r-r4vf,2026-08-18T16:31:16Z,"@rhinostone/swig: arbitrary local file read via include/extends path traversal",@rhinostone/swig-django,0,2.7.1,,HIGH,CWE-22,
|
|
7805
|
+
GHSA-2mf3-mr2r-r4vf,2026-08-18T16:31:16Z,"@rhinostone/swig: arbitrary local file read via include/extends path traversal",@rhinostone/swig-jinja2,0,2.7.1,,HIGH,CWE-22,
|
|
7806
|
+
GHSA-2mf3-mr2r-r4vf,2026-08-18T16:31:16Z,"@rhinostone/swig: arbitrary local file read via include/extends path traversal",@rhinostone/swig-twig,0,2.7.1,,HIGH,CWE-22,
|
|
7679
7807
|
GHSA-2mj8-pj3j-h362,2020-09-04T17:17:39Z,"Symlink reference outside of node_modules in bin-links",bin-links,0,1.1.5,,LOW,,
|
|
7680
7808
|
GHSA-2mvq-xp48-4c77,2020-09-03T20:35:29Z,"Denial of Service in subtext",subtext,0.0.0,,,HIGH,CWE-400,
|
|
7681
7809
|
GHSA-2mxc-m4c3-wqhq,2020-09-03T22:50:46Z,"Malicious Package in ruffer-xor",ruffer-xor,0.0.0,,,CRITICAL,CWE-506,
|
|
7682
7810
|
GHSA-2p3c-p3qw-69r4,2022-10-12T14:15:48Z,"The graphql-upload library included in Apollo Server 2 is vulnerable to CSRF mutations",apollo-server,2.0.0,2.25.4,,MODERATE,CWE-352,
|
|
7683
|
-
GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,1.0.0,2.8.3,,HIGH,CWE-184;CWE-79,
|
|
7684
|
-
GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,3.0.0,3.3.4,,HIGH,CWE-184;CWE-79,
|
|
7685
|
-
GHSA-2p49-hgcm-8545,2026-07-21T19:42:04Z,"SVGO removeScripts plugin leaves some executable scripts intact",svgo,4.0.0,4.0.2,,HIGH,CWE-184;CWE-79,
|
|
7686
7811
|
GHSA-2p62-c4rm-mr72,2020-09-01T19:44:57Z,"Malicious Package in another-date-picker",another-date-picker,2.0.43,2.0.45,,CRITICAL,CWE-506,
|
|
7687
7812
|
GHSA-2p99-6f47-8x9j,2020-09-02T18:38:39Z,"Malicious Package in asnc",asnc,0,,,CRITICAL,CWE-506,
|
|
7688
7813
|
GHSA-2pr6-76vf-7546,2019-06-05T14:35:29Z,"Denial of Service in js-yaml",js-yaml,0,3.13.0,,MODERATE,CWE-400,
|
|
@@ -7691,8 +7816,6 @@ GHSA-2qqc-p94c-hxwh,2026-04-16T21:22:00Z,"Flowise: Weak Default Express Session
|
|
|
7691
7816
|
GHSA-2r2p-4cgf-hv7h,2026-04-22T14:52:03Z,"engram: HTTP server CORS wildcard + auth-off-by-default enables CSRF graph exfiltration and persistent indirect prompt injection",engramx,0,2.0.2,,HIGH,"CWE-1188;CWE-306;CWE-352;CWE-942",
|
|
7692
7817
|
GHSA-2r8f-2665-3gxq,2020-09-02T21:36:36Z,"Malicious Package in froever",froever,0,,,CRITICAL,CWE-506,
|
|
7693
7818
|
GHSA-2r8f-cf6w-x5vq,2026-02-03T18:30:47Z,"Duplicate Advisory: FUXA contains a hard-coded credential vulnerability",fuxa-server,0,,1.2.7,HIGH,CWE-798,
|
|
7694
|
-
GHSA-2rp8-mm9q-fp49,2026-07-21T21:59:23Z," TypeORM: migration:generate template-literal code injection",typeorm,0,0.3.31,,MODERATE,CWE-94,
|
|
7695
|
-
GHSA-2rp8-mm9q-fp49,2026-07-21T21:59:23Z," TypeORM: migration:generate template-literal code injection",typeorm,1.0.0,1.1.0,,MODERATE,CWE-94,
|
|
7696
7819
|
GHSA-2rqg-gjgv-84jm,2026-03-13T20:55:30Z,"OpenClaw: Gateway `agent` calls could override the workspace boundary",openclaw,0,2026.3.11,,HIGH,CWE-668,
|
|
7697
7820
|
GHSA-2vg6-77g8-24mp,2026-07-07T20:56:45Z,"Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows",@better-auth/scim,1.6.0,1.6.11,,LOW,CWE-459;CWE-613;CWE-672,
|
|
7698
7821
|
GHSA-2vg6-77g8-24mp,2026-07-07T20:56:45Z,"Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows",better-auth,0.3.4,1.6.11,,LOW,CWE-459;CWE-613;CWE-672,
|
|
@@ -7725,7 +7848,7 @@ GHSA-365g-vjw2-grx8,2025-10-09T15:26:59Z,"n8n: Execute Command Node Allows Authe
|
|
|
7725
7848
|
GHSA-36c4-4r89-6whg,2020-09-03T15:49:02Z,"Prototype Pollution in @commercial/subtext",@commercial/subtext,0,5.1.2,,HIGH,CWE-1321,
|
|
7726
7849
|
GHSA-36cp-mh65-x882,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw is vulnerable to unauthenticated resource exhaustion through its voice call webhook handling",openclaw,0,2026.3.22,,MODERATE,CWE-405,
|
|
7727
7850
|
GHSA-36j9-mx87-2cff,2026-01-13T20:28:41Z,"Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies",renovate,32.135.0,40.33.0,,MODERATE,CWE-77,
|
|
7728
|
-
GHSA-36jr-mh4h-2g58,2022-09-29T14:12:55Z,"d3-color vulnerable to ReDoS",d3-color,1.0.2,3.1.0,,HIGH,CWE-
|
|
7851
|
+
GHSA-36jr-mh4h-2g58,2022-09-29T14:12:55Z,"d3-color vulnerable to ReDoS",d3-color,1.0.2,3.1.0,,HIGH,CWE-1333;CWE-400,
|
|
7729
7852
|
GHSA-36r8-9qq7-mh43,2020-09-03T17:02:40Z,"Malicious Package in we3b",we3b,0.0.0,,,CRITICAL,CWE-506,
|
|
7730
7853
|
GHSA-36rh-ggpr-j3gj,2020-09-14T16:38:40Z,"Renovate vulnerable to Azure DevOps token leakage in logs",renovate,19.180.0,23.25.1,,MODERATE,,
|
|
7731
7854
|
GHSA-377f-vvrc-9wgg,2020-09-03T19:09:07Z,"Malicious Package in zemen",zemen,0.0.5,0.0.6,,CRITICAL,CWE-506,
|
|
@@ -7738,7 +7861,6 @@ GHSA-38c7-23hj-2wgq,2026-02-26T22:47:06Z,"n8n has Webhook Forgery on Zendesk Tri
|
|
|
7738
7861
|
GHSA-38cw-85xc-xr9x,2026-01-16T21:04:12Z,"Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM",@veramo/data-store,0,6.0.2,,MODERATE,CWE-89,
|
|
7739
7862
|
GHSA-38fj-36m5-783c,2026-07-22T12:32:17Z,"Duplicate Advisory: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access",n8n,0,,,MODERATE,CWE-918,
|
|
7740
7863
|
GHSA-38gx-cfqf-f652,2026-08-01T15:30:27Z,"Duplicate Advisory: Axios: Prototype pollution auth subfields can inject Basic auth",axios,1.15.2,,,MODERATE,CWE-1321,
|
|
7741
|
-
GHSA-38hq-7x33-php4,2026-07-24T16:20:59Z,"@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass","@backstage/plugin-auth-backend",0,0.29.2,,MODERATE,CWE-601,
|
|
7742
7864
|
GHSA-38hx-3542-8fh3,2020-10-01T17:09:56Z,"Malicious code in `electorn`",electorn,0,,10.0.0,CRITICAL,CWE-506,
|
|
7743
7865
|
GHSA-38vq-cjh5-vw7x,2020-09-03T18:13:41Z,"Malicious Package in nodes.js",nodes.js,0.0.0,,,CRITICAL,CWE-506,
|
|
7744
7866
|
GHSA-392f-ggf5-fp3c,2026-03-02T21:49:33Z,"OpenClaw: Unicode canonicalization drift in node metadata policy classification could broaden node allowlists",openclaw,0,2026.3.1,,MODERATE,CWE-176;CWE-436,
|
|
@@ -7776,7 +7898,6 @@ GHSA-3p92-886g-qxpq,2019-06-04T15:42:32Z,"Remote Memory Exposure in floody",floo
|
|
|
7776
7898
|
GHSA-3pw3-v88x-xj24,2026-04-16T22:45:14Z,"Paperclip: Arbitrary File Read via Agent-Controlled adapterConfig.instructionsFilePath",@paperclipai/shared,0,2026.416.0,,MODERATE,CWE-73,
|
|
7777
7899
|
GHSA-3qmc-2r76-4rqp,2022-11-10T15:51:01Z,"Redwood is vulnerable to account takeover via dbAuth ""forgot-password"" ",@redwoodjs/api,0.38.0,2.2.5,,HIGH,,
|
|
7778
7900
|
GHSA-3qmc-2r76-4rqp,2022-11-10T15:51:01Z,"Redwood is vulnerable to account takeover via dbAuth ""forgot-password"" ",@redwoodjs/api,3.0.0,3.3.1,,HIGH,,
|
|
7779
|
-
GHSA-3r53-75j5-3g7j,2026-07-24T22:36:45Z,"Quasar: Prototype pollution in the extend() utility",quasar,0,2.22.0,,MODERATE,CWE-1321,
|
|
7780
7901
|
GHSA-3r56-7hhr-vfg9,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: CDP /json/version WebSocket URL could pivot to untrusted second-hop targets",openclaw,0,2026.4.5,,MODERATE,CWE-601,
|
|
7781
7902
|
GHSA-3r78-rqg8-95gg,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's voice-call Twilio webhook replay could bypass manager dedupe because normalized event IDs were randomized per parse",openclaw,0,,,MODERATE,CWE-294,
|
|
7782
7903
|
GHSA-3rw8-4xrq-3f7p,2025-03-17T21:30:34Z,"Duplicate Advisory: Uptime Kuma ReDoS vulnerability",uptime-kuma,1.23.0,,2.0.0-dev.0,MODERATE,CWE-1333,
|
|
@@ -7817,7 +7938,6 @@ GHSA-4f9m-pxwh-68hg,2020-09-11T21:20:14Z,"Cross-Site Scripting in swagger-ui",sw
|
|
|
7817
7938
|
GHSA-4fqg-89cc-5pv5,2020-09-04T14:58:44Z,"Malicious Package in sj-labc",sj-labc,0.0.0,,,CRITICAL,CWE-506,
|
|
7818
7939
|
GHSA-4fr9-3x69-36wv,2025-10-03T19:27:06Z,"Flowise vulnerable to XSS",flowise,0,3.0.8,,MODERATE,CWE-79,
|
|
7819
7940
|
GHSA-4g2x-vq5p-5vj6,2024-03-01T20:09:00Z,"Budibase affected by VM2 Constructor Escape Vulnerability",@budibase/server,0,2.20.0,,CRITICAL,CWE-94,
|
|
7820
|
-
GHSA-4g3v-8h47-v7g6,2026-07-20T21:08:16Z,"Astro: Reflected XSS via unescaped View Transition animation properties",astro,2.9.0,7.1.0,,MODERATE,CWE-79,
|
|
7821
7941
|
GHSA-4g53-vp7q-gfjv,2021-05-28T19:18:28Z,"constructEvent does not verify header","@worker-tools/stripe-webhook",0,1.1.4,,HIGH,,
|
|
7822
7942
|
GHSA-4gpv-cvmq-6526,2020-08-19T22:23:09Z,"Denial of Service in protobufjs",protobufjs,0,5.0.3,,MODERATE,,
|
|
7823
7943
|
GHSA-4gpv-cvmq-6526,2020-08-19T22:23:09Z,"Denial of Service in protobufjs",protobufjs,6.0.0,6.8.6,,MODERATE,,
|
|
@@ -7829,6 +7949,7 @@ GHSA-4hxc-9384-m385,2026-03-20T20:50:38Z,"h3: SSE Event Injection via Unsanitize
|
|
|
7829
7949
|
GHSA-4hxc-9384-m385,2026-03-20T20:50:38Z,"h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)",h3,2.0.0-beta.0,2.0.1-rc.17,,MODERATE,CWE-74,
|
|
7830
7950
|
GHSA-4j6x-w426-6rc6,2019-11-08T17:31:17Z,"Default Express middleware security check is ignored in production","@cubejs-backend/api-gateway",0.11.0,0.11.17,,HIGH,,
|
|
7831
7951
|
GHSA-4jfq-q299-g4cr,2020-09-02T20:28:57Z,"Malicious Package in reqquest",reqquest,0,,,CRITICAL,CWE-506,
|
|
7952
|
+
GHSA-4jjw-pwvw-q6w3,2026-08-11T15:32:37Z,"Duplicate Advisory: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint",nuxt,4.4.7,,,MODERATE,CWE-200,
|
|
7832
7953
|
GHSA-4jpw-hj22-2xmc,2026-03-13T15:47:29Z,"OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE",openclaw,0,2026.3.11,,CRITICAL,CWE-269,
|
|
7833
7954
|
GHSA-4jqc-jvh2-pxg9,2022-06-17T01:11:10Z,"Path traversal for local publishers in TechDocs backend","@backstage/plugin-techdocs-node",0,1.1.2,,MODERATE,,
|
|
7834
7955
|
GHSA-4jqc-jvh2-pxg9,2022-06-17T01:11:10Z,"Path traversal for local publishers in TechDocs backend","@backstage/techdocs-common",0,0.11.16,,MODERATE,,
|
|
@@ -7839,7 +7960,6 @@ GHSA-4mhr-cxr4-2prm,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: Workspac
|
|
|
7839
7960
|
GHSA-4pmg-jgm5-3jg6,2020-09-02T21:16:26Z,"Malicious Package in erquest",erquest,0,,,CRITICAL,CWE-506,
|
|
7840
7961
|
GHSA-4q2f-8g74-qm56,2020-09-03T17:18:05Z,"Cross-Site Scripting in takeapeek",takeapeek,0.0.0,,,HIGH,CWE-79,
|
|
7841
7962
|
GHSA-4q8f-5xxj-946r,2020-09-03T02:40:51Z,"Command Injection in addax",addax,0,1.1.0,,HIGH,CWE-77,
|
|
7842
|
-
GHSA-4qcj-m5wp-jmf4,2026-07-24T21:13:07Z," Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings",@budibase/server,0,,3.38.1,MODERATE,CWE-862,
|
|
7843
7963
|
GHSA-4qgr-57jq-93vh,2026-06-16T21:31:59Z,"Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots",openclaw,0,,,HIGH,CWE-426,
|
|
7844
7964
|
GHSA-4qhx-g9wp-g9m6,2019-06-14T16:09:01Z,"Failure to sanitize quotes which can lead to sql injection in squel",squel,0,,5.13.0,CRITICAL,CWE-74;CWE-89,
|
|
7845
7965
|
GHSA-4qqc-mp5f-ccv4,2020-09-02T15:05:51Z,"Command Injection in bestzip",bestzip,0,2.1.7,,CRITICAL,CWE-77,
|
|
@@ -7874,9 +7994,7 @@ GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket i
|
|
|
7874
7994
|
GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
|
|
7875
7995
|
GHSA-534w-2vm4-89xr,2026-03-03T23:18:26Z,"OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch",openclaw,0,2026.2.24,,MODERATE,CWE-284;CWE-863,
|
|
7876
7996
|
GHSA-536f-268f-6gxc,2020-09-03T22:17:36Z,"Malicious Package in buffermxor",buffermxor,0.0.0,,,CRITICAL,CWE-506,
|
|
7877
|
-
GHSA-53g2-mvcc-q9x3,2026-07-24T16:18:01Z,"Trix: Stored XSS via HTMLParser attribute injection on paste",trix,0,2.1.18,,MODERATE,CWE-79,
|
|
7878
7997
|
GHSA-53mj-mc38-q894,2020-09-01T19:40:41Z,"Remote Memory Exposure in openwhisk",openwhisk,0,3.3.1,,MODERATE,,
|
|
7879
|
-
GHSA-53p3-c7vp-4mcc,2026-03-29T15:22:17Z,"Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)",trix,0,2.1.18,,LOW,CWE-79,
|
|
7880
7998
|
GHSA-53rv-hcvm-rpp9,2025-01-14T22:03:59Z,"Lodestar snappy decompression issue",@lodestar/reqresp,0,1.25.0,,LOW,CWE-703,
|
|
7881
7999
|
GHSA-5478-66c3-rhxr,2026-04-08T21:50:51Z,"Pretext: Algorithmic Complexity (DoS) in the text analysis phase",@chenglou/pretext,0,0.0.5,,HIGH,CWE-407,
|
|
7882
8000
|
GHSA-54qm-37qr-w5wq,2020-09-04T15:04:20Z,"Sandbox Breakout / Arbitrary Code Execution in veval",veval,0.0.0,,,CRITICAL,,
|
|
@@ -7997,10 +8115,6 @@ GHSA-65xx-c85x-wg76,2020-09-04T17:20:52Z,"Command Injection in plotter",plotter,
|
|
|
7997
8115
|
GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,0,1.123.55,,MODERATE,CWE-863,
|
|
7998
8116
|
GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.0.0-rc.0,2.25.7,,MODERATE,CWE-863,
|
|
7999
8117
|
GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.26.0,2.26.2,,MODERATE,CWE-863,
|
|
8000
|
-
GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,0,6.13.10,,MODERATE,CWE-1321,
|
|
8001
|
-
GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,7.0.0,7.8.10,,MODERATE,CWE-1321,
|
|
8002
|
-
GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,8.0.0,8.24.1,,MODERATE,CWE-1321,
|
|
8003
|
-
GHSA-664h-wqgq-64gw,2026-07-24T16:22:34Z,"Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)",mongoose,9.0.0,9.7.2,,MODERATE,CWE-1321,
|
|
8004
8118
|
GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,0,16.8.2,,HIGH,,
|
|
8005
8119
|
GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,17.0.0,17.9.2,,HIGH,,
|
|
8006
8120
|
GHSA-66mv-xh68-h6v2,2020-09-03T15:48:53Z,"Denial of Service in @commercial/hapi",@commercial/hapi,18.0.0,18.4.1,,HIGH,,
|
|
@@ -8046,8 +8160,6 @@ GHSA-6qqf-vvcr-7qrv,2019-05-23T09:27:22Z,"Cryptographically Weak PRNG in generat
|
|
|
8046
8160
|
GHSA-6qqj-rx4w-r3cj,2020-08-31T22:48:44Z,"CSRF Vulnerability in jquery-ujs",jquery-ujs,0,1.0.4,,MODERATE,CWE-352,
|
|
8047
8161
|
GHSA-6r5x-hmgg-7h53,2019-07-15T19:46:01Z,"Remote code execution in Handlebars.js",handlebars,0,4.1.0,,MODERATE,,
|
|
8048
8162
|
GHSA-6rmx-gvvg-vh6j,2026-03-09T19:52:47Z,"OpenClaw's hooks count non-POST requests toward auth lockout",openclaw,0,2026.3.7,,MODERATE,CWE-307;CWE-799,
|
|
8049
|
-
GHSA-6v4m-fw66-8r4x,2026-07-24T22:33:38Z,"Shescape: Path disclosure on Unix with Zsh",shescape,0,2.1.14,,MODERATE,CWE-155;CWE-78,
|
|
8050
|
-
GHSA-6v4m-fw66-8r4x,2026-07-24T22:33:38Z,"Shescape: Path disclosure on Unix with Zsh",shescape,3.0.0,3.0.1,,MODERATE,CWE-155;CWE-78,
|
|
8051
8163
|
GHSA-6v7q-wjvx-w8wg,2026-04-10T20:18:23Z,"basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",basic-ftp,0,5.2.2,,HIGH,CWE-93,
|
|
8052
8164
|
GHSA-6x2m-hqfw-hvpj,2026-03-02T22:29:45Z,"OpenClaw: Node exec approvals could be replayed across nodes",openclaw,0,2026.2.23,,MODERATE,CWE-285;CWE-863,
|
|
8053
8165
|
GHSA-6x2m-p4xp-wg22,2026-06-19T21:42:36Z,"Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups",network-ai,0,5.12.2,,MODERATE,CWE-22;CWE-59,
|
|
@@ -8090,8 +8202,6 @@ GHSA-78p3-fwcq-62c2,2024-10-03T19:50:59Z,"@saltcorn/server Remote Code Execution
|
|
|
8090
8202
|
GHSA-796m-2973-wc5q,2026-03-03T22:23:45Z,"OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation",openclaw,0,2026.2.23,,MODERATE,CWE-436,
|
|
8091
8203
|
GHSA-798h-g4j5-5537,2023-01-11T15:30:28Z,"Duplicate Advisory: PapaParse Inefficient Regular Expression Complexity vulnerability",papaparse,0,5.2.0,,HIGH,CWE-1333,
|
|
8092
8204
|
GHSA-799q-f2px-wx8c,2025-03-28T21:30:46Z,"Duplicate Advisory: @alizeait/unflatto Prototype Pollution via `exports.unflatto` Method",@alizeait/unflatto,0,,1.0.2,HIGH,CWE-1321,
|
|
8093
|
-
GHSA-7c4v-fwgw-9rf7,2026-08-07T16:45:21Z,"Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint",nuxt,3.21.7,3.21.10,,MODERATE,CWE-200,
|
|
8094
|
-
GHSA-7c4v-fwgw-9rf7,2026-08-07T16:45:21Z,"Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint",nuxt,4.4.7,4.5.1,,MODERATE,CWE-200,
|
|
8095
8205
|
GHSA-7cg8-pq9v-x98q,2019-10-21T21:58:55Z,"Sandbox Breakout in realms-shim",realms-shim,0,1.2.1,,CRITICAL,,
|
|
8096
8206
|
GHSA-7cgc-fjv4-52x6,2023-05-24T16:43:58Z,"Malware in pre-build binaries of bignum",bignum,0.12.2,0.13.1,,CRITICAL,CWE-506,
|
|
8097
8207
|
GHSA-7cp4-jw97-3rc2,2025-05-01T03:31:17Z,"Duplicate Advisory: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint","@cloudflare/workers-oauth-provider",0,0.0.5,,MODERATE,CWE-601,
|
|
@@ -8105,7 +8215,6 @@ GHSA-7fhm-mqm4-2wp7,2020-03-13T20:36:16Z,"Withdrawn: ESLint dependencies are vul
|
|
|
8105
8215
|
GHSA-7fpw-cfc4-3p2c,2017-12-28T22:51:45Z,"Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2",passport-wsfed-saml2,0,3.0.5,,HIGH,CWE-290,
|
|
8106
8216
|
GHSA-7fqq-q52p-2jjg,2026-03-29T15:27:41Z,"OpenCC has an Out-of-bounds read when processing truncated UTF-8 input",opencc,0,1.2.0,,MODERATE,CWE-125,
|
|
8107
8217
|
GHSA-7frr-c83r-fm22,2020-09-03T22:20:49Z,"Malicious Package in buffez-xor",buffez-xor,0.0.0,,,CRITICAL,CWE-506,
|
|
8108
|
-
GHSA-7gfh-x38p-prh3,2026-07-24T16:21:22Z,"Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)",velocityjs,0,2.1.7,,CRITICAL,CWE-94,
|
|
8109
8218
|
GHSA-7h7g-x2px-94hj,2026-03-13T20:54:18Z,"OpenClaw: Pairing setup codes exposed long-lived shared gateway credentials instead of short-lived bootstrap tokens",openclaw,0,2026.3.12,,MODERATE,CWE-532,
|
|
8110
8219
|
GHSA-7hgr-7h44-33w2,2026-05-19T20:13:35Z,"CamoFox MCP: Unauthenticated HTTP MCP browser-control surface",camofox-mcp,0,1.13.2,,HIGH,CWE-306,
|
|
8111
8220
|
GHSA-7hrg-5w46-5r2x,2026-04-24T00:31:52Z,"Duplicate Advisory: OpenClaw: Slack thread context could include messages from non-allowlisted senders",openclaw,0,2026.4.2,,LOW,CWE-346,
|
|
@@ -8125,9 +8234,6 @@ GHSA-7qg7-6g3g-8vxg,2020-09-03T22:46:25Z,"Malicious Package in bwffer-xor",bwffe
|
|
|
8125
8234
|
GHSA-7r5f-7qr4-pf6q,2020-09-03T19:03:33Z,"Sandbox Breakout / Arbitrary Code Execution in notevil",notevil,0,1.3.2,,HIGH,,
|
|
8126
8235
|
GHSA-7r9x-hr76-jr96,2020-09-04T17:26:18Z,"Command Injection in giting",giting,0.0.0,,,CRITICAL,CWE-77,
|
|
8127
8236
|
GHSA-7rgr-72hp-9wp3,2025-10-06T03:31:38Z,"Duplicate Advisory: Flowise is vulnerable to stored XSS via ""View Messages"" allows credential theft in FlowiseAI admin panel",flowise,0,3.0.5,,HIGH,CWE-79,
|
|
8128
|
-
GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",@auth/core,0.1.0,0.41.3,,CRITICAL,CWE-180,
|
|
8129
|
-
GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",next-auth,4.10.3,4.24.15,,CRITICAL,CWE-180,
|
|
8130
|
-
GHSA-7rqj-j65f-68wh,2026-07-23T14:40:15Z,"Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass",next-auth,5.0.0-beta.1,5.0.0-beta.32,,CRITICAL,CWE-180,
|
|
8131
8237
|
GHSA-7rx3-28cr-v5wh,2026-03-29T15:17:15Z,"Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry",handlebars,4.6.0,4.7.9,,MODERATE,CWE-1321,
|
|
8132
8238
|
GHSA-7rx4-c5vx-g8w3,2026-05-14T18:26:02Z,"Karakeep SDK has SSRF via metascraper-logo-favicon that bypasses validateUrl protections",@karakeep/sdk,0,0.32.0,,HIGH,CWE-918,
|
|
8133
8239
|
GHSA-7v28-g2pq-ggg8,2022-06-17T01:16:03Z,"Ghost vulnerable to remote code execution in locale setting change",ghost,0,4.48.2,,MODERATE,,
|
|
@@ -8194,7 +8300,6 @@ GHSA-8c8c-4vfj-rrpc,2020-09-01T19:05:11Z,"Reflected Cross-Site Scripting in redi
|
|
|
8194
8300
|
GHSA-8cp7-rp8r-mg77,2026-03-04T18:55:48Z,"OpenClaw has SSRF guard bypass via IPv6 transition over ISATAP",openclaw,2026.1.20,2026.2.19,,MODERATE,CWE-918,
|
|
8195
8301
|
GHSA-8f93-rv4p-x4jw,2019-06-12T16:36:52Z,"SQL Injection in sql",sql,0,,0.78.0,MODERATE,CWE-89,
|
|
8196
8302
|
GHSA-8f9r-gr6r-x63q,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Feishu webhook reads and parses unauthenticated request bodies before signature validation",openclaw,0,2026.3.28,,MODERATE,CWE-696,
|
|
8197
|
-
GHSA-8fpg-xm3f-6cx3,2026-07-23T14:52:23Z,"Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)",next-auth,5.0.0-beta.0,5.0.0-beta.32,,CRITICAL,CWE-285;CWE-636,
|
|
8198
8303
|
GHSA-8fw4-xh83-3j6q,2020-09-11T21:18:05Z,"Cross-Site Scripting in diagram-js",diagram-js,0,2.6.2,,MODERATE,CWE-79,
|
|
8199
8304
|
GHSA-8fw4-xh83-3j6q,2020-09-11T21:18:05Z,"Cross-Site Scripting in diagram-js",diagram-js,3.0.0,3.3.1,,MODERATE,CWE-79,
|
|
8200
8305
|
GHSA-8g29-8xwr-qmhr,2026-03-25T17:33:01Z,"@grackle-ai/server JSON.parse lacks try-catch logic in its gRPC Service AdapterConfig Handling",@grackle-ai/server,0,0.70.6,,LOW,CWE-754,
|
|
@@ -8232,7 +8337,6 @@ GHSA-8mm3-2mcj-cx6r,2020-09-11T21:09:24Z,"Malicious Package in angluar-cli",angl
|
|
|
8232
8337
|
GHSA-8mmf-qp7j-2w24,2020-09-02T21:35:33Z,"Malicious Package in colour-string",colour-string,0,,,CRITICAL,CWE-506,
|
|
8233
8338
|
GHSA-8mpm-q7mh-8fvh,2026-03-18T16:09:42Z,"Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)",@capgo/cli,0,7.84.6,,HIGH,CWE-276;CWE-377;CWE-59,
|
|
8234
8339
|
GHSA-8mr2-f9wf-hcfq,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback",openclaw,0,2026.2.22,,LOW,CWE-522,
|
|
8235
|
-
GHSA-8mv7-9c27-98vc,2026-07-20T23:26:27Z,"Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered",astro,7.0.0,7.0.6,,MODERATE,CWE-352,
|
|
8236
8340
|
GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",@sequelize/core,0,7.0.0-alpha.20,,CRITICAL,CWE-790,
|
|
8237
8341
|
GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",sequelize,0,6.29.0,,CRITICAL,CWE-790,
|
|
8238
8342
|
GHSA-8pf2-vj79-4wxg,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API",openclaw,0,2026.3.31,,MODERATE,CWE-441,
|
|
@@ -8245,7 +8349,6 @@ GHSA-8qx4-r7fx-xc4v,2020-09-11T21:08:19Z,"Malicious Package in requst",requst,0,
|
|
|
8245
8349
|
GHSA-8r4g-cg4m-x23c,2021-09-22T18:22:02Z,"Denial of Service in node-static",node-static,0,,0.7.11,MODERATE,CWE-248;CWE-400,
|
|
8246
8350
|
GHSA-8r69-3cvp-wxc3,2022-11-02T18:18:10Z,"Batched HTTP requests may set incorrect `cache-control` response header",@apollo/server,0,4.1.0,,MODERATE,CWE-524,
|
|
8247
8351
|
GHSA-8r69-3cvp-wxc3,2022-11-02T18:18:10Z,"Batched HTTP requests may set incorrect `cache-control` response header",apollo-server-core,3.0.0,3.11.0,,MODERATE,CWE-524,
|
|
8248
|
-
GHSA-8r6m-32jq-jx6q,2026-07-21T22:06:36Z,"fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits",fast-xml-parser,5.9.3,5.10.1,,HIGH,CWE-776,
|
|
8249
8352
|
GHSA-8rgj-285w-qcq4,2025-02-10T17:59:09Z,"Unknown vulnerability in Coinbase Wallet SDK",@coinbase/wallet-sdk,4.0.0-beta.0,4.3.0,,HIGH,,
|
|
8250
8353
|
GHSA-8v5f-hp78-jgxq,2019-06-06T15:30:33Z,"Signature Verification Bypass in jwt-simple",jwt-simple,0,0.5.3,,HIGH,CWE-347,
|
|
8251
8354
|
GHSA-8vj3-jgcf-77jv,2020-09-02T20:26:49Z,"Malicious Package in requeest",requeest,0,,,CRITICAL,CWE-506,
|
|
@@ -8270,6 +8373,7 @@ GHSA-9237-rg5p-rhfw,2026-04-22T14:31:34Z,"@saltcorn/data: Tenant user role is us
|
|
|
8270
8373
|
GHSA-9272-59x2-gwf2,2020-09-03T17:04:13Z,"Malicious Package in ripedm160",ripedm160,0.0.0,,,CRITICAL,CWE-506,
|
|
8271
8374
|
GHSA-9298-m7jf-55h2,2020-09-04T16:42:08Z,"Malicious Package in bitconid-rpc",bitconid-rpc,0.0.0,,,CRITICAL,CWE-506,
|
|
8272
8375
|
GHSA-929m-phjg-qwcc,2025-04-01T21:31:30Z,"Duplicate Advisory: MathLive's Lack of Escaping of HTML allows for XSS",mathlive,0,0.104.0,,MODERATE,CWE-79,
|
|
8376
|
+
GHSA-92hr-gmr6-h8cp,2026-08-17T17:49:21Z,"Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling",ep_etherpad-lite,0,3.3.0,,MODERATE,"CWE-208;CWE-209;CWE-22;CWE-235;CWE-330",
|
|
8273
8377
|
GHSA-92jp-89mq-4374,2026-04-17T20:08:01Z,"OpenClaw: Sandbox noVNC helper route exposed interactive browser session credentials",openclaw,2026.2.21,2026.4.10,,MODERATE,CWE-306,
|
|
8274
8378
|
GHSA-93rg-2xm5-2p9v,2026-05-04T21:14:17Z,"OpenClaw's Gateway Control UI bootstrap config required Gateway auth",openclaw,0,2026.4.22,,MODERATE,CWE-287,
|
|
8275
8379
|
GHSA-943q-mwmv-hhvh,2026-03-02T23:32:22Z,"OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval",openclaw,0,2026.2.14,,HIGH,CWE-78,
|
|
@@ -8308,7 +8412,6 @@ GHSA-9m65-766c-r333,2026-05-14T16:37:10Z,"TanStack Start - Server Core: Inbound
|
|
|
8308
8412
|
GHSA-9mjp-gv34-3jcf,2020-09-02T18:37:35Z,"Malicious Package in aasync",aasync,0,,,CRITICAL,CWE-506,
|
|
8309
8413
|
GHSA-9mmw-3fmh-96g3,2020-09-02T20:23:38Z,"Malicious Package in calk",calk,0,,,CRITICAL,CWE-506,
|
|
8310
8414
|
GHSA-9mph-4f7v-fmvh,2026-03-04T19:02:59Z,"OpenClaw has agent avatar symlink traversal in gateway session metadata",openclaw,0,2026.2.22,,MODERATE,CWE-59,
|
|
8311
|
-
GHSA-9mqv-5hh9-4cgg,2026-07-21T22:04:27Z,"Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake",@hono/node-server,2.0.0,2.0.10,,MODERATE,CWE-401;CWE-770,
|
|
8312
8415
|
GHSA-9p64-h5q4-phpm,2020-09-02T15:44:58Z,"Remote Code Execution in office-converter",office-converter,0.0.0,,,HIGH,CWE-20,
|
|
8313
8416
|
GHSA-9p93-7j67-5pc2,2026-03-27T22:28:25Z,"OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding",openclaw,0,,2026.3.24,HIGH,CWE-226;CWE-863,
|
|
8314
8417
|
GHSA-9pcf-h8q9-63f6,2020-09-03T17:12:41Z,"Sandbox Breakout / Arbitrary Code Execution in safe-eval",safe-eval,0.0.0,,,HIGH,,
|
|
@@ -8332,7 +8435,6 @@ GHSA-9qr9-h5gf-34mp,2025-12-03T19:07:11Z,"Next.js is vulnerable to RCE in React
|
|
|
8332
8435
|
GHSA-9qr9-h5gf-34mp,2025-12-03T19:07:11Z,"Next.js is vulnerable to RCE in React flight protocol",next,15.5.0-canary.0,15.5.7,,CRITICAL,CWE-502,
|
|
8333
8436
|
GHSA-9qr9-h5gf-34mp,2025-12-03T19:07:11Z,"Next.js is vulnerable to RCE in React flight protocol",next,16.0.0-canary.0,16.0.7,,CRITICAL,CWE-502,
|
|
8334
8437
|
GHSA-9qrg-h9g8-c65q,2020-09-04T15:14:26Z,"Prototype Pollution in deep-setter",deep-setter,0.0.0,,,HIGH,CWE-1321,
|
|
8335
|
-
GHSA-9qrm-48qf-r2rw,2025-01-23T22:36:50Z,"Directus has a DOM-Based cross-site scripting (XSS) via layout_options",directus,0,11.3.3,,LOW,,
|
|
8336
8438
|
GHSA-9r27-994c-4xch,2020-02-24T17:34:02Z,"discord-html not escaping HTML code blocks when lacking a language identifier",discord-markdown,0,2.3.1,,HIGH,,
|
|
8337
8439
|
GHSA-9r3m-mhfm-39cm,2020-09-11T21:10:29Z,"Incorrect Calculation in bigint-money",bigint-money,0,0.6.2,,LOW,CWE-682,
|
|
8338
8440
|
GHSA-9r75-g2cr-3h76,2026-03-06T18:45:02Z,"Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens",@workflow/core,0,4.2.0-beta.64,,MODERATE,CWE-287,
|
|
@@ -8375,10 +8477,11 @@ GHSA-c5xm-m64m-f2vq,2020-09-04T15:23:47Z,"Malicious Package in cxct",cxct,0.0.0,
|
|
|
8375
8477
|
GHSA-c6f3-3c98-2j2f,2020-09-02T21:39:46Z,"Malicious Package in jquerz",jquerz,0,,,CRITICAL,CWE-506,
|
|
8376
8478
|
GHSA-c6h2-mpc6-232h,2020-08-27T22:26:15Z,"Command Injection in dns-sync",dns-sync,0,0.1.3,,MODERATE,,
|
|
8377
8479
|
GHSA-c6m7-q6pr-c64r,2025-12-12T16:41:58Z,"Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components",@vitejs/plugin-rsc,0,0.5.7,,MODERATE,CWE-1395;CWE-497;CWE-502,
|
|
8480
|
+
GHSA-c7hr-448w-65px,2026-08-18T20:09:35Z,"MeshCentral has unsanitized data fields",meshcentral,0,1.1.60,,HIGH,CWE-20;CWE-74,
|
|
8378
8481
|
GHSA-c7pp-x73h-4m2v,2020-09-02T15:53:46Z,"Cross-Site Scripting in bootstrap-vue",bootstrap-vue,0,2.0.0-rc.12,,HIGH,CWE-79,
|
|
8379
8482
|
GHSA-c7w3-x93f-qmm8,2026-03-26T22:26:46Z,"Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter",nodemailer,0,8.0.4,,LOW,CWE-93,
|
|
8380
|
-
GHSA-c8vc-7pv3-g98p,2026-07-24T21:14:49Z," Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)",@budibase/server,0,,3.38.1,HIGH,CWE-639,
|
|
8381
8483
|
GHSA-c8w7-9w9h-x69q,2026-06-16T21:31:58Z,"Duplicate Advisory: Slack reaction events could ignore reaction notification settings",openclaw,0,,2026.5.7,MODERATE,CWE-862,
|
|
8484
|
+
GHSA-cc2g-gq8c-r332,2026-08-19T19:15:01Z,"grok-faf-mcp has an arbitrary local file read via unconfined `path` argument in FAF tools",grok-faf-mcp,0,1.5.3,,HIGH,CWE-200;CWE-22;CWE-73,
|
|
8382
8485
|
GHSA-cc4f-hjpj-g9p8,2026-04-16T21:21:12Z,"Flowise: Weak Default JWT Secrets",flowise,0,3.1.0,,MODERATE,CWE-327,
|
|
8383
8486
|
GHSA-ccq6-3qx5-vmqx,2018-07-31T22:54:14Z,"Moderate severity vulnerability that affects is-my-json-valid",is-my-json-valid,0,2.12.4,,MODERATE,,
|
|
8384
8487
|
GHSA-ccrp-c664-8p4j,2020-09-03T21:17:36Z,"Cross-Site Scripting in markdown-to-jsx",markdown-to-jsx,0,6.11.4,,HIGH,CWE-79,
|
|
@@ -8417,7 +8520,6 @@ GHSA-cr4x-w2v7-4mmf,2020-09-03T22:26:13Z,"Malicious Package in bufver-xor",bufve
|
|
|
8417
8520
|
GHSA-cr56-66mx-293v,2020-09-03T15:53:50Z,"Cross-Site Scripting in @toast-ui/editor",@toast-ui/editor,0,2.2.0,,HIGH,CWE-79,
|
|
8418
8521
|
GHSA-cr5w-6rv4-r2qg,2020-09-03T02:37:45Z,"Malicious Package in maleficent",maleficent,0,,,CRITICAL,CWE-506,
|
|
8419
8522
|
GHSA-cr67-78jr-j94p,2020-09-03T18:14:47Z,"Local File Inclusion in domokeeper",domokeeper,0.0.0,,,MODERATE,,
|
|
8420
|
-
GHSA-cr7p-cr3q-h5cm,2026-07-24T21:43:11Z," Budibase: Account Enumeration via Login Lockout Response Differential",@budibase/server,0,,3.38.1,MODERATE,CWE-204,
|
|
8421
8523
|
GHSA-crf7-fvjx-863q,2020-09-03T17:09:26Z,"Path Traversal in zero",zero,0,1.0.6,,HIGH,CWE-22,
|
|
8422
8524
|
GHSA-crfh-jmv2-2f9v,2020-09-03T17:03:11Z,"Malicious Package in singale",singale,0.0.0,,,CRITICAL,CWE-506,
|
|
8423
8525
|
GHSA-crfx-5phg-hmw9,2019-06-13T18:59:12Z,"Cross-Site Scripting in ids-enterprise",ids-enterprise,0,4.18.2,,HIGH,CWE-79,
|
|
@@ -8468,7 +8570,6 @@ GHSA-f934-5rqf-xx47,2026-04-17T22:33:33Z,"OpenClaw: QMD memory_get restricts rea
|
|
|
8468
8570
|
GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/auth,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
|
|
8469
8571
|
GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/mcp,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
|
|
8470
8572
|
GHSA-f9ff-5x35-7gfw,2026-07-02T19:35:03Z,"Grackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)",@grackle-ai/plugin-core,0,,0.132.1,HIGH,CWE-613;CWE-639;CWE-862,
|
|
8471
|
-
GHSA-fcrw-f7gg-6g9f,2026-07-24T21:14:31Z," Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users",@budibase/server,0,3.39.25,,MODERATE,CWE-200,
|
|
8472
8573
|
GHSA-ff5x-w9wg-h275,2020-03-06T01:15:46Z,"Holder can generate proof of ownership for credentials it does not control in vp-toolkit",vp-toolkit,0,0.2.2,,HIGH,,
|
|
8473
8574
|
GHSA-ff6g-gm92-rf32,2020-09-03T19:42:06Z,"Malicious Package in coinstirng",coinstirng,0.0.0,,,CRITICAL,CWE-506,
|
|
8474
8575
|
GHSA-ff98-w8hj-qrxf,2026-03-03T21:39:26Z,"OpenClaw plugin runtime command execution is part of trusted plugin boundary",openclaw,0,2026.2.19,,MODERATE,CWE-78,
|
|
@@ -8499,7 +8600,8 @@ GHSA-fr4h-3cph-29xv,2026-06-27T00:02:51Z,"pnpm: Hoisted install imports lockfile
|
|
|
8499
8600
|
GHSA-fr4j-65pv-gjjj,2026-01-13T20:28:16Z,"Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration",renovate,35.63.0,40.33.0,,MODERATE,CWE-77,
|
|
8500
8601
|
GHSA-fr9g-2m2h-c27j,2023-08-16T06:30:24Z,"Duplicate Advisory: @excalidraw/excalidraw Cross-site Scripting vulnerability",@excalidraw/excalidraw,0,0.15.3,,MODERATE,CWE-79,
|
|
8501
8602
|
GHSA-frr5-j3mh-h9ch,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: OpenShell FS bridge reads pin and verify the opened file before returning bytes",openclaw,0,2026.4.22,,MODERATE,CWE-367,
|
|
8502
|
-
GHSA-frvp-7c67-39w9,2026-07-21T18:17:25Z,"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",@hono/node-server,0,
|
|
8603
|
+
GHSA-frvp-7c67-39w9,2026-07-21T18:17:25Z,"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",@hono/node-server,0,1.19.15,,MODERATE,CWE-22,
|
|
8604
|
+
GHSA-frvp-7c67-39w9,2026-07-21T18:17:25Z,"Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)",@hono/node-server,2.0.0,2.0.5,,MODERATE,CWE-22,
|
|
8503
8605
|
GHSA-frxq-v7fm-m4pv,2020-09-02T20:27:53Z,"Malicious Package in requuest",requuest,0,,,CRITICAL,CWE-506,
|
|
8504
8606
|
GHSA-fvfv-ppw4-7h2w,2026-02-26T22:46:42Z,"n8n has a Guardrail Node Bypass",n8n,0,2.10.0,,MODERATE,CWE-20;CWE-693,
|
|
8505
8607
|
GHSA-fvh2-gm75-j4j7,2026-05-18T17:00:25Z,"dynoxide: DNS rebinding and cross-origin CSRF via MCP HTTP transport",dynoxide,0.9.3,0.9.13,,HIGH,CWE-346;CWE-350;CWE-352,
|
|
@@ -8524,7 +8626,6 @@ GHSA-g485-8j3v-p6x8,2026-05-05T18:28:32Z,"@tdurieux/anonymous_github Vulnerable
|
|
|
8524
8626
|
GHSA-g49q-jw42-6x85,2024-05-09T21:31:35Z,"thelounge may publicly disclose of all usernames/idents via port 113",thelounge,0,,4.4.3,LOW,,
|
|
8525
8627
|
GHSA-g4m3-rpxr-h7vg,2020-09-03T19:52:25Z,"Malicious Package in mogodb-core",mogodb-core,0.0.0,,,CRITICAL,CWE-506,
|
|
8526
8628
|
GHSA-g5q2-fcg9-j526,2020-09-03T17:40:18Z,"Malicious Package in hsf-clients",hsf-clients,0.0.0,,,CRITICAL,CWE-506,
|
|
8527
|
-
GHSA-g5vv-q72c-7j78,2026-07-24T21:47:29Z,"@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion",@anephenix/hub,0,0.2.16,,HIGH,CWE-400,
|
|
8528
8629
|
GHSA-g64q-3vg8-8f93,2020-09-03T15:47:10Z,"Prototype Pollution in pez",pez,0.0.0,,,HIGH,CWE-1321,
|
|
8529
8630
|
GHSA-g6f4-j6c2-w3p3,2018-10-09T00:39:43Z,"High severity vulnerability that affects uglify-js",uglify-js,0,2.4.24,,HIGH,,
|
|
8530
8631
|
GHSA-g6w6-h933-4rc5,2023-08-03T19:44:52Z,"Soketi was exposed to Sandbox Escape vulnerability via vm2",@soketi/soketi,0,1.6.0,,CRITICAL,,
|
|
@@ -8567,13 +8668,11 @@ GHSA-gfm8-g3vm-53jh,2020-09-03T17:21:19Z,"Malicious Package in leetlog",leetlog,
|
|
|
8567
8668
|
GHSA-gfmx-pph7-g46x,2026-04-09T14:22:14Z,"OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade",openclaw,0,2026.4.8,,HIGH,CWE-501,
|
|
8568
8669
|
GHSA-gfp8-mp24-5vxg,2026-05-21T20:43:27Z,"@hulumi/baseline: CloudTrail selector tampering events were not fully detected",@hulumi/baseline,0,1.3.2,,MODERATE,CWE-778,
|
|
8569
8670
|
GHSA-ggm6-h3mx-cmmp,2026-03-19T03:30:57Z,"Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags",openclaw,0,,2026.2.17,LOW,CWE-78,
|
|
8570
|
-
GHSA-
|
|
8671
|
+
GHSA-ghvf-qf6h-g8x5,2026-08-20T18:42:21Z,"NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution",@nocobase/server,0,2.1.5,,HIGH,"CWE-209;CWE-434;CWE-73;CWE-829",
|
|
8571
8672
|
GHSA-gj2h-2fpw-fhv9,2026-07-02T20:16:12Z,"@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration",@nuxt/ui,0,4.8.1,,MODERATE,CWE-200;CWE-598,
|
|
8572
8673
|
GHSA-gjhc-6xm7-mc8q,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,5.9.0,,MODERATE,CWE-79,
|
|
8573
8674
|
GHSA-gjph-xf5q-6mfq,2020-09-03T15:46:02Z,"Denial of Service in @hapi/ammo",@hapi/ammo,0,3.1.2,,HIGH,,
|
|
8574
8675
|
GHSA-gjph-xf5q-6mfq,2020-09-03T15:46:02Z,"Denial of Service in @hapi/ammo",@hapi/ammo,4.0.0,5.0.1,,HIGH,,
|
|
8575
|
-
GHSA-gm3r-q2wp-hw87,2026-07-24T22:35:08Z,"Shescape: Quadratic-time denial of service in the flag-protection",shescape,2.1.11,2.1.14,,HIGH,CWE-400;CWE-407,
|
|
8576
|
-
GHSA-gm3r-q2wp-hw87,2026-07-24T22:35:08Z,"Shescape: Quadratic-time denial of service in the flag-protection",shescape,3.0.0,3.0.1,,HIGH,CWE-400;CWE-407,
|
|
8577
8676
|
GHSA-gm68-572p-q28r,2023-07-06T15:30:51Z,"@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability",@vendure/admin-ui-plugin,0,2.0.3,,MODERATE,CWE-79,
|
|
8578
8677
|
GHSA-gm9g-2g8v-fvxj,2019-06-06T15:32:28Z,"Prototype Pollution in upmerge",upmerge,0,,0.1.8,MODERATE,CWE-345;CWE-400,
|
|
8579
8678
|
GHSA-gm9m-x74r-8whg,2026-03-31T15:31:56Z,"Duplicate Advisory: OpenClaw's Nextcloud Talk webhook missing rate limiting on shared secret authentication",openclaw,0,2026.3.28,,MODERATE,CWE-307,
|
|
@@ -8651,7 +8750,6 @@ GHSA-hc4w-hm59-9w88,2026-06-16T21:31:59Z,"Duplicate Advisory: Empty-scope device
|
|
|
8651
8750
|
GHSA-hcm3-8f6r-6xwg,2026-07-02T16:54:44Z,"OpenClaw: Browser debug/export routes could reuse already-open blocked tabs",openclaw,0,2026.4.29,,MODERATE,CWE-862,
|
|
8652
8751
|
GHSA-hcpx-6fm6-wx23,2026-07-20T22:38:04Z,"Axios form serializer maxDepth bypass via {} metatoken",axios,0.31.1,0.33.0,,MODERATE,CWE-674,
|
|
8653
8752
|
GHSA-hcpx-6fm6-wx23,2026-07-20T22:38:04Z,"Axios form serializer maxDepth bypass via {} metatoken",axios,1.15.1,1.18.0,,MODERATE,CWE-674,
|
|
8654
|
-
GHSA-hfhx-w8p8-4hc7,2026-07-24T21:44:44Z,"Budibase: SSRF via bare fetch() in uploadUrl during AI table generation",@budibase/server,0,,3.38.1,MODERATE,CWE-918,
|
|
8655
8753
|
GHSA-hfpr-jhpq-x4rm,2026-03-09T19:54:41Z,"OpenClaw: `operator.write` chat.send could reach admin-only config writes",openclaw,0,2026.3.7,,MODERATE,CWE-863,
|
|
8656
8754
|
GHSA-hfwx-c7q6-g54c,2021-03-12T23:04:46Z,"Vulnerability allowing for reading internal HTTP resources",highcharts-export-server,0,2.1.0,,HIGH,CWE-552,
|
|
8657
8755
|
GHSA-hfxh-rjv7-2369,2023-11-27T17:25:11Z,"Uptime Kuma Authenticated remote code execution via TailscalePing",uptime-kuma,1.23.0,1.23.7,,MODERATE,,
|
|
@@ -8666,16 +8764,13 @@ GHSA-hgwr-wr8h-rxm7,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: Google C
|
|
|
8666
8764
|
GHSA-hgxv-3497-3hhj,2023-07-04T18:30:58Z,"Duplicate Advisory: @fastify/oauth2 Oauth2 state parameter reuse",@fastify/oauth2,0,7.2.0,,MODERATE,,
|
|
8667
8765
|
GHSA-hh43-q692-2xmq,2026-03-29T15:30:19Z,"Duplicate Advisory: `OpenClaw: session_status` let sandboxed subagents access parent or sibling session state",openclaw,0,,2026.3.8,CRITICAL,CWE-863,
|
|
8668
8766
|
GHSA-hj5w-xgw9-w4rj,2020-09-03T19:41:44Z,"Malicious Package in coinstrng",coinstrng,0.0.0,,,CRITICAL,CWE-506,
|
|
8767
|
+
GHSA-hjwh-xvfw-qrwj,2026-08-19T19:32:46Z,"SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses",mcp-searxng,0,1.12.0,,MODERATE,CWE-209;CWE-532,
|
|
8669
8768
|
GHSA-hm63-vwj4-mj2q,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure",openclaw,0,2026.3.22,,MODERATE,CWE-789,
|
|
8670
8769
|
GHSA-hmfr-rx46-4jx2,2025-08-26T18:42:37Z,"GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation","@escape.tech/graphql-armor-max-depth",0,2.4.2,,MODERATE,CWE-400,
|
|
8671
|
-
GHSA-hp3v-mfqw-h74c,2026-07-20T23:24:34Z,"@astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped",@astrojs/netlify,0,8.1.2,,LOW,CWE-185,
|
|
8672
|
-
GHSA-hp6v-6jw7-gv2f,2026-07-24T21:17:39Z," Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified",@budibase/server,0,,3.38.1,CRITICAL,CWE-287,
|
|
8673
8770
|
GHSA-hpfq-8wx8-cgqw,2019-06-13T18:59:18Z,"Cross-Site Scripting in ids-enterprise",ids-enterprise,0,4.18.2,,HIGH,CWE-79,
|
|
8674
8771
|
GHSA-hpr5-wp7c-hh5q,2020-09-01T19:37:29Z,"Cross-Site Scripting in mrk.js",mrk.js,0,2.0.1,,HIGH,CWE-79,
|
|
8675
8772
|
GHSA-hq75-xg7r-rx6c,2025-07-11T17:09:53Z,"Better Call routing bug can lead to Cache Deception",better-call,0,1.0.12,,MODERATE,CWE-525,
|
|
8676
8773
|
GHSA-hq8g-qq57-5275,2020-09-11T21:24:33Z,"SQL Injection in untitled-model",untitled-model,0,,,HIGH,CWE-89,
|
|
8677
|
-
GHSA-hqf9-8xv5-x8xw,2026-01-05T19:57:46Z,"ERC7984ERC20Wrapper: once a wrapper is filled, subsequent wrap requests do not revert and result in loss of funds.","@openzeppelin/confidential-contracts",0,0.3.1,,MODERATE,CWE-190,
|
|
8678
|
-
GHSA-hr66-5mqr-8mpx,2026-07-24T21:25:00Z," Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint",@budibase/server,0,,3.38.1,HIGH,CWE-200,
|
|
8679
8774
|
GHSA-hrpp-f84w-xhfg,2020-09-04T16:55:06Z,"Outdated Static Dependency in vue-moment",vue-moment,0,4.1.0,,MODERATE,CWE-1104,
|
|
8680
8775
|
GHSA-hv4w-jhcj-6wfw,2020-09-03T20:34:23Z,"Cross-Site Scripting in snekserve",snekserve,0.0.0,,,HIGH,CWE-79,
|
|
8681
8776
|
GHSA-hv7x-3x78-gx53,2026-06-16T18:59:58Z,"n8n: Wrong OAuth Scope On Evaluations Test Run Creation Endpoint",n8n,0,1.123.55,,MODERATE,CWE-284,
|
|
@@ -8710,6 +8805,7 @@ GHSA-j44m-5v8f-gc9c,2025-10-10T22:55:09Z,"Flowise is vulnerable to arbitrary fil
|
|
|
8710
8805
|
GHSA-j472-gf56-x589,2026-07-02T17:22:52Z,"OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks",openclaw,0,2026.5.12,,HIGH,CWE-184,
|
|
8711
8806
|
GHSA-j4c5-89f5-f3pm,2026-04-25T23:49:42Z,"OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks",openclaw,0,2026.4.20,,LOW,CWE-918,
|
|
8712
8807
|
GHSA-j4mr-9xw3-c9jx,2019-05-31T23:47:01Z,"Out-of-bounds Read in base64-url",base64-url,0,2.0.0,,HIGH,CWE-125,
|
|
8808
|
+
GHSA-j4r7-8ph4-43g3,2026-08-19T19:15:13Z,"faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools",faf-mcp,0,2.1.3,,HIGH,CWE-200;CWE-22;CWE-73,
|
|
8713
8809
|
GHSA-j4vm-hg8g-g9qv,2020-09-03T17:33:50Z,"Malicious Package in antd-cloud",antd-cloud,0.0.0,,,CRITICAL,CWE-506,
|
|
8714
8810
|
GHSA-j56c-wpqm-h24x,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: Plivo V2 verified replay identity drifts on query-only variants",openclaw,0,2026.3.23,,HIGH,CWE-294,
|
|
8715
8811
|
GHSA-j59f-6m4q-62h6,2019-05-30T17:28:48Z,"Improper Key Verification in ipns",ipns,0,0.1.3,,HIGH,CWE-287,
|
|
@@ -8731,7 +8827,6 @@ GHSA-j8v8-g9cx-5qf4,2026-07-07T20:57:05Z,"@better-auth/scim: Account/provider ta
|
|
|
8731
8827
|
GHSA-j95h-wmx9-4279,2021-02-25T17:15:39Z,"Denial of Service",sails,0,0.12.0,,HIGH,,
|
|
8732
8828
|
GHSA-j965-2qgj-vjmq,2026-01-08T22:04:26Z,"JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3",aws-sdk,2.0.0,,3.0.0,LOW,CWE-20,
|
|
8733
8829
|
GHSA-j9f8-8h89-j69x,2019-06-11T16:16:34Z,"Remote Code Execution in node-os-utils",node-os-utils,0,1.1.0,,HIGH,CWE-94,
|
|
8734
|
-
GHSA-j9fc-w3mr-x6mv,2026-07-24T21:12:40Z," Budibase: Privilege escalation via public role assignment API missing app-level authorization",@budibase/server,0,,3.38.1,HIGH,CWE-269;CWE-862;CWE-863,
|
|
8735
8830
|
GHSA-j9pv-rrcj-6pfx,2026-04-02T21:01:57Z,"OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes",openclaw,0,2026.3.31,,MODERATE,CWE-212,
|
|
8736
8831
|
GHSA-jc5m-wrp2-qq38,2026-03-05T21:58:02Z,"Flowise Vulnerable to PII Disclosure on Unauthenticated Forgot Password Endpoint",flowise,0,3.0.13,,MODERATE,CWE-200,
|
|
8737
8832
|
GHSA-jccr-rrw2-vc8h,2026-03-31T23:56:13Z,"OpenClaw safeBins jq `$ENV` filter bypass allows environment variable disclosure",openclaw,0,2026.3.28,,HIGH,CWE-185;CWE-200,
|
|
@@ -8798,6 +8893,7 @@ GHSA-m5ch-gx8g-rg73,2020-09-02T15:43:53Z,"Remote Code Execution in pomelo-monito
|
|
|
8798
8893
|
GHSA-m5j2-r859-r5cv,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: Isolated cron awareness events were recorded as trusted system events",openclaw,0,2026.4.20,,MODERATE,CWE-345,
|
|
8799
8894
|
GHSA-m5jp-p3r5-mfqp,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Gateway Plugin Subagent Fallback `deleteSession` Uses Synthetic `operator.admin`",openclaw,0,,2026.3.24,MODERATE,CWE-648;CWE-863,
|
|
8800
8895
|
GHSA-m5p4-7wf9-6w99,2020-09-01T21:10:53Z,"Malicious Package in regenrator",regenrator,0,,,CRITICAL,CWE-506,
|
|
8896
|
+
GHSA-m5w8-4gq2-6f8x,2026-08-17T17:32:47Z,"vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)",vm2,0,3.11.6,,CRITICAL,CWE-200;CWE-285;CWE-732,
|
|
8801
8897
|
GHSA-m69h-jm2f-2pv8,2026-03-13T20:54:30Z,"OpenClaw: Feishu reaction events could bypass group authorization and mention gating",openclaw,0,2026.3.12,,MODERATE,CWE-285;CWE-863,
|
|
8802
8898
|
GHSA-m6q2-9pfm-2wvr,2020-09-03T17:02:49Z,"Malicious Package in wallet-address-vaildator",wallet-address-vaildator,0.0.0,,,CRITICAL,CWE-506,
|
|
8803
8899
|
GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior","@openzeppelin/contracts-upgradeable",4.3.0,4.4.2,,MODERATE,,
|
|
@@ -8889,9 +8985,6 @@ GHSA-p4mf-4qvh-w8g5,2020-09-04T15:41:42Z,"Malicious Package in bitcionjslib",bit
|
|
|
8889
8985
|
GHSA-p56r-jr4p-4wgh,2020-08-03T18:16:37Z,Withdrawn,whereis,0,0.4.1,,HIGH,,
|
|
8890
8986
|
GHSA-p5p2-rhc3-wmf3,2020-09-03T17:03:31Z,"Malicious Package in siganle",siganle,0.0.0,,,CRITICAL,CWE-506,
|
|
8891
8987
|
GHSA-p62r-jf56-h429,2020-09-03T20:29:58Z,"Malicious Package in evil-package",evil-package,0.0.0,,,CRITICAL,CWE-506,
|
|
8892
|
-
GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,0,3.2.7,,CRITICAL,CWE-22;CWE-552;CWE-862,
|
|
8893
|
-
GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,4.0.0,4.1.10,,CRITICAL,CWE-22;CWE-552;CWE-862,
|
|
8894
|
-
GHSA-p63j-vcc4-9vmv,2026-07-21T19:36:12Z,"@vitest/browser: Browser Mode provider commands bypass the file-access permission gate",@vitest/browser,5.0.0-beta.1,5.0.0-beta.6,,CRITICAL,CWE-22;CWE-552;CWE-862,
|
|
8895
8988
|
GHSA-p6gq-j5cr-w38f,2026-06-18T14:28:05Z,"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message",nodemailer,0,9.0.1,,HIGH,CWE-73;CWE-918,
|
|
8896
8989
|
GHSA-p6j4-wvmc-vx2h,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete",openclaw,0,2026.3.22,,MODERATE,CWE-696,
|
|
8897
8990
|
GHSA-p72p-rjr2-r439,2019-05-29T20:24:02Z,"Server-Side Request Forgery in terriajs-server",terriajs-server,0,2.7.4,,HIGH,CWE-918,
|
|
@@ -8926,7 +9019,6 @@ GHSA-phgf-3849-rgjq,2026-03-31T12:31:35Z,"Duplicate Advisory: OpenClaw: Plugin s
|
|
|
8926
9019
|
GHSA-phph-xpj4-wvcv,2020-09-03T21:13:07Z,"Cross-Site Scripting in hexo-admin",hexo-admin,0.0.0,,,HIGH,CWE-79,
|
|
8927
9020
|
GHSA-pj97-j597-ppm7,2020-09-02T21:15:22Z,"Malicious Package in rqeuest",rqeuest,0,,,CRITICAL,CWE-506,
|
|
8928
9021
|
GHSA-pjvx-rx66-r3fg,2026-03-09T19:54:08Z,"OpenClaw: Cross-account sender authorization expansion in `/allowlist ... --store` account scoping",openclaw,0,2026.3.7,,MODERATE,CWE-639;CWE-863,
|
|
8929
|
-
GHSA-pm4m-ph32-ghv5,2026-07-24T16:47:36Z,"js-yaml: Exponential parsing time in flow collections leads to denial of service",js-yaml,5.0.0,5.2.2,,HIGH,CWE-407,
|
|
8930
9022
|
GHSA-pm52-wwrw-c282,2019-06-13T18:59:06Z,"Command Injection in wiki-plugin-datalog",wiki-plugin-datalog,0,0.1.6,,HIGH,CWE-94,
|
|
8931
9023
|
GHSA-pm9v-325f-5g74,2020-09-02T21:30:11Z,"Malicious Package in saync",saync,0,,,CRITICAL,CWE-506,
|
|
8932
9024
|
GHSA-pmf3-2q63-jmp6,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)",openclaw,0,,2026.2.22,MODERATE,CWE-61,
|
|
@@ -8934,7 +9026,6 @@ GHSA-pmgv-94f5-6w7w,2020-09-02T20:21:30Z,"Malicious Package in eact",eact,0,,,CR
|
|
|
8934
9026
|
GHSA-pmpg-2mxq-6xwr,2026-07-24T21:43:34Z," Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete",@budibase/server,0,,3.38.1,HIGH,CWE-89,
|
|
8935
9027
|
GHSA-pmv8-rq9r-6j72,2026-07-20T17:48:18Z,"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",axios,0.28.0,0.33.0,,MODERATE,CWE-400;CWE-770,
|
|
8936
9028
|
GHSA-pmv8-rq9r-6j72,2026-07-20T17:48:18Z,"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service",axios,1.0.0,1.18.0,,MODERATE,CWE-400;CWE-770,
|
|
8937
|
-
GHSA-ppr4-5f46-j9c6,2026-07-24T21:16:41Z," Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile",@budibase/server,0,,3.38.1,HIGH,CWE-209,
|
|
8938
9029
|
GHSA-ppwq-6v66-5m6j,2026-03-26T21:15:59Z,"OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status",openclaw,0,2026.3.22,,MODERATE,CWE-200;CWE-212;CWE-522,
|
|
8939
9030
|
GHSA-pqh8-p93p-2rx7,2026-07-31T15:56:12Z,"@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL","@dynatrace-oss/dynatrace-mcp-server",0,2.1.1,,MODERATE,CWE-943,
|
|
8940
9031
|
GHSA-pqhp-25j4-6hq9,2024-11-22T20:40:49Z,"smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables",smol-toml,0,1.3.1,,MODERATE,CWE-674,
|
|
@@ -8966,14 +9057,11 @@ GHSA-q4gf-8mx6-v5v3,2026-04-10T15:35:47Z,"Next.js has a Denial of Service with S
|
|
|
8966
9057
|
GHSA-q4h9-46xg-m3x9,2021-09-15T20:22:13Z,"UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable","@openzeppelin/contracts-upgradeable",4.1.0,4.3.2,,CRITICAL,,
|
|
8967
9058
|
GHSA-q4pp-j36h-3gqg,2023-08-24T12:53:06Z,"Minimal `basti` IAM Policy Allows Shell Access",basti-cdk,0,1.0.1,,LOW,,
|
|
8968
9059
|
GHSA-q4xx-mc3q-23x8,2025-08-14T12:30:22Z,"Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection",flowise,0,,3.0.5,CRITICAL,CWE-94,
|
|
8969
|
-
GHSA-q53c-4prm-w95q,2026-07-24T22:34:39Z,"Shescape: Home-directory disclosure in assignment context on Unix with Dash",shescape,0,2.1.14,,MODERATE,CWE-116;CWE-200,
|
|
8970
|
-
GHSA-q53c-4prm-w95q,2026-07-24T22:34:39Z,"Shescape: Home-directory disclosure in assignment context on Unix with Dash",shescape,3.0.0,3.0.1,,MODERATE,CWE-116;CWE-200,
|
|
8971
9060
|
GHSA-q5pp-5q2h-g8rv,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,,,MODERATE,CWE-79,
|
|
8972
9061
|
GHSA-q5pr-72pq-83v3,2026-03-23T21:44:55Z,"H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,2.0.1-rc.18,,MODERATE,CWE-400,
|
|
8973
9062
|
GHSA-q643-w9jp-q2qg,2020-09-04T17:34:59Z,"Hardcoded Initialization Vector in parsel",parsel,0.0.0,,,HIGH,,
|
|
8974
9063
|
GHSA-q67q-549q-p849,2025-09-15T20:11:39Z,"Flowise has arbitrary file access due to missing chat flow id validation",flowise,2.2.8,3.0.6,,CRITICAL,CWE-22,
|
|
8975
9064
|
GHSA-q6mx-qvhp-fqmg,2026-07-15T12:32:03Z,"Duplicate Advisory: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,0,,,MODERATE,CWE-639,
|
|
8976
|
-
GHSA-q6x4-v3qx-85qw,2026-07-24T21:15:02Z," Budibase: SQL Injection via `multipleStatements: true`",@budibase/server,0,,3.38.1,CRITICAL,CWE-89,
|
|
8977
9065
|
GHSA-q7jf-gf43-6x6p,2025-10-24T19:15:13Z,"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,4.10.3,,MODERATE,CWE-444,
|
|
8978
9066
|
GHSA-q83v-hq3j-4pq3,2024-08-15T06:32:22Z,"Duplicate Advisory: Improper access control in Directus",directus,0,,10.13.0,MODERATE,CWE-639,
|
|
8979
9067
|
GHSA-q849-wxrc-vqrp,2024-12-02T20:11:39Z,"hull.js Code Injection Vulnerability",hull.js,0.2.2,1.0.10,,CRITICAL,CWE-94,
|
|
@@ -9010,7 +9098,6 @@ GHSA-qm4q-f956-fg64,2020-09-03T17:39:13Z,"Malicious Package in luna-mock",luna-m
|
|
|
9010
9098
|
GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,2.0.0,2.25.3,,HIGH,CWE-79,
|
|
9011
9099
|
GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,3.0.0,3.4.1,,HIGH,CWE-79,
|
|
9012
9100
|
GHSA-qmgf-fp85-55gr,2020-09-04T15:40:34Z,"Malicious Package in bitcionjs",bitcionjs,0.0.0,,,CRITICAL,CWE-506,
|
|
9013
|
-
GHSA-qmpg-8xg6-ph5q,2026-03-12T17:29:30Z,"Trix has a Stored XSS vulnerability through serialized attributes",trix,0,2.1.17,,MODERATE,CWE-79,
|
|
9014
9101
|
GHSA-qmq6-f8pr-cx5x,2026-04-23T06:30:22Z,"Duplicate Advisory: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",uuid,0,14.0.0,,LOW,CWE-670,
|
|
9015
9102
|
GHSA-qmwg-qprg-3j38,2026-04-17T22:14:20Z,"OpenClaw: Browser interaction routes could pivot into local CDP and regain file reads",openclaw,0,2026.4.9,,MODERATE,CWE-693,
|
|
9016
9103
|
GHSA-qp56-gp47-jwj3,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: Feishu extension resolveUploadInput bypasses file-system sandbox and allows arbitrary file reads via upload_image",openclaw,2026.2.6,2026.3.28,,MODERATE,CWE-22,
|
|
@@ -9041,8 +9128,6 @@ GHSA-qwww-vcr4-c8h2,2026-07-24T16:44:43Z,"React Router: RSC Mode CSRF Bypass All
|
|
|
9041
9128
|
GHSA-qx4v-6gc5-f2vv,2019-06-20T14:32:56Z,"Regular Expression Denial of Service",esm,0,3.1.0,,MODERATE,CWE-400,
|
|
9042
9129
|
GHSA-qxrj-x7rm-2h49,2020-09-03T17:05:59Z,"Malicious Package in dhkey",dhkey,0.0.0,,,CRITICAL,CWE-506,
|
|
9043
9130
|
GHSA-r27j-894h-3w3p,2026-05-06T17:32:01Z,"mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`",icu-minify,0,4.9.2,,LOW,CWE-1321,
|
|
9044
|
-
GHSA-r28c-9q8g-f849,2026-07-24T16:24:55Z,"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",postcss,0,8.5.18,,HIGH,CWE-22,
|
|
9045
|
-
GHSA-r292-9mhp-454m,2026-07-24T16:26:16Z,"node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection",tar,0,7.5.21,,MODERATE,CWE-400;CWE-674,
|
|
9046
9131
|
GHSA-r294-2894-92j3,2026-03-03T22:09:26Z,"OpenClaw has stored XSS in exported session HTML viewer via markdown/raw-HTML rendering",openclaw,0,2026.2.23,,MODERATE,CWE-79,
|
|
9047
9132
|
GHSA-r2c6-8jc8-g32w,2026-02-02T00:30:23Z,"Duplicate Advisory: 1-Click RCE via Authentication Token Exfiltration From gatewayUrl",clawdbot,0,2026.1.29,,HIGH,CWE-669,
|
|
9048
9133
|
GHSA-r2fx-hp6p-pgrm,2026-06-16T21:31:59Z,"Duplicate Advisory: Internal/webchat command auth could inherit ownerAllowFrom wildcard state",openclaw,0,,2026.4.24,MODERATE,CWE-863,
|
|
@@ -9112,6 +9197,7 @@ GHSA-rmmc-8cqj-hfp3,2020-09-03T18:24:43Z,"Authentication Bypass in otpauth",otpa
|
|
|
9112
9197
|
GHSA-rp72-5v5q-2446,2026-06-26T21:08:06Z,"@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url",@cardano402/mcp-server,0,0.1.2,,LOW,"CWE-22;CWE-770;CWE-862;CWE-918",
|
|
9113
9198
|
GHSA-rq7w-g337-39qq,2026-06-15T20:56:22Z,"Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`",nuxt,4.0.0-alpha.1,4.4.7,,LOW,CWE-200,
|
|
9114
9199
|
GHSA-rqgv-292v-5qgr,2024-04-23T16:21:09Z,"Renovate vulnerable to arbitrary command injection via helmv3 manager and registryAliases",renovate,37.158.0,37.199.0,,MODERATE,CWE-78,
|
|
9200
|
+
GHSA-rr55-jp92-8wp2,2026-08-19T19:15:25Z,"claude-faf-mcp has an arbitrary local file read/write via unconfined `path` argument in FAF tools",claude-faf-mcp,0,5.7.2,,HIGH,CWE-200;CWE-22;CWE-73,
|
|
9115
9201
|
GHSA-rrqv-vjrw-hrcr,2021-05-26T19:59:19Z,"Arbitrary Code Execution in json-ptr",json-ptr,0,2.1.0,,HIGH,CWE-74,
|
|
9116
9202
|
GHSA-rrvm-gqq8-q2wx,2020-09-03T21:05:26Z,"Malicious Package in require-port",require-port,0.0.0,,,CRITICAL,CWE-506,
|
|
9117
9203
|
GHSA-rv49-54qp-fw42,2019-06-06T15:30:20Z,"Path Traversal in servey",servey,0,3.1.0,,MODERATE,CWE-22,
|
|
@@ -9131,7 +9217,6 @@ GHSA-v3f4-w7r7-v3hm,2026-06-19T21:43:09Z,"Uni-CLI: Legacy HTTP MCP transport acc
|
|
|
9131
9217
|
GHSA-v3qc-wrwx-j3pw,2026-04-03T03:03:18Z,"OpenClaw: Agentic Consent Bypass — LLM Agent Can Silently Disable Exec Approval via `config.patch`",openclaw,0,2026.3.28,,HIGH,CWE-285,
|
|
9132
9218
|
GHSA-v3rj-xjv7-4jmq,2026-03-25T21:03:56Z,"smol-toml: Denial of Service via TOML documents containing thousands of consecutive commented lines",smol-toml,0,1.6.1,,MODERATE,CWE-674,
|
|
9133
9219
|
GHSA-v3wr-67px-44xg,2022-03-03T19:11:14Z,"Execution with Unnecessary Privileges in arc-electron","@advanced-rest-client/base",0,0.1.10,,HIGH,,
|
|
9134
|
-
GHSA-v42f-v8xc-j435,2026-07-24T21:44:27Z,"Budibase: SSRF via DNS rebinding in the REST datasource integration",@budibase/server,0,,3.38.1,HIGH,CWE-367;CWE-918,
|
|
9135
9220
|
GHSA-v457-wxvj-p9w9,2026-04-10T15:36:00Z,"@vitejs/plugin-rsc has a Denial of Service with React Server Components",@vitejs/plugin-rsc,0,0.5.23,,HIGH,CWE-400,
|
|
9136
9221
|
GHSA-v45m-2wcp-gg98,2020-09-04T17:18:44Z,"Global node_modules Binary Overwrite in bin-links",bin-links,0,1.1.6,,LOW,,
|
|
9137
9222
|
GHSA-v4x8-gw49-7hv4,2020-09-03T20:37:42Z,"Path Traversal in swagger-injector",swagger-injector,0.0.0,,,CRITICAL,CWE-22,
|
|
@@ -9146,6 +9231,7 @@ GHSA-v6wj-c83f-v46x,2026-05-09T00:42:12Z,"@profullstack/mcp-server vulnerable to
|
|
|
9146
9231
|
GHSA-v78c-4p63-2j6c,2022-08-30T20:28:43Z,"Cleartext Transmission of Sensitive Information in moment-timezone",moment-timezone,0.1.0,0.5.35,,MODERATE,CWE-319,
|
|
9147
9232
|
GHSA-v7cp-5326-54fh,2020-09-03T16:45:15Z,"Path Traversal in bruteser",bruteser,0,0.1.0,,HIGH,CWE-22,
|
|
9148
9233
|
GHSA-v7x3-7hw7-pcjg,2019-10-21T16:02:33Z,"Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments",renovate,13.87.0,19.38.7,,MODERATE,CWE-200,
|
|
9234
|
+
GHSA-v836-6xw4-9cx3,2026-08-17T17:32:57Z,"vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass",vm2,0,3.11.6,,HIGH,CWE-770,
|
|
9149
9235
|
GHSA-v86x-f47q-f7f4,2020-09-11T21:09:24Z,"Unauthorized File Access in atompm",atompm,0,0.8.2,,HIGH,CWE-200,
|
|
9150
9236
|
GHSA-v8g7-9qv2-j865,2020-09-04T16:38:55Z,"Malicious Package in bitcoin-osp",bitcoin-osp,0.0.0,,,CRITICAL,CWE-506,
|
|
9151
9237
|
GHSA-v8j2-5f9p-fmh4,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload",openclaw,0,2026.4.23,,MODERATE,CWE-672,
|
|
@@ -9161,7 +9247,6 @@ GHSA-vf8q-pw7h-r2x2,2020-09-11T21:15:54Z,"Malicious Package in epress",epress,0,
|
|
|
9161
9247
|
GHSA-vg44-fw64-cpjx,2020-03-24T15:08:59Z,"Incorrect Account Used for Signing","@metamask/eth-ledger-bridge-keyring",0,0.2.2,,HIGH,CWE-287,
|
|
9162
9248
|
GHSA-vg44-fw64-cpjx,2020-03-24T15:08:59Z,"Incorrect Account Used for Signing","eth-ledger-bridge-keyring",0,0.2.1,,HIGH,CWE-287,
|
|
9163
9249
|
GHSA-vg6v-j97m-h5xq,2026-07-28T14:59:22Z,"@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition","@novu/application-generic",0,3.17.0,,MODERATE,CWE-918,
|
|
9164
|
-
GHSA-vh45-f885-3848,2026-07-24T21:50:45Z,"sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock",sm-crypto,0,0.5.0,,CRITICAL,CWE-338,
|
|
9165
9250
|
GHSA-vh4c-j2xv-9pv9,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw: BlueBubbles beta plugin webhook auth hardening (remove passwordless fallback)",openclaw,0,,,MODERATE,CWE-306,
|
|
9166
9251
|
GHSA-vh4h-fvqf-q9wv,2025-05-01T03:31:17Z,"Duplicate Advisory: @cloudflare/workers-oauth-provider PKCE bypass via downgrade attack","@cloudflare/workers-oauth-provider",0,0.0.5,,MODERATE,CWE-287,
|
|
9167
9252
|
GHSA-vh5j-5fhq-9xwg,2025-06-27T22:06:48Z,"Taylor has race condition in /get-patch that allows purchase token replay",taylored,0,8.1.3,,LOW,CWE-362,
|
|
@@ -9243,8 +9328,6 @@ GHSA-w46p-w7w2-fr9g,2026-07-22T12:32:17Z,"Duplicate Advisory: AI Agents Project
|
|
|
9243
9328
|
GHSA-w48f-fwg7-ww6p,2026-04-04T04:24:27Z,"@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding",@stablelib/cbor,0,2.0.3,,HIGH,CWE-1321,
|
|
9244
9329
|
GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/core,0,,0.1.142,HIGH,,
|
|
9245
9330
|
GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/server,0,,0.56.0,HIGH,,
|
|
9246
|
-
GHSA-w4hw-qcx7-56pr,2026-07-24T22:34:23Z,"Shescape: Shell injection via unescaped parentheses on Windows with CMD",shescape,0,2.1.14,,CRITICAL,CWE-150;CWE-78,
|
|
9247
|
-
GHSA-w4hw-qcx7-56pr,2026-07-24T22:34:23Z,"Shescape: Shell injection via unescaped parentheses on Windows with CMD",shescape,3.0.0,3.0.1,,CRITICAL,CWE-150;CWE-78,
|
|
9248
9331
|
GHSA-w4v6-g3wm-w36c,2026-07-02T16:48:45Z,"OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy",openclaw,0,2026.4.29,,CRITICAL,CWE-863,
|
|
9249
9332
|
GHSA-w4vp-3mq7-7v82,2020-09-03T15:49:48Z,"Cross-Site Scripting in lazysizes",lazysizes,0,5.2.1-rc1,,HIGH,CWE-79,
|
|
9250
9333
|
GHSA-w5c7-9qqw-6645,2026-02-18T00:56:51Z,"OpenClaw inter-session prompts could be treated as direct user instructions",openclaw,0,2026.2.13,,HIGH,CWE-345,
|
|
@@ -9344,15 +9427,11 @@ GHSA-wxj2-777f-vxmf,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripti
|
|
|
9344
9427
|
GHSA-wxrm-2h86-v95f,2020-09-03T21:04:20Z,"Malicious Package in pizza-pasta",pizza-pasta,0.0.0,,,CRITICAL,CWE-506,
|
|
9345
9428
|
GHSA-wxvm-fh75-mpgr,2018-07-26T16:24:34Z,"Critical severity vulnerability that affects dns-sync",dns-sync,0,0.1.1,,CRITICAL,,
|
|
9346
9429
|
GHSA-wxw3-q3m9-c3jr,2026-05-15T17:33:40Z,"Better Auth: OAuth callback accepts mismatched `state` when cookie-backed state storage is used without PKCE",better-auth,0,1.6.2,,MODERATE,CWE-287;CWE-345;CWE-352,
|
|
9347
|
-
GHSA-x27w-589x-frm2,2026-07-20T23:25:07Z,"Astro: Unauthenticated path override in the @astrojs/vercel ISR function",@astrojs/vercel,10.0.3,11.0.3,,MODERATE,CWE-441;CWE-862,
|
|
9348
9430
|
GHSA-x39m-3393-3qp4,2025-11-14T20:56:02Z,"Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)",flowise-ui,0,3.0.10,,HIGH,CWE-306;CWE-620,
|
|
9349
9431
|
GHSA-x3ff-w252-2g7j,2026-04-01T22:13:35Z,"StableLib Ed25519 Signature Malleability via Missing S < L Check",@stablelib/ed25519,0,,2.0.2,MODERATE,CWE-347,
|
|
9350
9432
|
GHSA-x3h8-jrgh-p8jx,2026-05-04T20:23:35Z,"OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs",openclaw,0,2026.4.22,,MODERATE,CWE-200,
|
|
9351
9433
|
GHSA-x3m6-rprw-862w,2020-09-03T17:43:31Z,"Malicious Package in node-buc",node-buc,0.0.0,,,CRITICAL,CWE-506,
|
|
9352
9434
|
GHSA-x3w4-mrmv-cw2x,2020-09-03T22:19:44Z,"Malicious Package in buffev-xor",buffev-xor,0.0.0,,,CRITICAL,CWE-506,
|
|
9353
|
-
GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",@auth/core,0,0.41.3,,MODERATE,CWE-345;CWE-346;CWE-940,
|
|
9354
|
-
GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",next-auth,0,4.24.15,,MODERATE,CWE-345;CWE-346;CWE-940,
|
|
9355
|
-
GHSA-x445-f3h2-j279,2026-07-23T14:31:51Z,"Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them",next-auth,5.0.0-beta.1,5.0.0-beta.32,,MODERATE,CWE-345;CWE-346;CWE-940,
|
|
9356
9435
|
GHSA-x45v-pvpg-hcrh,2020-09-03T19:54:36Z,"Malicious Package in mysql-koa",mysql-koa,0.0.0,,,CRITICAL,CWE-506,
|
|
9357
9436
|
GHSA-x48m-gp6r-gp4v,2020-09-03T18:21:26Z,"Malicious Package in rate-map",rate-map,1.0.3,1.0.5,,CRITICAL,CWE-506,
|
|
9358
9437
|
GHSA-x49q-fhhm-r9jf,2026-03-20T15:31:14Z,"Duplicate Advisory: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes",openclaw,0,2026.3.12,,CRITICAL,CWE-862,
|
|
@@ -9402,9 +9481,6 @@ GHSA-xm7f-x4wx-wmgv,2019-06-04T15:47:43Z,"Out-of-bounds Read in byte",byte,0,1.4
|
|
|
9402
9481
|
GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,0,1.123.67,,HIGH,CWE-73,
|
|
9403
9482
|
GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-73,
|
|
9404
9483
|
GHSA-xmc9-4f2h-jf9c,2026-07-22T22:11:49Z,"n8n: Edit Image Node Format Injection Allows Arbitrary File Write",n8n,2.32.0,2.32.1,,HIGH,CWE-73,
|
|
9405
|
-
GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",@auth/core,0.1.0,0.41.3,,HIGH,CWE-20,
|
|
9406
|
-
GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",next-auth,4.0.6,4.24.15,,HIGH,CWE-20,
|
|
9407
|
-
GHSA-xmf8-cvqr-rfgj,2026-07-23T14:42:55Z,"Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers",next-auth,5.0.0-beta.0,5.0.0-beta.32,,HIGH,CWE-20,
|
|
9408
9484
|
GHSA-xmh9-rg6f-j3mr,2021-03-12T22:39:01Z,"Verification flaw in Solid identity-token-verifier","@solid/identity-token-verifier",0,0.5.2,,MODERATE,CWE-290,
|
|
9409
9485
|
GHSA-xmmp-hrmx-x5g7,2020-09-02T21:32:22Z,"Malicious Package in bowe",bowe,0,,,CRITICAL,CWE-506,
|
|
9410
9486
|
GHSA-xmv6-r34m-62p4,2026-03-03T22:08:54Z,"OpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot",openclaw,0,2026.2.25,,HIGH,CWE-22;CWE-59,
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@openrewrite/recipes-nodejs",
|
|
3
|
-
"version": "0.48.
|
|
3
|
+
"version": "0.48.2",
|
|
4
4
|
"license": "Moderne Proprietary",
|
|
5
5
|
"description": "OpenRewrite recipes for Node.js library migrations.",
|
|
6
6
|
"homepage": "https://github.com/moderneinc/rewrite-node",
|
|
@@ -25,7 +25,7 @@
|
|
|
25
25
|
"ci:test": "jest"
|
|
26
26
|
},
|
|
27
27
|
"dependencies": {
|
|
28
|
-
"@openrewrite/rewrite": "^8.
|
|
28
|
+
"@openrewrite/rewrite": "^8.91.0-20260826-142518",
|
|
29
29
|
"mutative": "^1.1.0",
|
|
30
30
|
"semver": "^7.7.3"
|
|
31
31
|
},
|
|
@@ -3,7 +3,7 @@
|
|
|
3
3
|
*
|
|
4
4
|
* Moderne Proprietary. Only for use by Moderne customers under the terms of a commercial contract.
|
|
5
5
|
*/
|
|
6
|
-
import {check,
|
|
6
|
+
import {check, ExecutionContext, Recipe, TreeVisitor} from "@openrewrite/rewrite";
|
|
7
7
|
import {
|
|
8
8
|
JavaScriptVisitor,
|
|
9
9
|
JS,
|
|
@@ -12,7 +12,7 @@ import {
|
|
|
12
12
|
template,
|
|
13
13
|
usesMethod
|
|
14
14
|
} from "@openrewrite/rewrite/javascript";
|
|
15
|
-
import {
|
|
15
|
+
import {Expression, J} from "@openrewrite/rewrite/java";
|
|
16
16
|
|
|
17
17
|
export class UseNativeTypeCheckingMethods extends Recipe {
|
|
18
18
|
readonly name = "org.openrewrite.node.migrate.util.use-native-type-checking-methods"
|
|
@@ -41,51 +41,45 @@ export class UseNativeTypeCheckingMethods extends Recipe {
|
|
|
41
41
|
|
|
42
42
|
protected async visitUnary(unary: J.Unary, p: ExecutionContext): Promise<J | undefined> {
|
|
43
43
|
const unaryAfter = await super.visitUnary(unary, p) as J.Unary;
|
|
44
|
-
if (unary.expression.kind
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
} as JS.Binary;
|
|
55
|
-
// TODO analyze why immer `produce()` gives us the "RangeError: Maximum call stack size exceeded" error
|
|
56
|
-
// return produce(binary, draft => {
|
|
57
|
-
// draft.operator.element = JS.Binary.Type.IdentityNotEquals;
|
|
58
|
-
// });
|
|
59
|
-
}
|
|
60
|
-
} else if (unaryAfter.expression.kind === J.Kind.Binary) {
|
|
61
|
-
// used for `!util.isNullOrUndefined(x)`
|
|
62
|
-
const binary = unaryAfter.expression as J.Binary;
|
|
63
|
-
if (binary.operator.element === J.Binary.Type.Equal) {
|
|
64
|
-
return {
|
|
65
|
-
...binary,
|
|
66
|
-
operator: {
|
|
67
|
-
...binary.operator,
|
|
68
|
-
element: J.Binary.Type.NotEqual
|
|
69
|
-
}
|
|
70
|
-
} as J.Binary;
|
|
71
|
-
// TODO analyze why immer `produce()` gives us the "RangeError: Maximum call stack size exceeded" error
|
|
72
|
-
// return produce(binary, draft => {
|
|
73
|
-
// draft.operator.element = J.Binary.Type.NotEqual;
|
|
74
|
-
// });
|
|
75
|
-
}
|
|
76
|
-
}
|
|
44
|
+
if (unary.expression.kind !== J.Kind.MethodInvocation
|
|
45
|
+
|| unaryAfter.expression.kind === J.Kind.MethodInvocation
|
|
46
|
+
|| unaryAfter.operator.element !== J.Unary.Type.Not) {
|
|
47
|
+
return unaryAfter;
|
|
48
|
+
}
|
|
49
|
+
|
|
50
|
+
// The template engine wraps a substituted comparison in parentheses under `!`; look through them
|
|
51
|
+
const replaced = unaryAfter.expression.kind === J.Kind.Parentheses
|
|
52
|
+
? (unaryAfter.expression as J.Parentheses<Expression>).tree.element
|
|
53
|
+
: unaryAfter.expression;
|
|
77
54
|
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
55
|
+
if (replaced.kind === JS.Kind.Binary) {
|
|
56
|
+
const binary = replaced as JS.Binary;
|
|
57
|
+
if (binary.operator.element === JS.Binary.Type.IdentityEquals) {
|
|
58
|
+
return {
|
|
59
|
+
...binary,
|
|
60
|
+
prefix: unaryAfter.prefix,
|
|
61
|
+
operator: {
|
|
62
|
+
...binary.operator,
|
|
63
|
+
element: JS.Binary.Type.IdentityNotEquals
|
|
64
|
+
}
|
|
65
|
+
} as JS.Binary;
|
|
66
|
+
}
|
|
67
|
+
} else if (replaced.kind === J.Kind.Binary) {
|
|
68
|
+
// used for `!util.isNullOrUndefined(x)`
|
|
69
|
+
const binary = replaced as J.Binary;
|
|
70
|
+
if (binary.operator.element === J.Binary.Type.Equal) {
|
|
71
|
+
return {
|
|
72
|
+
...binary,
|
|
73
|
+
prefix: unaryAfter.prefix,
|
|
74
|
+
operator: {
|
|
75
|
+
...binary.operator,
|
|
76
|
+
element: J.Binary.Type.NotEqual
|
|
77
|
+
}
|
|
78
|
+
} as J.Binary;
|
|
79
|
+
}
|
|
88
80
|
}
|
|
81
|
+
|
|
82
|
+
// Anything else (instanceof, &&, !==) keeps the `!`, and the template already parenthesized it as needed
|
|
89
83
|
return unaryAfter;
|
|
90
84
|
}
|
|
91
85
|
|