npm - @openrewrite/recipes-nodejs - Versions diffs - 0.51.0-20260922-170911 → 0.51.1 - Mend

@openrewrite/recipes-nodejs 0.51.0-20260922-170911 → 0.51.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (104) hide show

package/dist/resources/advisories-npm.csv CHANGED Viewed

@@ -4500,9 +4500,10 @@ CVE-2025-70948,2026-03-05T21:30:49Z,"@perfood/couch-auth has a host header injec
 CVE-2025-70949,2026-03-05T21:30:49Z,"@perfood/couch-auth has an Observable Timing Discrepancy ",@perfood/couch-auth,0,,0.26.0,HIGH,CWE-208,
 CVE-2025-71319,2025-04-02T15:04:58Z,"image-size Denial of Service via Infinite Loop during Image Processing",image-size,1.1.0,1.2.1,,HIGH,CWE-770;CWE-835,
 CVE-2025-71319,2025-04-02T15:04:58Z,"image-size Denial of Service via Infinite Loop during Image Processing",image-size,2.0.0,2.0.2,,HIGH,CWE-770;CWE-835,
-CVE-2025-71329,2026-06-10T15:31:30Z,"image-size: JXL and HEIF parsers allow denial of service through infinite loops",image-size,0,,2.0.2,HIGH,CWE-835,
-CVE-2025-71330,2026-06-10T15:31:30Z,"image-size: ICNS parser allows denial of service through an infinite loop",image-size,0,,2.0.2,HIGH,CWE-835,
+CVE-2025-71329,2026-06-10T15:31:30Z,"image-size: JXL and HEIF parsers allow denial of service through infinite loops",image-size,1.2.0,2.0.3,,HIGH,CWE-835,
+CVE-2025-71330,2026-06-10T15:31:30Z,"image-size: ICNS parser allows denial of service through an infinite loop",image-size,0.6.3,2.0.3,,HIGH,CWE-835,
 CVE-2025-71332,2025-04-07T18:55:13Z,"FlowiseDB vulnerable to SQL Injection by authenticated users",flowise,0,,2.2.7,MODERATE,CWE-564,
+CVE-2025-71381,2025-10-24T19:15:13Z,"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,4.10.3,,MODERATE,CWE-444,
 CVE-2025-71401,2025-12-01T21:29:48Z,"Better Auth affected by external request basePath modification DoS",better-auth,0,1.4.2,,HIGH,CWE-73;CWE-770,
 CVE-2025-7338,2025-07-17T21:01:54Z,"Multer vulnerable to Denial of Service via unhandled exception from malformed request",multer,1.4.4-lts.1,2.0.2,,HIGH,CWE-248,
 CVE-2025-7339,2025-07-17T21:17:19Z,"on-headers is vulnerable to http response header manipulation",on-headers,0,1.1.0,,LOW,CWE-241,
@@ -4537,8 +4538,88 @@ CVE-2026-0824,2026-01-10T15:31:22Z,"QuestDB UI's Web Console is Vulnerable to Cr
 CVE-2026-0933,2026-01-21T23:00:35Z,"Wrangler affected by OS Command Injection in `wrangler pages deploy`",wrangler,2.0.15,3.114.17,,HIGH,CWE-78,
 CVE-2026-0933,2026-01-21T23:00:35Z,"Wrangler affected by OS Command Injection in `wrangler pages deploy`",wrangler,4.0.0,4.59.1,,HIGH,CWE-78,
 CVE-2026-0969,2026-02-12T03:31:01Z,"next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content",next-mdx-remote,4.3.0,6.0.0,,HIGH,CWE-94,
+CVE-2026-10032,2026-10-02T22:55:49Z,"@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions",@a2ui/web_core,0.9.0,0.10.2,,CRITICAL,CWE-79,
+CVE-2026-101894,2026-09-29T23:49:42Z,"@xhmikosr/decompress: Path traversal via symlink chain",@xhmikosr/decompress,0,10.2.2,,CRITICAL,CWE-22;CWE-59,
+CVE-2026-101894,2026-09-29T23:49:42Z,"@xhmikosr/decompress: Path traversal via symlink chain",@xhmikosr/decompress,11.0.0,11.1.4,,CRITICAL,CWE-22;CWE-59,
+CVE-2026-101894,2026-09-29T23:49:42Z,"@xhmikosr/decompress: Path traversal via symlink chain",decompress,0,,4.2.1,CRITICAL,CWE-22;CWE-59,
+CVE-2026-101895,2026-09-28T21:31:21Z,"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE",@angular/platform-server,0,,19.2.25,HIGH,CWE-400;CWE-835,
+CVE-2026-101895,2026-09-28T21:31:21Z,"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE",@angular/platform-server,20.0.0,20.3.31,,HIGH,CWE-400;CWE-835,
+CVE-2026-101895,2026-09-28T21:31:21Z,"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE",@angular/platform-server,21.0.0,21.2.23,,HIGH,CWE-400;CWE-835,
+CVE-2026-101895,2026-09-28T21:31:21Z,"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE",@angular/platform-server,22.0.0,22.1.6,,HIGH,CWE-400;CWE-835,
+CVE-2026-101896,2026-09-30T15:40:47Z,"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",@angular/router,0,,19.2.25,HIGH,CWE-400;CWE-770,
+CVE-2026-101896,2026-09-30T15:40:47Z,"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",@angular/router,20.0.0,20.3.32,,HIGH,CWE-400;CWE-770,
+CVE-2026-101896,2026-09-30T15:40:47Z,"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",@angular/router,21.0.0,21.2.24,,HIGH,CWE-400;CWE-770,
+CVE-2026-101896,2026-09-30T15:40:47Z,"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",@angular/router,22.0.0,22.2.0,,HIGH,CWE-400;CWE-770,
+CVE-2026-101898,2026-09-30T15:02:14Z,"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls",axios,1.13.0,1.20.0,,HIGH,CWE-918,
+CVE-2026-101899,2026-09-30T15:32:30Z,"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges",axios,1.15.0,1.20.0,,MODERATE,CWE-693,
+CVE-2026-101900,2026-09-30T15:34:46Z,"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders",axios,1.12.0,1.20.0,,MODERATE,CWE-1321;CWE-693;CWE-74,
+CVE-2026-101901,2026-09-30T15:01:07Z,"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization",axios,1.13.0,1.20.0,,HIGH,CWE-400,
+CVE-2026-101902,2026-09-30T15:12:49Z,"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method",axios,0.27.2,0.34.0,,MODERATE,CWE-1321,
+CVE-2026-101902,2026-09-30T15:12:49Z,"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method",axios,1.0.0,1.20.0,,MODERATE,CWE-1321,
+CVE-2026-101903,2026-09-30T15:03:21Z,"Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)",axios,1.16.1,1.20.0,,HIGH,CWE-1333,
+CVE-2026-101904,2026-09-30T15:35:14Z,"Axios: Header Injection via Inherited headers After Minimal Interceptor",axios,1.0.0,1.20.0,,MODERATE,CWE-1321;CWE-74,
+CVE-2026-101905,2026-09-30T15:32:51Z,"Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection",axios,1.15.2,1.20.0,,HIGH,CWE-1321;CWE-441,
+CVE-2026-101906,2026-09-30T15:03:02Z,"Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location",axios,1.15.0,1.20.0,,HIGH,CWE-1333;CWE-400,
+CVE-2026-101907,2026-09-30T15:31:58Z,"Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF",axios,1.17.0,1.20.0,,HIGH,CWE-441;CWE-601,
+CVE-2026-101908,2026-09-30T15:13:16Z,"Axios: Prototype pollution gadget in fetch adapter can alter outbound requests",axios,1.7.0,1.20.0,,MODERATE,CWE-1321,
+CVE-2026-101909,2026-09-30T15:02:45Z,"Axios: Prototype Pollution Gadget in axios toFormData Options",axios,0.28.0,0.34.0,,HIGH,CWE-1321,
+CVE-2026-101909,2026-09-30T15:02:45Z,"Axios: Prototype Pollution Gadget in axios toFormData Options",axios,1.15.1,1.20.0,,HIGH,CWE-1321,
+CVE-2026-101910,2026-09-28T20:43:03Z,"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass",ip-address,10.2.0,10.5.1,,MODERATE,CWE-918,
+CVE-2026-101911,2026-09-29T23:46:39Z,"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process",ip-address,0,10.7.1,,MODERATE,CWE-400;CWE-770,
+CVE-2026-101912,2026-09-29T23:46:52Z,"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range",ip-address,0,10.7.1,,MODERATE,CWE-697;CWE-843,
+CVE-2026-101913,2026-09-28T20:43:55Z,"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts",ip-address,0,10.5.1,,MODERATE,CWE-697;CWE-918,
+CVE-2026-101914,2026-09-28T19:43:51Z,"@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches",@grpc/grpc-js-xds,0,1.13.1,,MODERATE,CWE-187;CWE-863,
+CVE-2026-101914,2026-09-28T19:43:51Z,"@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches",@grpc/grpc-js-xds,1.14.0,1.14.1,,MODERATE,CWE-187;CWE-863,
+CVE-2026-101915,2026-09-30T15:35:41Z,"@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages",@grpc/grpc-js,0,1.13.6,,LOW,CWE-550,
+CVE-2026-101915,2026-09-30T15:35:41Z,"@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages",@grpc/grpc-js,1.14.0,1.14.5,,LOW,CWE-550,
+CVE-2026-101916,2026-09-30T15:35:53Z,"@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized",@grpc/grpc-js,0,1.13.6,,HIGH,CWE-295,
+CVE-2026-101916,2026-09-30T15:35:53Z,"@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized",@grpc/grpc-js,1.14.0,1.14.5,,HIGH,CWE-295,
+CVE-2026-102276,2026-09-29T23:44:58Z,"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",brace-expansion,0,1.1.19,,HIGH,CWE-400;CWE-674,
+CVE-2026-102276,2026-09-29T23:44:58Z,"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",brace-expansion,2.0.0,2.1.5,,HIGH,CWE-400;CWE-674,
+CVE-2026-102276,2026-09-29T23:44:58Z,"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",brace-expansion,3.0.0,3.0.7,,HIGH,CWE-400;CWE-674,
+CVE-2026-102276,2026-09-29T23:44:58Z,"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",brace-expansion,4.0.0,5.0.10,,HIGH,CWE-400;CWE-674,
+CVE-2026-102277,2026-09-29T23:45:39Z,"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",brace-expansion,0,1.1.21,,MODERATE,CWE-400;CWE-407,
+CVE-2026-102277,2026-09-29T23:45:39Z,"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",brace-expansion,2.0.0,2.1.7,,MODERATE,CWE-400;CWE-407,
+CVE-2026-102277,2026-09-29T23:45:39Z,"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",brace-expansion,3.0.0,3.0.9,,MODERATE,CWE-400;CWE-407,
+CVE-2026-102277,2026-09-29T23:45:39Z,"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",brace-expansion,4.0.0,5.0.12,,MODERATE,CWE-400;CWE-407,
+CVE-2026-102278,2026-09-29T23:45:17Z,"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",brace-expansion,0,1.1.20,,HIGH,CWE-400;CWE-674,
+CVE-2026-102278,2026-09-29T23:45:17Z,"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",brace-expansion,2.0.0,2.1.6,,HIGH,CWE-400;CWE-674,
+CVE-2026-102278,2026-09-29T23:45:17Z,"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",brace-expansion,3.0.0,3.0.8,,HIGH,CWE-400;CWE-674,
+CVE-2026-102278,2026-09-29T23:45:17Z,"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",brace-expansion,4.0.0,5.0.11,,HIGH,CWE-400;CWE-674,
+CVE-2026-102281,2026-09-29T23:54:44Z,"Nest: Remote process termination via a deeply nested microservice message pattern",@nestjs/microservices,0,11.2.4,,HIGH,CWE-248;CWE-674,
+CVE-2026-102281,2026-09-29T23:54:44Z,"Nest: Remote process termination via a deeply nested microservice message pattern",@nestjs/microservices,12.0.0,12.0.2,,HIGH,CWE-248;CWE-674,
+CVE-2026-102282,2026-09-29T18:24:57Z,"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation",adm-zip,0,0.6.1,,HIGH,CWE-732,
+CVE-2026-102599,2026-09-29T23:44:33Z,"Socket.IO: Engine.IO Protocol Revision Mismatch DoS",engine.io,6.6.0,6.6.10,,HIGH,CWE-248,
+CVE-2026-102672,2026-09-29T18:06:59Z,"Electron: Local race condition in Squirrel.Mac update installation on macOS",electron,0,39.8.10,,MODERATE,CWE-367,
+CVE-2026-102672,2026-09-29T18:06:59Z,"Electron: Local race condition in Squirrel.Mac update installation on macOS",electron,40.0.0-alpha.1,41.10.5,,MODERATE,CWE-367,
+CVE-2026-102672,2026-09-29T18:06:59Z,"Electron: Local race condition in Squirrel.Mac update installation on macOS",electron,42.0.0-alpha.1,42.0.0-beta.2,,MODERATE,CWE-367,
+CVE-2026-102673,2026-09-29T18:05:34Z,"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab",electron,0,41.10.4,,HIGH,CWE-346;CWE-693,
+CVE-2026-102673,2026-09-29T18:05:34Z,"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab",electron,42.0.0-alpha.1,42.5.2,,HIGH,CWE-346;CWE-693,
+CVE-2026-102673,2026-09-29T18:05:34Z,"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab",electron,43.0.0-alpha.1,43.0.0,,HIGH,CWE-346;CWE-693,
+CVE-2026-102674,2026-09-29T18:05:11Z,"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions",electron,0,41.10.6,,HIGH,CWE-266;CWE-693,
+CVE-2026-102674,2026-09-29T18:05:11Z,"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions",electron,42.0.0-alpha.1,42.9.2,,HIGH,CWE-266;CWE-693,
+CVE-2026-102674,2026-09-29T18:05:11Z,"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions",electron,43.0.0-alpha.1,43.4.1,,HIGH,CWE-266;CWE-693,
+CVE-2026-102674,2026-09-29T18:05:11Z,"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions",electron,44.0.0-alpha.1,44.0.0-beta.5,,HIGH,CWE-266;CWE-693,
+CVE-2026-102675,2026-09-29T18:04:24Z,"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled",electron,0,41.10.6,,HIGH,CWE-346,
+CVE-2026-102675,2026-09-29T18:04:24Z,"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled",electron,42.0.0-alpha.1,42.9.2,,HIGH,CWE-346,
+CVE-2026-102675,2026-09-29T18:04:24Z,"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled",electron,43.0.0-alpha.1,43.4.1,,HIGH,CWE-346,
+CVE-2026-102675,2026-09-29T18:04:24Z,"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled",electron,44.0.0-alpha.1,44.0.0-beta.5,,HIGH,CWE-346,
+CVE-2026-102676,2026-09-29T18:02:18Z,"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions",electron,0,41.10.6,,HIGH,CWE-1188;CWE-269,
+CVE-2026-102676,2026-09-29T18:02:18Z,"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions",electron,42.0.0-alpha.1,42.9.2,,HIGH,CWE-1188;CWE-269,
+CVE-2026-102676,2026-09-29T18:02:18Z,"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions",electron,43.0.0-alpha.1,43.4.1,,HIGH,CWE-1188;CWE-269,
+CVE-2026-102676,2026-09-29T18:02:18Z,"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions",electron,44.0.0-alpha.1,44.0.0-beta.5,,HIGH,CWE-1188;CWE-269,
+CVE-2026-102677,2026-09-29T18:02:01Z,"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer",electron,42.3.3,42.10.0,,HIGH,CWE-20;CWE-345,
+CVE-2026-102677,2026-09-29T18:02:01Z,"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer",electron,43.0.0-beta.1,43.5.0,,HIGH,CWE-20;CWE-345,
+CVE-2026-102677,2026-09-29T18:02:01Z,"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer",electron,44.0.0-alpha.1,44.0.0-beta.6,,HIGH,CWE-20;CWE-345,
 CVE-2026-10281,2026-06-01T21:30:42Z,"Claw Orchestrator is missing authentication for the component API Endpoint","@enderfga/claw-orchestrator",0,3.5.6,,MODERATE,CWE-287,
 CVE-2026-10291,2026-06-02T00:31:57Z,"Claw Orchestrator has inefficient regular expression complexity via validateRegex()","@enderfga/claw-orchestrator",0,3.7.1,,MODERATE,CWE-1333;CWE-400,
+CVE-2026-102983,2026-09-30T23:40:12Z,"Astro: Netlify Image CDN allowlist bypass enables SSRF",@astrojs/netlify,5.2.0,8.2.4,,MODERATE,CWE-625;CWE-918,
+CVE-2026-102984,2026-09-30T23:29:40Z,"Astro: Malformed port in the Host header can crash the Node adapter",@astrojs/node,0,11.1.3,,HIGH,CWE-248,
+CVE-2026-102990,2026-10-01T14:42:42Z,"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)",basic-ftp,0,6.2.1,,HIGH,CWE-1333,
+CVE-2026-102992,2026-10-01T15:03:33Z,"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env",piscina,0,4.9.4,,CRITICAL,CWE-1321,
+CVE-2026-102992,2026-10-01T15:03:33Z,"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env",piscina,5.0.0,5.3.2,,CRITICAL,CWE-1321,
+CVE-2026-102992,2026-10-01T15:03:33Z,"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env",piscina,6.0.0-rc.1,6.0.0-rc.5,,CRITICAL,CWE-1321,
+CVE-2026-104861,2026-10-02T23:18:02Z,"probe-image-size: Quadratic-time Denial of Service in the SVG Parser",probe-image-size,0,7.4.0,,HIGH,CWE-1333;CWE-400,
 CVE-2026-10690,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to SSRF","@wonderwhy-er/desktop-commander",0,,0.2.37,LOW,CWE-918,
 CVE-2026-10691,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption","@wonderwhy-er/desktop-commander",0,0.2.39,,LOW,CWE-400,
 CVE-2026-10732,2026-06-05T09:33:46Z,"decompress: Arbitrary File Write via Archive Extraction (Zip Slip)",decompress,0,,4.2.1,MODERATE,CWE-22;CWE-29,
@@ -4564,9 +4645,14 @@ CVE-2026-12151,2026-06-19T14:22:01Z,"undici WebSocket client vulnerable to denia
 CVE-2026-12208,2026-06-15T03:30:32Z,"jsonata: Function Binding Prototype Pollution via hasOwnProperty Override",jsonata,0,1.8.8,,MODERATE,CWE-94,
 CVE-2026-12208,2026-06-15T03:30:32Z,"jsonata: Function Binding Prototype Pollution via hasOwnProperty Override",jsonata,2.0.0,2.2.1,,MODERATE,CWE-94,
 CVE-2026-1245,2026-01-20T21:31:34Z,"binary-parser library has a code injection vulnerability",binary-parser,0,2.3.0,,MODERATE,CWE-94,
+CVE-2026-12537,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0,0.39.1,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
+CVE-2026-12537,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0.40.0-preview.2,0.40.0-preview.3,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
 CVE-2026-12590,2026-07-20T23:23:26Z,"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",body-parser,0,1.20.6,,LOW,CWE-770,
 CVE-2026-12590,2026-07-20T23:23:26Z,"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",body-parser,2.0.0,2.3.0,,LOW,CWE-770,
 CVE-2026-12644,2026-06-19T06:31:56Z,"ts-deepmerge: Prototype Method Override leads to DoS",ts-deepmerge,0,8.0.0,,MODERATE,CWE-248,
+CVE-2026-12866,2026-06-23T06:30:41Z,"expr-eval vulnerable to Code Execution",expr-eval,0,,2.0.2,CRITICAL,CWE-94,
+CVE-2026-12957,2026-09-24T19:13:53Z,"Language Servers for AWS Vulnerable to Arbitrary Code Execution",@aws/lsp-codewhisperer,0,0.0.113,,HIGH,CWE-732,
+CVE-2026-12958,2026-09-24T19:15:39Z,"Language Servers for AWS vulnerable to arbitrary file write",@aws/lsp-codewhisperer,0,0.0.117,,HIGH,CWE-61,
 CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,0,1.1.16,,HIGH,CWE-400;CWE-407,
 CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,2.0.0,2.1.2,,HIGH,CWE-400;CWE-407,
 CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,3.0.0,5.0.7,,HIGH,CWE-400;CWE-407,
@@ -4588,6 +4674,7 @@ CVE-2026-14643,2026-08-03T19:32:12Z,"undici vulnerable to cross-user information
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,0,1.123.17,,CRITICAL,CWE-95,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,2.0.0,2.4.5,,CRITICAL,CWE-95,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,2.5.0,2.5.1,,CRITICAL,CWE-95,
+CVE-2026-14802,2026-07-06T09:30:27Z," react-dev-utils openBrowser permits command injection on macOS",react-dev-utils,0,,5.0.1,MODERATE,CWE-77,
 CVE-2026-15074,2026-07-24T16:43:21Z,"@fastify/static vulnerable to route guard bypass via path traversal",@fastify/static,0,10.1.1,,HIGH,CWE-22,
 CVE-2026-1513,2026-01-28T03:30:30Z,"billboard.js is vulnerable to XSS during chart option binding",billboard.js,0,3.18.0,,HIGH,CWE-79,
 CVE-2026-15157,2026-08-03T19:33:53Z,"undici vulnerable to CRLF Injection via blob-like body 'type' property",undici,0,6.28.0,,MODERATE,CWE-93,
@@ -4618,11 +4705,22 @@ CVE-2026-16729,2026-08-03T19:30:52Z,"undici vulnerable to cookie attribute injec
 CVE-2026-16729,2026-08-03T19:30:52Z,"undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields",undici,8.0.0,8.9.0,,MODERATE,CWE-74,
 CVE-2026-16732,2026-09-02T15:14:06Z,"fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count",fastify,5.8.3,5.12.1,,MODERATE,CWE-348,
 CVE-2026-1721,2026-02-13T03:31:23Z,"Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler",agents,0,0.3.10,,MODERATE,CWE-79,
+CVE-2026-17495,2026-09-29T23:46:02Z,"moment vulnerable to Path Traversal via crafted non-string locale name",moment,2.29.2,2.31.0,,MODERATE,CWE-27,
 CVE-2026-1774,2026-02-10T18:30:38Z,"CASL Ability is Vulnerable to Prototype Pollution",@casl/ability,2.4.0,6.7.5,,CRITICAL,CWE-1321,
+CVE-2026-18149,2026-09-29T18:22:34Z,"undici vulnerable to Denial of Service via orphaned RetryHandler response body",undici,7.11.0,7.29.1,,MODERATE,CWE-772,
+CVE-2026-18149,2026-09-29T18:22:34Z,"undici vulnerable to Denial of Service via orphaned RetryHandler response body",undici,8.0.0,8.10.2,,MODERATE,CWE-772,
 CVE-2026-18446,2026-08-03T19:16:43Z,"fast-uri vulnerable to host confusion via backslash authority introducer",fast-uri,0,2.4.4,,HIGH,CWE-436,
 CVE-2026-18446,2026-08-03T19:16:43Z,"fast-uri vulnerable to host confusion via backslash authority introducer",fast-uri,3.0.0,3.1.5,,HIGH,CWE-436,
 CVE-2026-18446,2026-08-03T19:16:43Z,"fast-uri vulnerable to host confusion via backslash authority introducer",fast-uri,4.0.0,4.1.2,,HIGH,CWE-436,
 CVE-2026-18504,2026-09-02T15:13:23Z,"fastify vulnerable to schema validation bypass via root primitive coercion mismatch",fastify,0,5.12.1,,MODERATE,CWE-20,
+CVE-2026-18540,2026-09-29T18:22:07Z,"undici vulnerable to downstream response splitting via retry interceptor",undici,0,6.28.1,,LOW,CWE-444,
+CVE-2026-18540,2026-09-29T18:22:07Z,"undici vulnerable to downstream response splitting via retry interceptor",undici,7.0.0,7.29.1,,LOW,CWE-444,
+CVE-2026-18540,2026-09-29T18:22:07Z,"undici vulnerable to downstream response splitting via retry interceptor",undici,8.0.0,8.10.2,,LOW,CWE-444,
+CVE-2026-19481,2026-10-02T23:16:36Z,"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header",@fastify/busboy,1.0.0,3.2.1,,HIGH,CWE-754,
+CVE-2026-19484,2026-10-02T23:16:17Z,"@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary",@fastify/busboy,3.1.0,3.2.1,,HIGH,CWE-1322;CWE-835,
+CVE-2026-19534,2026-09-29T18:21:33Z,"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",undici,6.7.0,6.28.1,,HIGH,CWE-248;CWE-252,
+CVE-2026-19534,2026-09-29T18:21:33Z,"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",undici,7.0.0,7.29.1,,HIGH,CWE-248;CWE-252,
+CVE-2026-19534,2026-09-29T18:21:33Z,"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",undici,8.0.0,8.10.2,,HIGH,CWE-248;CWE-252,
 CVE-2026-19693,2026-08-17T15:30:40Z,"extract-zip allows arbitrary file writes through symlink archive entries",extract-zip,0,,2.0.1,HIGH,CWE-22,
 CVE-2026-2130,2026-02-08T03:30:27Z,"mcp-maigret vulnerable to command injection",mcp-maigret,0,1.0.13,,MODERATE,CWE-74;CWE-77,
 CVE-2026-21440,2026-01-02T18:58:32Z,"AdonisJS Path Traversal in Multipart File Handling",@adonisjs/bodyparser,0,10.1.2,,CRITICAL,CWE-22,
@@ -7333,18 +7431,34 @@ CVE-2026-56268,2026-05-20T15:45:19Z,"Flowise: Cross-Workspace Chatflow Disclosur
 CVE-2026-56269,2026-04-16T21:22:36Z,"Flowise: Weak Default Token Hash Secret",flowise,0,3.1.0,,MODERATE,CWE-798,
 CVE-2026-56270,2026-04-16T21:20:05Z,"Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request",flowise,0,3.1.0,,MODERATE,CWE-306;CWE-312,
 CVE-2026-56272,2026-03-05T21:54:31Z,"Flowise has Insufficient Password Salt Rounds",flowise,0,3.0.13,,MODERATE,CWE-328;CWE-916,
+CVE-2026-56275,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise,0,3.1.0,,MODERATE,CWE-918,
+CVE-2026-56275,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise-components,0,3.1.0,,MODERATE,CWE-918,
+CVE-2026-56301,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,3.18.0,3.21.7,,MODERATE,CWE-276,
+CVE-2026-56301,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
 CVE-2026-56317,2026-06-16T23:38:47Z,"Cross-site scripting via <NoScript> slot content in Nuxt's head components",nuxt,0,3.21.7,,LOW,CWE-79,
 CVE-2026-56317,2026-06-16T23:38:47Z,"Cross-site scripting via <NoScript> slot content in Nuxt's head components",nuxt,4.0.0,4.4.7,,LOW,CWE-79,
-CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,3.5.0,3.21.7,,MODERATE,CWE-79;CWE-601,
-CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,4.0.0,4.4.7,,MODERATE,CWE-79;CWE-601,
+CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,3.5.0,3.21.7,,MODERATE,CWE-601;CWE-79,
+CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,4.0.0,4.4.7,,MODERATE,CWE-601;CWE-79,
 CVE-2026-56348,2026-05-19T16:17:43Z,"n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass",n8n,0,2.20.0,,MODERATE,CWE-918,
 CVE-2026-56351,2026-02-26T15:56:31Z,"n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes",n8n,0,2.4.0,,MODERATE,CWE-89,
 CVE-2026-56357,2026-02-26T15:58:34Z,"n8n: Webhook Forgery on Github Webhook Trigger",n8n,0,1.123.15,,MODERATE,CWE-290,
 CVE-2026-56357,2026-02-26T15:58:34Z,"n8n: Webhook Forgery on Github Webhook Trigger",n8n,2.0.0,2.5.0,,MODERATE,CWE-290,
 CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,0,1.123.25,,MODERATE,CWE-79,
 CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,2.0.0-rc.0,2.11.2,,MODERATE,CWE-79,
+CVE-2026-56669,2026-09-23T21:54:50Z,"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict",elysia,0,1.4.29,,HIGH,CWE-407;CWE-436,
+CVE-2026-56675,2026-09-23T18:12:26Z,"9router /v1 APIs has unauthenticated access via reverse proxy locality collapse",9router,0,0.5.2,,HIGH,"CWE-287;CWE-290;CWE-306;CWE-441",
+CVE-2026-56676,2026-09-23T18:12:28Z,"9router: Image prefetch DNS rebinding allows SSRF to internal services",9router,0,0.5.2,,HIGH,CWE-367;CWE-918,
 CVE-2026-56677,2026-08-17T21:58:43Z,"9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint",9router,0,,0.5.4,HIGH,CWE-306;CWE-918,
+CVE-2026-56678,2026-09-23T18:12:30Z,"9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding",9router,0,0.5.6,,MODERATE,CWE-20;CWE-918,
+CVE-2026-56679,2026-09-23T18:12:33Z,"9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade",9router,0,0.5.4,,HIGH,CWE-915,
+CVE-2026-56681,2026-09-22T16:34:06Z,"9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header",9router,0,0.5.8,,HIGH,CWE-807,
+CVE-2026-56682,2026-09-22T16:34:18Z,"9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header",9router,0,0.5.8,,MODERATE,CWE-307;CWE-807,
+CVE-2026-56744,2026-09-24T19:32:00Z,"`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction","@bsv/wallet-toolbox-client",1.1.47,2.4.0,,HIGH,CWE-1288,
+CVE-2026-56744,2026-09-24T19:32:00Z,"`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction","@bsv/wallet-toolbox-mobile",1.3.21,2.4.0,,HIGH,CWE-1288,
+CVE-2026-56744,2026-09-24T19:32:00Z,"`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction",@bsv/wallet-toolbox,1.1.47,2.4.0,,HIGH,CWE-1288,
 CVE-2026-56761,2026-04-16T01:02:24Z,"hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR",hono,0,4.12.14,,MODERATE,CWE-79,
+CVE-2026-56762,2026-04-08T00:17:02Z,"Hono missing validation of cookie name on write path in setCookie()",hono,0,4.12.12,,MODERATE,CWE-113;CWE-20,
+CVE-2026-56763,2026-03-11T00:31:47Z,"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })",hono,0,4.12.7,,MODERATE,CWE-1321,
 CVE-2026-56812,2026-09-03T20:30:33Z,"Phoenix: Presence keys colliding with `Object.prototype` members break existence checks",phoenix,1.2.0-rc.0,1.5.15,,MODERATE,CWE-754,
 CVE-2026-56812,2026-09-03T20:30:33Z,"Phoenix: Presence keys colliding with `Object.prototype` members break existence checks",phoenix,1.6.0-rc.0,1.6.17,,MODERATE,CWE-754,
 CVE-2026-56812,2026-09-03T20:30:33Z,"Phoenix: Presence keys colliding with `Object.prototype` members break existence checks",phoenix,1.7.0-rc.0,1.7.24,,MODERATE,CWE-754,
@@ -7359,6 +7473,7 @@ CVE-2026-57138,2026-06-18T14:26:32Z,"npm PraisonAI codeMode sandbox escape via F
 CVE-2026-57139,2026-06-18T14:26:48Z,"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call",praisonai,1.5.0,1.7.2,,CRITICAL,CWE-1188;CWE-306;CWE-862,
 CVE-2026-57140,2026-06-18T14:26:42Z,"npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation",praisonai,1.6.0,1.7.2,,CRITICAL,CWE-306,
 CVE-2026-57141,2026-06-18T14:26:37Z,"PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool",praisonai,0,1.7.2,,CRITICAL,CWE-94,
+CVE-2026-57439,2026-09-24T19:24:30Z,"CyberChef: Prototype pollution in Series Chart operation",cyberchef,0,11.2.0,,MODERATE,CWE-1321;CWE-79,
 CVE-2026-57441,2026-06-18T14:30:43Z,"MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence",@bitbonsai/mcpvault,0,0.11.4,,MODERATE,CWE-178;CWE-41,
 CVE-2026-57442,2026-06-19T21:42:24Z,"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested",@bitbonsai/mcpvault,0,0.11.5,,MODERATE,CWE-22;CWE-538,
 CVE-2026-57494,2026-06-18T17:20:55Z,"AgenticMail: Cross-agent task authorization bypass in AgenticMail API",@agenticmail/api,0,0.9.64,,HIGH,CWE-639;CWE-862,
@@ -7370,6 +7485,10 @@ CVE-2026-5758,2026-04-15T18:31:58Z,"Mafintosh's protocol-buffers-schema is vulne
 CVE-2026-58191,2026-09-01T18:54:53Z,"Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes",@appium/base-driver,0,10.7.0,,MODERATE,CWE-489;CWE-79,
 CVE-2026-58230,2026-08-11T03:31:56Z,"SAP Approuter has an Information Disclosure vulnerability",@sap/approuter,0,23.0.0,,HIGH,CWE-601,
 CVE-2026-58263,2026-07-31T19:12:40Z,"Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier",jodit,0,4.12.28,,HIGH,CWE-79;CWE-83,
+CVE-2026-58269,2026-09-22T14:46:30Z,"Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`",@sync-in/server,0,2.4.0,,HIGH,CWE-288,
+CVE-2026-58270,2026-09-22T14:47:56Z,"Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`",@sync-in/server,0,2.4.0,,MODERATE,CWE-1333,
+CVE-2026-58271,2026-09-22T14:44:43Z,"@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`",@sync-in/server,0,2.4.0,,MODERATE,CWE-307,
+CVE-2026-58272,2026-09-22T14:49:23Z,"Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)",@sync-in/server,0,2.4.1,,MODERATE,CWE-208,
 CVE-2026-5831,2026-04-09T03:31:14Z,"Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts",taskflow-ai,0,2.1.9,,MODERATE,CWE-77,
 CVE-2026-5832,2026-04-09T03:31:15Z,"api-lab-mcp vulnerable to SSRF",api-lab-mcp,0,,0.2.1,MODERATE,CWE-918,
 CVE-2026-5833,2026-04-09T06:30:27Z,"awwaiid mcp-server-taskwarrior vulnerable to command injection",mcp-server-taskwarrior,0,,1.0.1,LOW,CWE-74,
@@ -7383,6 +7502,7 @@ CVE-2026-59149,2026-09-11T22:04:32Z,"@Mockoon/commons-server: Path traversal in
 CVE-2026-59149,2026-09-11T22:04:32Z,"@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)",@mockoon/commons-server,0,9.7.0,,MODERATE,CWE-22;CWE-23,
 CVE-2026-59158,2026-09-09T23:47:44Z,"Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients",nuxt-ollama,1.2.26,1.3.1,,HIGH,CWE-522,
 CVE-2026-59160,2026-09-09T23:47:55Z,"@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run",@yeger/turbo-graph,0,2.8.12,,HIGH,CWE-306,
+CVE-2026-59167,2026-09-24T14:57:55Z,"SunEditor: Critical XSS vulnerability - sanitizer bypass",suneditor,0,2.47.11,,CRITICAL,CWE-79,
 CVE-2026-59176,2026-09-09T23:49:20Z,"functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import",functype-mcp-server,0,1.4.4,,HIGH,CWE-829,
 CVE-2026-59179,2026-09-09T23:51:59Z,"@openhop/server: Path Traversal in Flow ID File Operations",@openhop/server,0,0.3.6,,HIGH,CWE-22,
 CVE-2026-59206,2026-07-22T21:57:21Z,"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration",n8n,0,1.123.61,,HIGH,CWE-1321,
@@ -7406,6 +7526,7 @@ CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via
 CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,2.28.0,2.28.1,,MODERATE,CWE-639,
 CVE-2026-59710,2026-07-07T00:30:59Z,"showdown allows stored cross-site scripting through table header ID injection",showdown,0,,2.1.0,MODERATE,CWE-79,
 CVE-2026-59711,2026-07-06T21:30:43Z,"showdown metadata title handling allows cross-site scripting",showdown,0,,2.1.0,MODERATE,CWE-79,
+CVE-2026-59723,2026-09-24T19:48:34Z,"Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)",cline,0,3.0.30,,HIGH,CWE-346,
 CVE-2026-59724,2026-08-31T21:28:12Z,"Socket.IO: Engine.IO WebTransport SID DoS",engine.io,6.5.0,6.6.7,,HIGH,CWE-20,
 CVE-2026-59725,2026-07-20T21:49:54Z,"Socket.IO: Engine.IO Polling Transport Connection Exhaustion",engine.io,4.1.0,6.6.7,,HIGH,CWE-404,
 CVE-2026-59727,2026-07-20T23:21:02Z,"Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands",astro,3.10.0,7.0.4,,LOW,CWE-116;CWE-79;CWE-83,
@@ -7456,9 +7577,17 @@ CVE-2026-61556,2026-09-03T17:45:26Z,"LiquidJS has an infinite loop vulnerability
 CVE-2026-61559,2026-09-15T20:57:28Z,"@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery",@zereight/mcp-gitlab,0.0.1,2.1.27,,CRITICAL,CWE-918,
 CVE-2026-61560,2026-09-16T13:48:28Z,"@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover",@zereight/mcp-gitlab,0,2.1.27,,CRITICAL,CWE-22,
 CVE-2026-61568,2026-09-15T20:54:55Z,"@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport",@zereight/mcp-gitlab,0,2.1.30,,CRITICAL,CWE-350,
+CVE-2026-61612,2026-09-22T14:51:20Z,"@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509","@aborruso/ckan-mcp-server",0,0.4.108,,MODERATE,CWE-918,
+CVE-2026-61647,2026-09-22T14:43:26Z,"@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory","@roomi-fields/notebooklm-mcp",1.6.0,2.0.3,,HIGH,CWE-22;CWE-73,
+CVE-2026-61685,2026-09-23T21:51:59Z,"ReactPress has SQL injection via dynamic column names in TypeORM query builders",@fecommunity/reactpress,0,3.7.0,,HIGH,CWE-89,
 CVE-2026-61704,2026-09-02T21:29:57Z,"link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897",link-preview-js,0,4.0.4,,HIGH,CWE-918,
+CVE-2026-61742,2026-09-24T19:36:57Z,"DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution",@bytebase/dbhub,0,0.22.5,,CRITICAL,CWE-306;CWE-346,
+CVE-2026-61782,2026-09-24T19:42:10Z,"@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata",@rsdoctor/rspack-plugin,0,1.5.16,,HIGH,CWE-200,
+CVE-2026-61784,2026-09-24T19:33:23Z,"xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS",xhtml-purifier,0,0.4.3,,MODERATE,CWE-116;CWE-79,
+CVE-2026-61788,2026-09-24T19:37:59Z,"@bytebase/dbhub's read-only mode does not prevent database writes",@bytebase/dbhub,0,0.22.6,,HIGH,CWE-184;CWE-636;CWE-863,
 CVE-2026-61793,2026-09-17T14:48:55Z,"Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter",nuxt-og-image,6.0.2,6.7.0,,MODERATE,"CWE-1188;CWE-20;CWE-441;CWE-749;CWE-918",
 CVE-2026-61824,2026-08-21T20:54:56Z,"Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors",defuddle,0,0.19.1,,HIGH,CWE-116;CWE-79,
+CVE-2026-61834,2026-09-28T14:01:15Z,"scim-patch: Mutation of Inherited Built-in Method Objects",scim-patch,0,0.9.2,,MODERATE,CWE-1321;CWE-915,
 CVE-2026-61835,2026-07-20T21:47:17Z,"Directus: SSRF Protection Bypass via 0.0.0.0 in File Import",directus,0,12.0.0,,HIGH,CWE-918,
 CVE-2026-61836,2026-07-20T21:48:15Z,"Directus: Authorization-dependent response served from unsegmented cache key",directus,0,12.0.0,,HIGH,CWE-524;CWE-639,
 CVE-2026-6216,2026-04-13T21:30:45Z,"DbGate has cross site scripting via the  SVG Icon String Handler component",dbgate-web,0,7.1.5,,LOW,CWE-79,
@@ -7467,9 +7596,11 @@ CVE-2026-62680,2026-09-02T14:54:48Z,"Orval: Generation-time SSRF + remote/local
 CVE-2026-62681,2026-09-03T19:17:32Z,"Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)",orval,0,8.21.0,,CRITICAL,CWE-116;CWE-1336;CWE-94,
 CVE-2026-62682,2026-09-03T19:06:52Z,"Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)",orval,0,8.21.0,,CRITICAL,CWE-116;CWE-1336;CWE-94,
 CVE-2026-6270,2026-04-16T22:29:04Z,"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes",@fastify/middie,0,9.3.2,,CRITICAL,CWE-436,
+CVE-2026-62985,2026-09-22T19:54:18Z,"request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process",request-filtering-agent,0,3.2.1,,HIGH,CWE-248,
 CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,0,7.5.2,,MODERATE,CWE-918,
 CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,7.6.0,7.6.5,,MODERATE,CWE-918,
 CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,8.0.0,8.0.2,,MODERATE,CWE-918,
+CVE-2026-63116,2026-09-22T19:56:34Z,"deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes",@deepstream/server,10.1.0,10.1.1,,HIGH,CWE-862,
 CVE-2026-63123,2026-08-19T21:56:36Z,"Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root",@tinacms/cli,0,2.5.2,,MODERATE,CWE-352,
 CVE-2026-63188,2026-08-19T20:24:06Z,"logto-tunnel serves files outside --experience-path via path traversal",@logto/tunnel,0,0.3.9,,HIGH,CWE-22,
 CVE-2026-6321,2026-05-08T17:15:09Z,"fast-uri vulnerable to path traversal via percent-encoded dot segments",fast-uri,0,2.4.1,,HIGH,CWE-22,
@@ -7482,7 +7613,7 @@ CVE-2026-63376,2026-09-03T20:55:32Z,"toml-node: Prototype Pollution Leads to `Ob
 CVE-2026-63397,2026-07-16T21:30:38Z,"Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema",@genql/cli,0,6.3.4,,HIGH,CWE-116,
 CVE-2026-63421,2026-08-21T20:55:11Z,"Keystone vulnerable to `graphql.maxTake` bypass with negative `take`",@keystone-6/core,0,6.5.3,,HIGH,CWE-20;CWE-480,
 CVE-2026-63459,2026-09-17T14:49:34Z,"Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions",@vendure/dashboard,0,3.6.5,,HIGH,CWE-79,
-CVE-2026-63460,2026-09-17T14:49:56Z,"Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends",vendure/core,0,3.6.5,,HIGH,CWE-1333,
+CVE-2026-63460,2026-09-17T14:49:56Z,"Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends",@vendure/core,0,3.6.5,,HIGH,CWE-1333,
 CVE-2026-63461,2026-09-17T14:50:02Z,"Vendure: Shop API list queries can return non-public entities when filterOperator is OR",@vendure/core,1.0.0,3.6.5,,MODERATE,CWE-200,
 CVE-2026-63462,2026-08-21T19:14:37Z,"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter",unleash-server,0,7.5.2,,HIGH,CWE-674,
 CVE-2026-63462,2026-08-21T19:14:37Z,"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter",unleash-server,7.6.0,7.6.5,,HIGH,CWE-674,
@@ -7491,6 +7622,8 @@ CVE-2026-63466,2026-08-21T19:14:52Z,"Unleash: Global Mustache.escape override di
 CVE-2026-63472,2026-09-17T14:50:22Z,"Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification",@vendure/core,0,3.7.0,,CRITICAL,CWE-287,
 CVE-2026-63506,2026-09-17T14:59:00Z,"Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site",@tinacms/auth,0,1.1.4,,HIGH,CWE-639,
 CVE-2026-63506,2026-09-17T14:59:00Z,"Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site",next-tinacms-azure,0,15.0.1,,HIGH,CWE-639,
+CVE-2026-63627,2026-09-22T20:34:17Z,"mppx: Gas Draining with padding",mppx,0,0.8.2,,MODERATE,CWE-20,
+CVE-2026-63628,2026-09-22T20:34:19Z,"mppx: Gas Draining with access list",mppx,0,0.8.2,,MODERATE,CWE-20,
 CVE-2026-63640,2026-08-18T18:00:16Z,"MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables",magicmirror,0,2.37.0,,MODERATE,CWE-200,
 CVE-2026-63641,2026-08-18T17:26:41Z,"MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions",magicmirror,0,2.37.0,,LOW,CWE-284,
 CVE-2026-63642,2026-08-18T17:26:46Z,"MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery",magicmirror,0,2.37.0,,MODERATE,CWE-918,
@@ -7567,6 +7700,7 @@ CVE-2026-65912,2026-04-03T03:46:07Z,"DOMPurify ADD_ATTR predicate skips URI vali
 CVE-2026-65913,2026-04-03T03:45:08Z,"DOMPurify USE_PROFILES prototype pollution allows event handlers",dompurify,0,3.3.2,,MODERATE,CWE-1321,
 CVE-2026-65914,2026-03-27T20:41:29Z,"DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",dompurify,0,3.3.2,,MODERATE,CWE-79,
 CVE-2026-6594,2026-04-20T03:34:41Z,"Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization",@brikcss/merge,0,,1.3.1,MODERATE,CWE-1321;CWE-94,
+CVE-2026-66010,2026-07-21T19:41:07Z,"DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",dompurify,0,3.4.12,,LOW,CWE-184;CWE-693;CWE-79,
 CVE-2026-66062,2026-08-07T16:50:02Z,"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header",@sveltejs/kit,0,2.70.2,,MODERATE,CWE-1333,
 CVE-2026-67213,2026-07-29T15:31:12Z,"nanoid: custom generators can loop indefinitely when size is zero",nanoid,0,3.3.18,,HIGH,CWE-835,
 CVE-2026-67213,2026-07-29T15:31:12Z,"nanoid: custom generators can loop indefinitely when size is zero",nanoid,4.0.0,5.1.6,,HIGH,CWE-835,
@@ -7860,6 +7994,7 @@ CVE-2026-73844,2026-09-03T14:49:10Z,"CKAN MCP Server: Information disclosure via
 CVE-2026-73845,2026-09-02T14:52:21Z,"CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)","@aborruso/ckan-mcp-server",0,0.4.112,,MODERATE,CWE-20;CWE-625;CWE-918,
 CVE-2026-73846,2026-09-03T14:49:22Z,"CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning","@aborruso/ckan-mcp-server",0,0.4.112,,MODERATE,CWE-345;CWE-436,
 CVE-2026-7446,2026-04-30T00:31:22Z,"mcp-server-semgrep has a Command Injection issue",mcp-server-semgrep,0,1.0.1,,MODERATE,CWE-77,
+CVE-2026-75510,2026-09-22T20:34:35Z,"Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme",@novu/js,0,3.18.0,,MODERATE,CWE-79,
 CVE-2026-75604,2026-09-08T20:51:40Z,"Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",next,13.4.0,15.5.24,,CRITICAL,CWE-22,
 CVE-2026-75604,2026-09-08T20:51:40Z,"Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",next,16.0.0,16.3.3,,CRITICAL,CWE-22,
 CVE-2026-75856,2026-09-04T18:05:12Z,"CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning",codewhale,0.8.41,0.8.64,,CRITICAL,CWE-918,
@@ -7890,11 +8025,16 @@ CVE-2026-75975,2026-09-02T15:43:30Z,"fast-uri vulnerable to server-side request
 CVE-2026-75975,2026-09-02T15:43:30Z,"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",fast-uri,3.0.0,3.1.6,,HIGH,CWE-20;CWE-918,
 CVE-2026-75975,2026-09-02T15:43:30Z,"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",fast-uri,4.0.0,4.1.3,,HIGH,CWE-20;CWE-918,
 CVE-2026-7600,2026-05-02T03:31:13Z,"yii2-mcp-server has a Command Injection Issue",yii2-mcp-server,0,,1.0.2,LOW,CWE-77,
+CVE-2026-76169,2026-09-30T23:45:34Z,"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers",fastify,4.0.0,5.12.2,,HIGH,CWE-288,
 CVE-2026-76172,2026-09-02T15:41:53Z,"fast-uri vulnerable to host confusion via percent-encoded scheme normalization",fast-uri,2.3.1,2.4.5,,HIGH,CWE-177,
 CVE-2026-76172,2026-09-02T15:41:53Z,"fast-uri vulnerable to host confusion via percent-encoded scheme normalization",fast-uri,3.0.0,3.1.6,,HIGH,CWE-177,
 CVE-2026-76172,2026-09-02T15:41:53Z,"fast-uri vulnerable to host confusion via percent-encoded scheme normalization",fast-uri,4.0.0,4.1.3,,HIGH,CWE-177,
 CVE-2026-7645,2026-05-02T18:30:27Z,"sublinear-time-solver has a Path Traversal Issue",sublinear-time-solver,0,,1.5.0,MODERATE,CWE-22,
+CVE-2026-76844,2026-09-29T16:59:18Z,"webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",webpack-dev-middleware,0,7.4.6,,HIGH,CWE-22,
+CVE-2026-76844,2026-09-29T16:59:18Z,"webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",webpack-dev-middleware,8.0.0,8.3.0,,HIGH,CWE-22,
 CVE-2026-76845,2026-08-24T15:31:51Z,"adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite",adm-zip,0.5.9,,0.6.0,MODERATE,CWE-59,
+CVE-2026-76909,2026-09-22T20:34:38Z,"Unleash: CR-approval email renders user-controlled raw HTML",unleash-server,0,8.0.3,,LOW,CWE-79,
+CVE-2026-76910,2026-09-22T20:34:40Z,"Unleash: Clone-feature lets a user copy a feature from a project they cannot read",unleash-server,0,8.0.3,,MODERATE,CWE-639,
 CVE-2026-76969,2026-09-08T03:31:13Z,"@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)",@sap/cds-mtxs,0,1.18.4,,CRITICAL,CWE-522,
 CVE-2026-76969,2026-09-08T03:31:13Z,"@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)",@sap/cds-mtxs,2.0.2,2.7.7,,CRITICAL,CWE-522,
 CVE-2026-76969,2026-09-08T03:31:13Z,"@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)",@sap/cds-mtxs,3.0.1,3.9.7,,CRITICAL,CWE-522,
@@ -7905,12 +8045,15 @@ CVE-2026-77078,2026-09-08T21:30:20Z,"multer vulnerable to Denial of Service via
 CVE-2026-77301,2026-09-18T17:18:01Z,"adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)",adm-zip,0,0.6.1,,HIGH,CWE-789,
 CVE-2026-77360,2026-09-17T14:52:37Z,"oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass",@orpc/server,0,1.14.8,,MODERATE,CWE-113,
 CVE-2026-7738,2026-05-04T09:31:09Z,"@puchunjie/doc-tools-mcp has a Path Traversal Issue",@puchunjie/doc-tools-mcp,0,,1.0.18,LOW,CWE-22,
+CVE-2026-77394,2026-09-23T21:24:11Z,"OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget",@openc3/vue-common,5.0.6,7.3.0,,HIGH,CWE-79,
 CVE-2026-77413,2026-08-21T20:57:07Z,"JSONata: Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
 CVE-2026-77413,2026-08-21T20:57:07Z,"JSONata: Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.0,,CRITICAL,CWE-94,
 CVE-2026-77414,2026-08-21T20:58:01Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
 CVE-2026-77414,2026-08-21T20:58:01Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.1,,CRITICAL,CWE-94,
 CVE-2026-77415,2026-08-21T21:04:19Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
 CVE-2026-77415,2026-08-21T21:04:19Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.1,,CRITICAL,CWE-94,
+CVE-2026-77425,2026-09-22T20:36:39Z,"Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log",unleash-server,0,8.0.3,,MODERATE,CWE-639;CWE-863,
+CVE-2026-77426,2026-09-22T20:36:42Z,"Unleash: Missing await on permission check + cross-project IDOR in admin API",unleash-server,0,8.0.3,,HIGH,CWE-639;CWE-862,
 CVE-2026-77465,2026-09-03T20:56:13Z,"toml-node: Uncontrolled Recursion",toml,0,4.2.0,,HIGH,CWE-674,
 CVE-2026-77615,2026-09-18T13:11:59Z,"Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text",paella-core,0,1.50.6,,HIGH,CWE-79,
 CVE-2026-7768,2026-05-08T17:13:38Z,"@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth","@fastify/accepts-serializer",0,6.0.4,,HIGH,CWE-770,
@@ -7963,6 +8106,9 @@ CVE-2026-83616,2026-09-08T21:03:28Z,"xmldom: Processing Instruction Target Injec
 CVE-2026-83617,2026-09-08T21:03:17Z,"xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator",@xmldom/xmldom,0.9.11,0.9.12,,HIGH,CWE-625;CWE-91,
 CVE-2026-83618,2026-09-08T21:02:25Z,"xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator",@xmldom/xmldom,0.9.10,0.9.12,,HIGH,CWE-625;CWE-91,
 CVE-2026-83619,2026-09-08T21:01:09Z,"xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser",@xmldom/xmldom,0.7.0,0.8.15,,HIGH,CWE-1333;CWE-400,
+CVE-2026-84292,2026-09-28T21:24:39Z,"fast-uri vulnerable to authority injection via an unvalidated port in serialize",fast-uri,0,2.4.6,,HIGH,CWE-116,
+CVE-2026-84292,2026-09-28T21:24:39Z,"fast-uri vulnerable to authority injection via an unvalidated port in serialize",fast-uri,3.0.0,3.1.7,,HIGH,CWE-116,
+CVE-2026-84292,2026-09-28T21:24:39Z,"fast-uri vulnerable to authority injection via an unvalidated port in serialize",fast-uri,4.0.0,4.1.4,,HIGH,CWE-116,
 CVE-2026-84363,2026-09-08T21:22:50Z,"Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials",hono,0,4.13.5,,MODERATE,CWE-444,
 CVE-2026-84364,2026-09-08T21:23:02Z,"Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion",hono,0,4.13.5,,MODERATE,CWE-400,
 CVE-2026-84365,2026-09-08T21:23:51Z,"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory",hono,0,4.13.5,,MODERATE,CWE-22,
@@ -7985,10 +8131,33 @@ CVE-2026-84373,2026-09-08T20:46:45Z,"Vitest: Path Traversal / Arbitrary File Rea
 CVE-2026-84375,2026-09-08T21:24:51Z,"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",js-yaml,3.0.0,3.15.2,,HIGH,CWE-400;CWE-407,
 CVE-2026-84375,2026-09-08T21:24:51Z,"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",js-yaml,4.0.0,4.3.2,,HIGH,CWE-400;CWE-407,
 CVE-2026-84376,2026-09-08T21:26:02Z,"Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base",astro,0,7.2.4,,MODERATE,CWE-187,
+CVE-2026-84394,2026-09-28T21:23:35Z,"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority",fast-uri,2.4.5,2.4.6,,HIGH,CWE-436,
+CVE-2026-84394,2026-09-28T21:23:35Z,"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority",fast-uri,3.1.6,3.1.7,,HIGH,CWE-436,
+CVE-2026-84394,2026-09-28T21:23:35Z,"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority",fast-uri,4.1.3,4.1.4,,HIGH,CWE-436,
+CVE-2026-84428,2026-09-30T23:44:27Z,"fastify vulnerable to header validation bypass via incomplete schema case normalization",fastify,0,5.12.2,,HIGH,CWE-178,
+CVE-2026-84469,2026-09-30T23:44:58Z,"fastify vulnerable to request validation bypass via skipped boolean false schemas",fastify,0,5.12.2,,HIGH,CWE-20,
+CVE-2026-84504,2026-09-30T23:45:45Z,"fastify vulnerable to request body replacement via an async validation result collision",fastify,0,5.12.2,,HIGH,CWE-20,
+CVE-2026-84890,2026-09-29T18:20:37Z,"undici vulnerable to Denial of Service via unbounded decompression of compressed responses",undici,7.15.0,7.29.1,,MODERATE,CWE-770,
+CVE-2026-84890,2026-09-29T18:20:37Z,"undici vulnerable to Denial of Service via unbounded decompression of compressed responses",undici,8.0.0,8.10.2,,MODERATE,CWE-770,
+CVE-2026-84933,2026-09-29T18:19:58Z,"undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches",undici,7.0.0,7.29.1,,MODERATE,CWE-200;CWE-524,
+CVE-2026-84933,2026-09-29T18:19:58Z,"undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches",undici,8.0.0,8.10.2,,MODERATE,CWE-200;CWE-524,
+CVE-2026-84947,2026-09-29T18:18:51Z,"undici vulnerable to response truncation via oversized chunked responses in the dump interceptor",undici,7.1.0,7.29.1,,LOW,CWE-20;CWE-248,
+CVE-2026-84947,2026-09-29T18:18:51Z,"undici vulnerable to response truncation via oversized chunked responses in the dump interceptor",undici,8.0.0,8.10.2,,LOW,CWE-20;CWE-248,
+CVE-2026-84961,2026-09-29T18:17:15Z,"undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool",undici,7.24.1,7.29.1,,HIGH,CWE-295,
+CVE-2026-84961,2026-09-29T18:17:15Z,"undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool",undici,8.0.0,8.10.2,,HIGH,CWE-295,
 CVE-2026-84992,2026-09-18T17:17:36Z,"md-editor-v3: XSS via fenced-code language rendering bypass",md-editor-v3,0,6.5.4,,MODERATE,CWE-79,
+CVE-2026-85008,2026-09-29T18:16:28Z,"undici vulnerable to caching and replay of unsafe HTTP method responses",undici,7.0.0,7.29.1,,LOW,CWE-345,
+CVE-2026-85008,2026-09-29T18:16:28Z,"undici vulnerable to caching and replay of unsafe HTTP method responses",undici,8.0.0,8.10.2,,LOW,CWE-345,
+CVE-2026-85014,2026-09-29T18:10:32Z,"undici vulnerable to Denial of Service via WebSocketStream unclean close",undici,7.0.0,7.29.1,,MODERATE,CWE-248;CWE-754,
+CVE-2026-85014,2026-09-29T18:10:32Z,"undici vulnerable to Denial of Service via WebSocketStream unclean close",undici,8.0.0,8.10.2,,MODERATE,CWE-248;CWE-754,
+CVE-2026-85024,2026-09-28T21:42:37Z,"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",undici,6.25.0,6.28.1,,MODERATE,CWE-248,
+CVE-2026-85024,2026-09-28T21:42:37Z,"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",undici,7.28.0,7.29.1,,MODERATE,CWE-248,
+CVE-2026-85024,2026-09-28T21:42:37Z,"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",undici,8.1.0,8.10.2,,MODERATE,CWE-248,
 CVE-2026-85061,2026-09-08T20:50:47Z,"MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip",maplibre-gl,0,6.4.1,,CRITICAL,CWE-79,
 CVE-2026-85062,2026-09-08T20:51:57Z,"Colord: Slow rejection of oversized malformed color strings",colord,0,2.9.4,,MODERATE,CWE-1333,
 CVE-2026-85063,2026-09-08T18:01:39Z,"node-csv: Prototype replacement still reachable via columns path",csv-parse,0,7.0.2,,MODERATE,CWE-1321,
+CVE-2026-85152,2026-09-29T18:15:13Z,"undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors",undici,8.10.0,8.10.2,,HIGH,CWE-346,
+CVE-2026-85393,2026-09-03T21:31:15Z,"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements",node-forge,0,,1.4.0,HIGH,CWE-347,
 CVE-2026-85715,2026-09-17T16:30:00Z,"ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion",exifreader,0,4.41.1,,HIGH,CWE-789;CWE-835,
 CVE-2026-85730,2026-09-09T18:07:11Z,"smol-toml: Denial of Service via malformed TOML documents",smol-toml,0,1.7.1,,HIGH,CWE-606;CWE-835,
 CVE-2026-86038,2026-09-17T17:29:31Z,"libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID",@libp2p/gossipsub,15.0.0,16.0.5,,HIGH,CWE-345;CWE-347,
@@ -8026,7 +8195,13 @@ CVE-2026-86084,2026-09-10T21:07:24Z,"n8n: Disabled OIDC SSO Endpoints Remain Act
 CVE-2026-86084,2026-09-10T21:07:24Z,"n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions",n8n,2.38.0,2.38.2,,MODERATE,CWE-288,
 CVE-2026-86085,2026-09-10T21:13:24Z,"n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints",n8n,0,2.37.7,,MODERATE,CWE-862,
 CVE-2026-86085,2026-09-10T21:13:24Z,"n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints",n8n,2.38.0,2.38.2,,MODERATE,CWE-862,
+CVE-2026-86250,2026-03-23T21:44:55Z,"H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,2.0.1-rc.18,,MODERATE,CWE-400,
+CVE-2026-86439,2026-09-25T19:32:05Z,"Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools",knowns,0,0.30.0,,HIGH,CWE-22;CWE-306;CWE-863,
+CVE-2026-86472,2026-09-29T23:54:25Z,"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",fast-uri,0,2.4.7,,MODERATE,CWE-178,
+CVE-2026-86472,2026-09-29T23:54:25Z,"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",fast-uri,3.0.0,3.1.8,,MODERATE,CWE-178,
+CVE-2026-86472,2026-09-29T23:54:25Z,"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",fast-uri,4.0.0,4.1.5,,MODERATE,CWE-178,
 CVE-2026-8657,2026-05-16T06:30:29Z," jsondiffpatch patch APIs are vulnerable to prototype pollution",jsondiffpatch,0,0.7.6,,HIGH,CWE-1321,
+CVE-2026-86818,2026-09-29T23:51:16Z,"fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization",fast-uri,4.1.3,4.1.5,,MODERATE,CWE-172;CWE-436,
 CVE-2026-86993,2026-09-10T21:07:45Z,"n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check",n8n,0,1.123.76,,MODERATE,CWE-862,
 CVE-2026-86993,2026-09-10T21:07:45Z,"n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check",n8n,2.0.0,2.37.7,,MODERATE,CWE-862,
 CVE-2026-86993,2026-09-10T21:07:45Z,"n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check",n8n,2.38.0,2.38.2,,MODERATE,CWE-862,
@@ -8043,6 +8218,7 @@ CVE-2026-8766,2026-05-18T00:31:36Z,"@kilocode/cli Vulnerable to Exposure of Sens
 CVE-2026-8769,2026-05-18T00:31:37Z,"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",@ai-sdk/provider-utils,0,3.0.28,,LOW,CWE-400,
 CVE-2026-8769,2026-05-18T00:31:37Z,"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",@ai-sdk/provider-utils,4.0.0-beta.10,4.0.33,,LOW,CWE-400,
 CVE-2026-8769,2026-05-18T00:31:37Z,"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",@ai-sdk/provider-utils,5.0.0-beta.0,5.0.1,,LOW,CWE-400,
+CVE-2026-87859,2026-09-28T21:33:08Z,"morgan vulnerable to Log Injection via unescaped double quote in quoted log fields",morgan,0,1.12.1,,MODERATE,CWE-117,
 CVE-2026-88056,2026-09-10T20:19:43Z,"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR",@angular/platform-server,0,,19.2.25,HIGH,CWE-918,
 CVE-2026-88056,2026-09-10T20:19:43Z,"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR",@angular/platform-server,20.0.0,20.3.30,,HIGH,CWE-918,
 CVE-2026-88056,2026-09-10T20:19:43Z,"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR",@angular/platform-server,21.0.0,21.2.22,,HIGH,CWE-918,
@@ -8055,24 +8231,49 @@ CVE-2026-88057,2026-09-10T20:18:02Z,"Angular: Sanitization bypass via directive
 CVE-2026-88057,2026-09-10T20:18:02Z,"Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",@angular/core,20.0.0,20.3.28,,MODERATE,CWE-79,
 CVE-2026-88057,2026-09-10T20:18:02Z,"Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",@angular/core,21.0.0,21.2.20,,MODERATE,CWE-79,
 CVE-2026-88057,2026-09-10T20:18:02Z,"Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",@angular/core,22.0.0,22.1.0,,MODERATE,CWE-79,
+CVE-2026-88058,2026-09-28T20:39:26Z,"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements",@angular/platform-server,0,,19.2.25,HIGH,CWE-116;CWE-79,
+CVE-2026-88058,2026-09-28T20:39:26Z,"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements",@angular/platform-server,20.0.0,20.3.30,,HIGH,CWE-116;CWE-79,
+CVE-2026-88058,2026-09-28T20:39:26Z,"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements",@angular/platform-server,21.0.0,21.2.22,,HIGH,CWE-116;CWE-79,
+CVE-2026-88058,2026-09-28T20:39:26Z,"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements",@angular/platform-server,22.0.0,22.1.4,,HIGH,CWE-116;CWE-79,
 CVE-2026-88059,2026-09-10T20:19:19Z,"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",@angular/common,0,,19.2.25,MODERATE,CWE-200;CWE-524,
 CVE-2026-88059,2026-09-10T20:19:19Z,"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",@angular/common,20.0.0,20.3.28,,MODERATE,CWE-200;CWE-524,
 CVE-2026-88059,2026-09-10T20:19:19Z,"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",@angular/common,21.0.0,21.2.20,,MODERATE,CWE-200;CWE-524,
 CVE-2026-88059,2026-09-10T20:19:19Z,"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",@angular/common,22.0.0,22.1.1,,MODERATE,CWE-200;CWE-524,
-CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,0,,19.2.25,HIGH,CWE-79;CWE-116,
-CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,20.0.0,20.3.30,,HIGH,CWE-79;CWE-116,
-CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,21.0.0,21.2.22,,HIGH,CWE-79;CWE-116,
-CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,22.0.0,22.1.4,,HIGH,CWE-79;CWE-116,
+CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,0,,19.2.25,HIGH,CWE-116;CWE-79,
+CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,20.0.0,20.3.30,,HIGH,CWE-116;CWE-79,
+CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,21.0.0,21.2.22,,HIGH,CWE-116;CWE-79,
+CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,22.0.0,22.1.4,,HIGH,CWE-116;CWE-79,
 CVE-2026-88062,2026-09-10T21:22:12Z," OmniRoute ACP Custom-Agent Remote Code Execution (RCE)",omniroute,0,,3.8.50,CRITICAL,CWE-306;CWE-94,
 CVE-2026-8813,2026-05-29T17:58:37Z,"ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag",exifreader,2.10.0,4.39.0,,HIGH,CWE-1284,
 CVE-2026-8814,2026-05-29T17:52:26Z,"ExifReader is vulnerable to denial of service via unbounded decompression of image metadata",exifreader,4.20.0,4.39.0,,MODERATE,CWE-409,
+CVE-2026-88932,2026-09-28T21:34:58Z,"multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads",multer,2.2.0,2.4.0,,MODERATE,CWE-400;CWE-459,
 CVE-2026-88976,2026-09-17T20:32:47Z,"@platejs/core HTML deserialization can trigger browser behavior during parsing",@platejs/core,0,53.3.11,,MODERATE,CWE-79,
 CVE-2026-88976,2026-09-17T20:32:47Z,"@platejs/core HTML deserialization can trigger browser behavior during parsing",@platejs/core,54.0.0-beta.0,,54.0.0-beta.1,MODERATE,CWE-79,
 CVE-2026-91127,2026-09-18T17:19:42Z,"File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer",@file-viewer/doc,0,2.3.1,,HIGH,CWE-79;CWE-83,
 CVE-2026-91127,2026-09-18T17:19:42Z,"File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer",msdoc-viewer,0,0.2.2,,HIGH,CWE-79;CWE-83,
+CVE-2026-92081,2026-09-30T23:53:44Z,"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses",fastify,0,5.12.5,,MODERATE,CWE-248,
+CVE-2026-92708,2026-10-01T15:18:06Z,"devalue: `stringify`/`uneval` serialize shared memory",devalue,5.1.0,5.9.3,,HIGH,CWE-200;CWE-226,
 CVE-2026-9277,2026-06-09T14:27:15Z,"shell-quote quote() does not escape newlines in object .op values",shell-quote,1.1.0,1.8.4,,CRITICAL,CWE-77;CWE-78,
+CVE-2026-92935,2026-10-01T15:34:58Z,"vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE",vm2,3.11.4,3.11.7,,CRITICAL,CWE-913,
+CVE-2026-92937,2026-10-01T15:32:10Z,"vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection",vm2,3.11.6,3.11.7,,CRITICAL,CWE-693;CWE-94,
+CVE-2026-92938,2026-10-01T15:29:04Z,"vm2 allows a sandboxed plugin to execute native code through `node:sqlite`",vm2,3.11.3,3.11.7,,CRITICAL,CWE-693,
+CVE-2026-92939,2026-10-01T15:28:36Z,"vm2 crypto builtin loads attacker native code through setEngine",vm2,3.11.3,3.11.7,,CRITICAL,CWE-114,
+CVE-2026-92940,2026-10-01T15:38:26Z,"vm2 exposes host HTTPS credentials and TLS traffic through globalAgent",vm2,3.11.3,3.11.7,,CRITICAL,CWE-668,
+CVE-2026-92941,2026-10-01T15:27:28Z,"vm2 NodeVM can replace the host process TLS trust store",vm2,3.11.3,3.11.7,,CRITICAL,CWE-732,
+CVE-2026-92944,2026-10-01T15:28:07Z,"vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector",vm2,3.10.2,3.11.7,,CRITICAL,CWE-693;CWE-913,
+CVE-2026-92945,2026-10-01T15:26:45Z,"vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted",vm2,0,3.11.7,,MODERATE,CWE-22;CWE-863,
+CVE-2026-92948,2026-10-01T15:41:31Z,"vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape",vm2,3.9.6,3.11.7,,CRITICAL,CWE-693,
+CVE-2026-92949,2026-10-01T15:35:25Z,"vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor",vm2,3.9.6,3.11.7,,MODERATE,CWE-471;CWE-693,
+CVE-2026-92950,2026-10-01T15:40:45Z,"vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts",vm2,0,3.11.7,,HIGH,CWE-1188;CWE-453;CWE-829,
+CVE-2026-92951,2026-10-01T15:37:19Z,"vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package",vm2,0,3.11.7,,CRITICAL,CWE-706;CWE-829;CWE-863,
+CVE-2026-92952,2026-10-01T15:42:15Z,"vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks",vm2,3.11.4,3.11.7,,MODERATE,CWE-669,
+CVE-2026-92957,2026-10-01T15:36:01Z,"vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process",vm2,0,3.11.7,,CRITICAL,CWE-269;CWE-284,
+CVE-2026-92958,2026-10-01T15:36:48Z,"vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes",vm2,0,3.11.7,,HIGH,CWE-269;CWE-284,
 CVE-2026-9358,2026-05-26T13:30:30Z,"postcss-selector-parser allows denial of service through uncontrolled AST recursion",postcss-selector-parser,6.1.0,6.1.3,,LOW,CWE-404,
 CVE-2026-9358,2026-05-26T13:30:30Z,"postcss-selector-parser allows denial of service through uncontrolled AST recursion",postcss-selector-parser,7.1.0,7.1.3,,LOW,CWE-404,
+CVE-2026-93687,2026-09-18T18:31:41Z,"braces vulnerable to stack-exhaustion denial of service through deeply nested patterns",braces,0,,3.0.3,HIGH,CWE-674,
+CVE-2026-93748,2026-09-18T18:31:44Z,"http-cache-semantics max-stale handling can disclose cross-user cached responses",http-cache-semantics,0,,4.2.0,HIGH,CWE-524,
+CVE-2026-93981,2026-09-30T23:46:16Z,"hono/jsx renders plain strings unescaped in boundary components, leading to XSS",hono,0,4.13.7,,MODERATE,CWE-79,
 CVE-2026-9495,2026-05-26T13:30:54Z,"@koa/router has an Access Control Bypass",@koa/router,14.0.0,15.0.0,,MODERATE,CWE-284,
 CVE-2026-9496,2026-05-26T13:30:54Z,"pacote is vulnerable to Denial of Service (DoS) via the addGitSha function",pacote,11.2.7,21.5.1,,HIGH,CWE-1333;CWE-400,
 CVE-2026-9520,2026-05-26T13:30:53Z,"Blitz has a Cross-site Scripting issue",blitz,0,,3.0.2,LOW,CWE-79,
@@ -8081,11 +8282,13 @@ CVE-2026-9673,2026-05-28T06:31:09Z,"json-2-csv vulnerable to CSV Injection via t
 CVE-2026-9675,2026-06-18T14:28:10Z,"undici WebSocket client vulnerable to denial of service via cumulative fragment bypass",undici,8.0.0,8.5.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-9678,2026-06-18T14:28:13Z,"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",undici,7.0.0,7.28.0,,MODERATE,CWE-524,
 CVE-2026-9678,2026-06-18T14:28:13Z,"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",undici,8.0.0,8.5.0,,MODERATE,CWE-524,
+CVE-2026-96780,2026-10-02T22:39:16Z,"figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width",figlet,0,1.11.3,,HIGH,CWE-835,
 CVE-2026-9679,2026-06-19T14:21:30Z,"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",undici,0,6.27.0,,MODERATE,CWE-93,
 CVE-2026-9679,2026-06-19T14:21:30Z,"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",undici,7.0.0,7.28.0,,MODERATE,CWE-93,
 CVE-2026-9679,2026-06-19T14:21:30Z,"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",undici,8.0.0,8.5.0,,MODERATE,CWE-93,
 CVE-2026-9697,2026-06-18T14:28:21Z,"undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent",undici,7.23.0,7.28.0,,HIGH,CWE-295,
 CVE-2026-9697,2026-06-18T14:28:21Z,"undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent",undici,8.0.0,8.5.0,,HIGH,CWE-295,
+CVE-2026-97711,2026-09-30T15:40:05Z,"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies",serialize-javascript,7.1.1,7.1.2,,LOW,CWE-79;CWE-80,
 GHSA-224h-p7p5-rh85,2020-09-01T17:32:26Z,"Directory Traversal in wenluhong1",wenluhong1,0.0.0,,,HIGH,CWE-22,
 GHSA-224p-v68g-5g8f,2025-08-26T18:45:55Z,"GraphQL Armor Max-Depth Plugin Bypass via fragment caching","@escape.tech/graphql-armor-max-depth",0,2.4.2,,MODERATE,CWE-400,
 GHSA-226w-6hhj-69hp,2020-09-03T19:06:52Z,"Malicious Package in cal_rd",cal_rd,0.0.0,,,CRITICAL,CWE-506,
@@ -8101,12 +8304,13 @@ GHSA-23q2-5gf8-gjpp,2024-04-19T17:26:32Z,"Enabling Authentication does not close
 GHSA-23vw-mhv5-grv5,2020-09-03T15:48:43Z,"Denial of Service in @hapi/hapi",@hapi/hapi,0,18.4.1,,HIGH,,
 GHSA-23vw-mhv5-grv5,2020-09-03T15:48:43Z,"Denial of Service in @hapi/hapi",@hapi/hapi,19.0.0,19.1.1,,HIGH,,
 GHSA-24v3-254g-jv85,2025-12-19T21:32:35Z,"Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature",@tutao/tutanota-utils,0,314.251111.0,,LOW,CWE-1021;CWE-79,
+GHSA-253c-mchw-3w2r,2026-09-29T17:57:56Z,"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds",markdown-it,0,14.3.1,,MODERATE,CWE-400;CWE-407,
+GHSA-253c-mchw-3w2r,2026-09-29T17:57:56Z,"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds",markdown-it,15.0.0,15.0.1,,MODERATE,CWE-400;CWE-407,
 GHSA-255r-pghp-r5wh,2020-09-03T17:05:34Z,"Malicious Package in hdeky",hdeky,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2563-83p7-f34p,2020-09-02T20:24:41Z,"Malicious Package in requestt",requestt,0,,,CRITICAL,CWE-506,
 GHSA-25v4-mcx4-hh35,2020-09-04T17:28:28Z,"Cross-Site Scripting in atlasboard-atlassian-package","atlasboard-atlassian-package",0.0.0,,,HIGH,CWE-79,
 GHSA-268h-hp4c-crq3,2026-06-15T17:36:06Z,"Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection",nodemailer,0,8.0.9,,MODERATE,CWE-93,
 GHSA-26hg-crh6-mjrw,2021-02-23T21:28:28Z,"Directory Traversal",list-n-stream,0,0.0.11,,HIGH,,
-GHSA-26pp-8wgv-hjvm,2026-04-08T00:17:02Z,"Hono missing validation of cookie name on write path in setCookie()",hono,0,4.12.12,,MODERATE,CWE-113,
 GHSA-26w7-cxv4-gfx2,2026-09-08T21:26:16Z,"Astro: Remote code execution through AVIF image optimization",astro,0,7.2.8,,CRITICAL,CWE-125;CWE-787,
 GHSA-26wg-9xf2-q495,2026-04-14T23:23:01Z,"Novu has a XSS sanitization bypass",novu/api,0,3.15.0,,HIGH,CWE-79,
 GHSA-277h-px4m-62q8,2024-10-03T19:46:12Z,"@saltcorn/server arbitrary file zip read and download when downloading auto backups",@saltcorn/server,0,1.0.0-beta.14,,MODERATE,CWE-22,
@@ -8116,11 +8320,15 @@ GHSA-27v7-qhfv-rqq8,2019-05-30T17:26:30Z,"Insecure Credential Storage in web3",w
 GHSA-2858-xg23-26fp,2026-03-03T21:18:56Z,"OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots",openclaw,2026.2.13,2026.3.2,,MODERATE,CWE-918,
 GHSA-28f4-mjfq-qrvf,2020-09-03T22:18:40Z,"Malicious Package in buffes-xor",buffes-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-28hp-fgcr-2r4h,2019-06-27T17:25:42Z,"Cross-Site Scripting via JSONP",angular,0,1.6.0,,MODERATE,CWE-79,
+GHSA-28q4-xrqh-9479,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process",vm2,0,,3.11.6,CRITICAL,CWE-269,
 GHSA-28qq-5f47-r5x2,2026-01-23T06:31:23Z,"Duplicate Advisory: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)",gemini-mcp-tool,1.1.2,1.1.6,,CRITICAL,CWE-78,
 GHSA-28xh-wpgr-7fm8,2019-06-20T15:35:49Z,"Command Injection in open",open,0,6.0.0,,CRITICAL,CWE-77,
 GHSA-28xx-8j99-m32j,2020-09-01T20:37:25Z,"Malicious Package in nginxbeautifier",nginxbeautifier,1.0.14,1.0.15,,CRITICAL,CWE-506,
 GHSA-2944-57xv-2682,2026-07-02T19:07:44Z,"@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-918,
 GHSA-29fh-xcjr-p7rx,2020-09-03T17:02:22Z,"Malicious Package in web3-eht",web3-eht,0.0.0,,,CRITICAL,CWE-506,
+GHSA-29h2-jr22-frmh,2026-09-25T19:31:08Z,"OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet","@openzeppelin/confidential-contracts",0,0.3.2,,HIGH,CWE-284,
+GHSA-29h2-jr22-frmh,2026-09-25T19:31:08Z,"OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet","@openzeppelin/confidential-contracts",0.4.0-rc.0,0.4.2,,HIGH,CWE-284,
+GHSA-29h2-jr22-frmh,2026-09-25T19:31:08Z,"OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet","@openzeppelin/confidential-contracts",0.5.0-rc.0,0.5.2,,HIGH,CWE-284,
 GHSA-2c83-wfv3-q25f,2021-09-07T23:07:56Z,"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown",rebber,0,5.2.1,,CRITICAL,CWE-78,
 GHSA-2cf5-4w76-r9qv,2020-09-04T14:57:38Z,"Arbitrary Code Execution in handlebars",handlebars,0,3.0.8,,HIGH,CWE-94,
 GHSA-2cf5-4w76-r9qv,2020-09-04T14:57:38Z,"Arbitrary Code Execution in handlebars",handlebars,4.0.0,4.5.2,,HIGH,CWE-94,
@@ -8178,6 +8386,7 @@ GHSA-2w9p-xf5h-qwj3,2023-03-27T03:30:16Z,"Duplicate Advisory: pullit Command Inj
 GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,0,1.123.67,,HIGH,CWE-200;CWE-843;CWE-918,
 GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-200;CWE-843;CWE-918,
 GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,2.32.0,2.32.1,,HIGH,CWE-200;CWE-843;CWE-918,
+GHSA-2x6f-57hp-86fx,2026-06-23T15:32:36Z,"Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
 GHSA-2x7j-588g-ccc2,2026-09-08T21:33:17Z,"Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list",nodemailer,0,9.1.0,,HIGH,CWE-400;CWE-407,
 GHSA-2xgg-r2wc-c5r2,2026-07-24T21:26:19Z,"Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector",@budibase/server,0,,3.38.1,HIGH,CWE-89,
 GHSA-2xp4-qhr4-xqm2,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode",openclaw,0,2026.3.31,,LOW,CWE-352,
@@ -8261,6 +8470,7 @@ GHSA-3r78-rqg8-95gg,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's voice-c
 GHSA-3rw8-4xrq-3f7p,2025-03-17T21:30:34Z,"Duplicate Advisory: Uptime Kuma ReDoS vulnerability",uptime-kuma,1.23.0,,2.0.0-dev.0,MODERATE,CWE-1333,
 GHSA-3v3j-737j-7g74,2026-06-16T21:31:59Z,"Duplicate Advisory: Linux and macOS exec allowlists skipped configured argument patterns",openclaw,0,,,HIGH,CWE-693,
 GHSA-3w6x-gv34-mqpf,2026-03-26T21:24:34Z,"OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement",openclaw,0,2026.3.22,,HIGH,CWE-862,
+GHSA-3wcj-gjvf-fvch,2026-07-11T15:30:23Z,"Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })",hono,0,,,MODERATE,CWE-1321,
 GHSA-3wqh-h42r-x8fq,2020-09-03T15:46:22Z,"Denial of Service in @hapi/content",@hapi/content,0,5.0.2,,HIGH,,
 GHSA-3wqp-prf6-2m72,2026-07-02T17:08:08Z,"OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement",openclaw,0,2026.5.6,,LOW,CWE-862,
 GHSA-3xc7-xg67-pw99,2019-06-05T20:43:10Z,"Sensitive Data Exposure in sequelize-cli",sequelize-cli,0,,5.4.0,LOW,CWE-532,
@@ -8271,10 +8481,12 @@ GHSA-43vf-2x6g-p2m5,2020-09-02T21:33:26Z,"Malicious Package in browserift",brows
 GHSA-442j-39wm-28r2,2026-03-29T15:16:37Z,"Handlebars.js has a Property Access Validation Bypass in container.lookup",handlebars,4.0.0,4.7.9,,LOW,CWE-367,
 GHSA-44c9-4rg5-qjgq,2026-03-19T03:30:57Z,"Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy",openclaw,0,,,MODERATE,CWE-918,
 GHSA-44vf-8ffm-v2qh,2020-09-02T15:42:47Z,"Sensitive Data Exposure in rails-session-decoder",rails-session-decoder,0.0.0,,,HIGH,,
+GHSA-456v-xq2p-r4cj,2026-09-28T13:59:43Z,"code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)",code-ollama,0,0.36.1,,HIGH,CWE-78,
 GHSA-457r-cqc8-9vj9,2022-11-23T15:39:50Z,"sweetalert2 v10.16.10 and above contains hidden functionality",sweetalert2,10.16.10,11.22.4,,LOW,CWE-912,
 GHSA-4627-w373-375v,2020-09-11T21:22:24Z,"Malicious Package in grunt-radical",grunt-radical,0.0.14,0.0.13,,CRITICAL,,
 GHSA-464c-974j-9xm6,2026-07-24T16:44:20Z,"AWS CDK CodeBuild S3 Log Encryption Boolean Inversion",@aws-cdk/aws-codebuild,1.75.0,,1.204.0,LOW,CWE-311;CWE-682,
 GHSA-464c-974j-9xm6,2026-07-24T16:44:20Z,"AWS CDK CodeBuild S3 Log Encryption Boolean Inversion",aws-cdk-lib,0,2.253.0,,LOW,CWE-311;CWE-682,
+GHSA-4672-hwv6-gq62,2026-10-02T22:42:40Z,"Trigger.dev: Cross-environment deployment cancel",trigger.dev,0,4.5.6,,MODERATE,CWE-639,
 GHSA-46fh-8fc5-xcwx,2020-09-03T18:09:16Z,"Prototype Pollution in lodash.defaultsdeep",lodash.defaultsdeep,0,4.6.1,,HIGH,CWE-1321,
 GHSA-46j5-6fg5-4gv3,2025-12-18T09:30:30Z,"Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion",nodemailer,0,7.0.11,,MODERATE,CWE-674;CWE-703,
 GHSA-474h-prjg-mmw3,2026-03-03T21:31:57Z,"OpenClaw: Sandboxed sessions_spawn(runtime=""acp"") bypassed sandbox inheritance and allowed host ACP initialization",openclaw,0,2026.3.2,,HIGH,CWE-269,
@@ -8315,6 +8527,7 @@ GHSA-4m3v-q747-pc6h,2026-07-02T17:13:01Z,"OpenClaw: Mattermost slash token revoc
 GHSA-4mhr-cxr4-2prm,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests",openclaw,2026.4.5,2026.4.20,,MODERATE,CWE-441,
 GHSA-4pmg-jgm5-3jg6,2020-09-02T21:16:26Z,"Malicious Package in erquest",erquest,0,,,CRITICAL,CWE-506,
 GHSA-4q2f-8g74-qm56,2020-09-03T17:18:05Z,"Cross-Site Scripting in takeapeek",takeapeek,0.0.0,,,HIGH,CWE-79,
+GHSA-4q55-j62x-fr9h,2026-10-01T15:13:23Z,"devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion",devalue,0,5.9.3,,MODERATE,CWE-1321,
 GHSA-4q8f-5xxj-946r,2020-09-03T02:40:51Z,"Command Injection in addax",addax,0,1.1.0,,HIGH,CWE-77,
 GHSA-4qgr-57jq-93vh,2026-06-16T21:31:59Z,"Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots",openclaw,0,,,HIGH,CWE-426,
 GHSA-4qhx-g9wp-g9m6,2019-06-14T16:09:01Z,"Failure to sanitize quotes which can lead to sql injection in squel",squel,0,,5.13.0,CRITICAL,CWE-74;CWE-89,
@@ -8347,8 +8560,6 @@ GHSA-52rh-5rpj-c3w6,2022-05-05T16:00:50Z,"Improper handling of multiline message
 GHSA-5326-6f73-m96w,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains",openclaw,0,,,MODERATE,CWE-184,
 GHSA-5327-gfq5-8f4m,2020-09-03T21:56:23Z,"Malicious Package in buffer-xmr",buffer-xmr,0.0.0,,,CRITICAL,CWE-506,
 GHSA-533p-g2hq-qr26,2020-09-04T17:16:35Z,"Command Injection in treekill",treekill,0.0.0,,,HIGH,CWE-77,
-GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,3.18.0,3.21.7,,MODERATE,CWE-276,
-GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
 GHSA-534w-2vm4-89xr,2026-03-03T23:18:26Z,"OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch",openclaw,0,2026.2.24,,MODERATE,CWE-284;CWE-863,
 GHSA-536f-268f-6gxc,2020-09-03T22:17:36Z,"Malicious Package in buffermxor",buffermxor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-53mj-mc38-q894,2020-09-01T19:40:41Z,"Remote Memory Exposure in openwhisk",openwhisk,0,3.3.1,,MODERATE,,
@@ -8358,6 +8569,7 @@ GHSA-54qm-37qr-w5wq,2020-09-04T15:04:20Z,"Sandbox Breakout / Arbitrary Code Exec
 GHSA-54xq-cgqr-rpm3,2023-11-16T17:14:15Z,"sharp vulnerability in libwebp dependency CVE-2023-4863",sharp,0,0.32.6,,HIGH,,
 GHSA-553v-f69r-656j,2026-03-03T21:39:10Z,"OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth",openclaw,2026.2.22,2026.2.25,,MODERATE,CWE-863,
 GHSA-559q-92vx-xvjp,2020-09-03T17:44:36Z,"Malicious Package in qingting",qingting,0.0.0,,,CRITICAL,CWE-506,
+GHSA-55cm-p4ww-685g,2026-06-23T15:32:37Z,"Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()",hono,0,4.12.12,,MODERATE,CWE-113;CWE-20,
 GHSA-55q2-fjhq-7xh7,2026-08-07T15:30:47Z,"DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS",dompurify,0,3.4.13,,MODERATE,CWE-79,
 GHSA-5634-rv46-48jf,2020-09-03T17:13:45Z,"Cross-Site Scripting in bleach",bleach,0.0.0,,,HIGH,CWE-79,
 GHSA-5635-9mvj-r6hp,2020-09-03T02:34:39Z,"Malicious Package in vue-backbone",vue-backbone,0.1.2,0.1.3,,CRITICAL,CWE-506,
@@ -8369,6 +8581,7 @@ GHSA-56x4-j7p9-fcf9,2022-08-30T20:31:21Z,"Command Injection in moment-timezone",
 GHSA-5799-3xg7-rfrv,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host",openclaw,0,2026.3.31,,HIGH,CWE-59,
 GHSA-57cf-349j-352g,2019-06-12T16:37:00Z,"Out-of-bounds Read in npmconf",npmconf,0,2.1.3,,MODERATE,CWE-125,
 GHSA-57gh-m6rq-54cf,2026-04-03T02:53:58Z,"OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration",openclaw,0,2026.3.31,,HIGH,CWE-552,
+GHSA-5843-9mh5-hhgw,2026-09-17T15:32:14Z,"Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent",vm2,3.11.3,,3.11.6,CRITICAL,CWE-668,
 GHSA-5847-rm3g-23mw,2026-03-03T00:38:48Z,"OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants",openclaw,0,2026.2.22,,MODERATE,CWE-770,
 GHSA-5854-jvxx-2cg9,2020-09-03T15:46:57Z,"Denial of Service in content",content,0,,4.0.6,HIGH,,
 GHSA-588m-9qg5-35pq,2020-09-03T17:19:09Z,"Reverse Tabnabbing in quill",quill,0,1.3.7,,MODERATE,CWE-1022,
@@ -8381,6 +8594,7 @@ GHSA-593v-wcqx-hq2w,2021-09-07T22:57:58Z,"Incorrect version tags linked to exter
 GHSA-5947-m4fg-xhqg,2020-09-03T18:08:10Z,"Prototype Pollution in lodash.mergewith",lodash.mergewith,0,4.6.1,,HIGH,CWE-1321,
 GHSA-59f3-7227-wmh4,2026-05-21T20:47:44Z,"@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails",@hulumi/policies,0,1.3.2,,HIGH,CWE-693,
 GHSA-59fh-9f3p-7m39,2026-05-20T15:44:40Z,"Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification",flowise,0,3.1.2,,MODERATE,CWE-915,
+GHSA-59h8-w5q6-mfmp,2026-10-02T22:39:57Z,"Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId",trigger.dev,0,4.5.5,,MODERATE,CWE-306,
 GHSA-59x8-7wx6-4hj9,2020-09-03T17:47:52Z,"Malicious Package in secure_identity_login_module","secure_identity_login_module",0.0.0,,,CRITICAL,CWE-506,
 GHSA-59xc-5v89-r7pr,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token",openclaw,0,2026.3.28,,MODERATE,CWE-307,
 GHSA-59xv-588h-2vmm,2026-04-10T19:30:32Z,"@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler",@saltcorn/data,0,1.4.5,,LOW,CWE-89,
@@ -8469,6 +8683,7 @@ GHSA-65p7-pjj8-ggmr,2021-09-23T23:18:42Z,"Member account takeover",ghost,3.18.0,
 GHSA-65p7-pjj8-ggmr,2021-09-23T23:18:42Z,"Member account takeover",ghost,4.0.0,4.15.1,,MODERATE,,
 GHSA-65p8-3hm4-h9h8,2019-08-23T00:04:48Z,"Denial of Service in rgb2hex",rgb2hex,0,0.1.6,,MODERATE,CWE-400,
 GHSA-65xx-c85x-wg76,2020-09-04T17:20:52Z,"Command Injection in plotter",plotter,0.0.0,,,CRITICAL,CWE-77,
+GHSA-6623-4q32-82v8,2026-09-19T12:32:10Z,"Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS",hono,0,,,LOW,CWE-79,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,0,1.123.55,,MODERATE,CWE-863,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.0.0-rc.0,2.25.7,,MODERATE,CWE-863,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.26.0,2.26.2,,MODERATE,CWE-863,
@@ -8500,11 +8715,15 @@ GHSA-6f72-9gxx-98mj,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: OpenShel
 GHSA-6f93-xj8r-jp82,2020-09-03T22:28:21Z,"Malicious Package in bunfer-xor",bunfer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6fcr-9h9g-23fq,2020-09-02T21:50:51Z,"Denial of Service in ipfs-bitswap",ipfs-bitswap,0,0.24.1,,MODERATE,CWE-400,
 GHSA-6fh5-8wq8-w3wr,2020-09-04T15:09:55Z,"Prototype Pollution in unflatten",unflatten,0.0.0,,,HIGH,CWE-1321,
+GHSA-6fvh-fgmg-3x7v,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package",vm2,0,,3.11.6,CRITICAL,CWE-706,
 GHSA-6g25-pc82-vfwp,2026-03-03T00:39:40Z,"OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state",openclaw,0,2026.2.25,,MODERATE,CWE-200,
+GHSA-6h2x-m376-mqjq,2026-09-29T18:07:42Z,"joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`",joi,17.2.0,17.13.7,,HIGH,CWE-1333,
+GHSA-6h2x-m376-mqjq,2026-09-29T18:07:42Z,"joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`",joi,18.0.0,18.2.6,,HIGH,CWE-1333,
 GHSA-6hqm-hm2v-3p2p,2026-08-01T15:30:27Z,"Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",axios,1.0.0,,,MODERATE,CWE-183,
 GHSA-6hxq-p678-4hr2,2026-09-04T17:33:20Z,"SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor",@simplewebauthn/server,0,13.3.2,,LOW,CWE-295;CWE-296,
 GHSA-6jg8-7333-554w,2019-10-04T17:56:12Z,"Sandbox Breakout in realms-shim",realms-shim,0,1.2.0,,CRITICAL,,
 GHSA-6jg8-7333-554w,2019-10-04T17:56:12Z,"Sandbox Breakout in realms-shim",ses,0,0.6.3,,CRITICAL,,
+GHSA-6jgm-4w45-vh8j,2026-09-17T15:32:14Z,"Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine",vm2,3.11.3,,3.11.6,CRITICAL,CWE-114,
 GHSA-6jm4-83g2-35gv,2026-06-16T21:31:57Z,"Duplicate Advisory: memory-wiki shared search could miss session visibility checks",openclaw,0,,,MODERATE,CWE-862,
 GHSA-6jrj-vc65-c983,2024-08-26T15:17:40Z,"unzip-stream allows Arbitrary File Write via artifact extraction",unzip-stream,0,0.3.2,,HIGH,CWE-22,
 GHSA-6m6m-j2hm-pxrg,2020-09-03T17:37:05Z,"Malicious Package in cicada-render",cicada-render,0.0.0,,,CRITICAL,CWE-506,
@@ -8521,6 +8740,7 @@ GHSA-6qqj-rx4w-r3cj,2020-08-31T22:48:44Z,"CSRF Vulnerability in jquery-ujs",jque
 GHSA-6r5x-hmgg-7h53,2019-07-15T19:46:01Z,"Remote code execution in Handlebars.js",handlebars,0,4.1.0,,MODERATE,,
 GHSA-6rmx-gvvg-vh6j,2026-03-09T19:52:47Z,"OpenClaw's hooks count non-POST requests toward auth lockout",openclaw,0,2026.3.7,,MODERATE,CWE-307;CWE-799,
 GHSA-6v7q-wjvx-w8wg,2026-04-10T20:18:23Z,"basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",basic-ftp,0,5.2.2,,HIGH,CWE-93,
+GHSA-6vj9-mwq6-2f5v,2026-09-28T21:56:05Z,"Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure",nodemailer,5.0.0,10.0.2,,MODERATE,CWE-295,
 GHSA-6x2m-hqfw-hvpj,2026-03-02T22:29:45Z,"OpenClaw: Node exec approvals could be replayed across nodes",openclaw,0,2026.2.23,,MODERATE,CWE-285;CWE-863,
 GHSA-6x2m-p4xp-wg22,2026-06-19T21:42:36Z,"Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups",network-ai,0,5.12.2,,MODERATE,CWE-22;CWE-59,
 GHSA-6x33-pw7p-hmpq,2020-09-04T17:59:49Z,"Denial of Service in http-proxy",http-proxy,0,1.18.1,,HIGH,CWE-184;CWE-693,
@@ -8561,6 +8781,7 @@ GHSA-78p3-fwcq-62c2,2024-10-03T19:50:59Z,"@saltcorn/server Remote Code Execution
 GHSA-796m-2973-wc5q,2026-03-03T22:23:45Z,"OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation",openclaw,0,2026.2.23,,MODERATE,CWE-436,
 GHSA-798h-g4j5-5537,2023-01-11T15:30:28Z,"Duplicate Advisory: PapaParse Inefficient Regular Expression Complexity vulnerability",papaparse,0,5.2.0,,HIGH,CWE-1333,
 GHSA-799q-f2px-wx8c,2025-03-28T21:30:46Z,"Duplicate Advisory: @alizeait/unflatto Prototype Pollution via `exports.unflatto` Method",@alizeait/unflatto,0,,1.0.2,HIGH,CWE-1321,
+GHSA-7c3p-84r8-h79q,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes",vm2,0,,3.11.6,HIGH,CWE-269,
 GHSA-7cg8-pq9v-x98q,2019-10-21T21:58:55Z,"Sandbox Breakout in realms-shim",realms-shim,0,1.2.1,,CRITICAL,,
 GHSA-7cgc-fjv4-52x6,2023-05-24T16:43:58Z,"Malware in pre-build binaries of bignum",bignum,0.12.2,0.13.1,,CRITICAL,CWE-506,
 GHSA-7cp4-jw97-3rc2,2025-05-01T03:31:17Z,"Duplicate Advisory: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint","@cloudflare/workers-oauth-provider",0,0.0.5,,MODERATE,CWE-601,
@@ -8610,6 +8831,7 @@ GHSA-7xf9-74cp-8hx3,2020-09-03T22:59:21Z,"Malicious Package in js-cha3",js-cha3,
 GHSA-7xfq-xh6v-4mrm,2020-09-01T20:27:53Z,"Malicious Package in json-serializer",json-serializer,2.0.10,2.0.11,,CRITICAL,CWE-506,
 GHSA-7xmq-g46g-f8pv,2026-03-02T21:55:47Z,"OpenClaw: Sandbox media TOCTOU could read files outside sandbox root",openclaw,0,2026.3.1,,HIGH,CWE-367;CWE-59,
 GHSA-7xp7-m392-h92c,2026-05-05T21:15:32Z,"@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS",@evomap/evolver,0,1.70.0-beta.5,,MODERATE,CWE-400,
+GHSA-8238-w5pm-2374,2026-09-29T23:10:09Z,"adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)",adm-zip,0,0.6.1,,HIGH,CWE-248;CWE-400,
 GHSA-82gw-wqw6-r2cf,2026-03-19T03:30:57Z,"Duplicate Advisory: Command Injection via unescaped environment assignments in Windows Scheduled Task script generation",openclaw,0,,2026.2.17,MODERATE,CWE-78,
 GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",derby,0,2.3.2,,LOW,CWE-1321,
 GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",derby,3.0.0,3.0.2,,LOW,CWE-1321,
@@ -8695,6 +8917,7 @@ GHSA-8mm3-2mcj-cx6r,2020-09-11T21:09:24Z,"Malicious Package in angluar-cli",angl
 GHSA-8mmf-qp7j-2w24,2020-09-02T21:35:33Z,"Malicious Package in colour-string",colour-string,0,,,CRITICAL,CWE-506,
 GHSA-8mpm-q7mh-8fvh,2026-03-18T16:09:42Z,"Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)",@capgo/cli,0,7.84.6,,HIGH,CWE-276;CWE-377;CWE-59,
 GHSA-8mr2-f9wf-hcfq,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback",openclaw,0,2026.2.22,,LOW,CWE-522,
+GHSA-8mvv-mcc3-xwhh,2026-09-17T15:32:15Z,"Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted",vm2,0,,3.11.6,LOW,CWE-22,
 GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",@sequelize/core,0,7.0.0-alpha.20,,CRITICAL,CWE-790,
 GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",sequelize,0,6.29.0,,CRITICAL,CWE-790,
 GHSA-8pf2-vj79-4wxg,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API",openclaw,0,2026.3.31,,MODERATE,CWE-441,
@@ -8712,6 +8935,7 @@ GHSA-8rgj-285w-qcq4,2025-02-10T17:59:09Z,"Unknown vulnerability in Coinbase Wall
 GHSA-8v5f-hp78-jgxq,2019-06-06T15:30:33Z,"Signature Verification Bypass in jwt-simple",jwt-simple,0,0.5.3,,HIGH,CWE-347,
 GHSA-8vj3-jgcf-77jv,2020-09-02T20:26:49Z,"Malicious Package in requeest",requeest,0,,,CRITICAL,CWE-506,
 GHSA-8vvx-qvq9-5948,2025-03-14T18:48:44Z,"Flowise allows arbitrary file write to RCE",flowise,0,,2.2.7,CRITICAL,CWE-94,
+GHSA-8vvx-rff5-p5rq,2026-09-29T18:23:50Z,"Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS",nodemailer,0,10.0.2,,MODERATE,CWE-674,
 GHSA-8w57-jfpm-945m,2019-06-11T16:16:07Z,"Denial of Service in http-proxy-agent",http-proxy-agent,0,2.1.0,,HIGH,CWE-400,
 GHSA-8w9j-6wg6-qv4f,2020-09-03T19:41:17Z,"Malicious Package in axioss",axioss,0.0.0,,,CRITICAL,CWE-506,
 GHSA-8wc6-vgrq-x6cf,2026-02-13T20:53:58Z,"Child processes spawned by Renovate incorrectly have full access to environment variables",renovate,42.68.1,42.96.3,,MODERATE,CWE-269,
@@ -8737,6 +8961,8 @@ GHSA-92jp-89mq-4374,2026-04-17T20:08:01Z,"OpenClaw: Sandbox noVNC helper route e
 GHSA-93rg-2xm5-2p9v,2026-05-04T21:14:17Z,"OpenClaw's Gateway Control UI bootstrap config required Gateway auth",openclaw,0,2026.4.22,,MODERATE,CWE-287,
 GHSA-943q-mwmv-hhvh,2026-03-02T23:32:22Z,"OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval",openclaw,0,2026.2.14,,HIGH,CWE-78,
 GHSA-95cg-3r4g-7w6j,2020-09-03T23:01:29Z,"Malicious Package in js-rha3",js-rha3,0.0.0,,,CRITICAL,CWE-506,
+GHSA-96h4-vgxj-gvm2,2026-09-30T14:44:21Z,"Nest: Unbounded memory growth in the NestJS TCP microservice transport",@nestjs/microservices,0,11.2.5,,MODERATE,CWE-770,
+GHSA-96h4-vgxj-gvm2,2026-09-30T14:44:21Z,"Nest: Unbounded memory growth in the NestJS TCP microservice transport",@nestjs/microservices,12.0.0,12.0.3,,MODERATE,CWE-770,
 GHSA-96qw-h329-v5rg,2026-01-08T21:13:37Z,"Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles",shakapacker,0,9.5.0,,HIGH,CWE-200,
 GHSA-97mg-3cr6-3x4c,2020-09-04T17:27:23Z,"Remote Code Execution in mongodb-query-parser",mongodb-query-parser,0,2.0.0,,CRITICAL,,
 GHSA-97mp-9g5c-6c93,2020-09-04T16:50:48Z,"Malicious Package in bs58chcek",bs58chcek,0.0.0,,,CRITICAL,CWE-506,
@@ -8750,12 +8976,16 @@ GHSA-992f-wf4w-x36v,2020-09-01T21:16:13Z,"Prototype Pollution in merge-objects",
 GHSA-9959-c6q6-6qp3,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects validator",validator,0,2.0.0,,MODERATE,,
 GHSA-99pg-hqvx-r4gf,2025-09-15T20:00:39Z,"Flowise has an Arbitrary File Read",flowise,3.0.5,3.0.6,,CRITICAL,CWE-22,
 GHSA-9c3v-684m-579c,2026-07-01T22:09:28Z,"OpenClaw MCP SSE redirects could forward Authorization headers",openclaw,0,2026.6.5,,MODERATE,CWE-200;CWE-522;CWE-601,
+GHSA-9c5c-9qcx-q35q,2026-09-30T14:41:39Z,"@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets",@nestjs/platform-fastify,0,11.2.4,,HIGH,CWE-288;CWE-436,
+GHSA-9c5c-9qcx-q35q,2026-09-30T14:41:39Z,"@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets",@nestjs/platform-fastify,12.0.0,12.0.2,,HIGH,CWE-288;CWE-436,
 GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,0,1.123.67,,MODERATE,CWE-20,
 GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-20,
 GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,2.32.0,2.32.1,,MODERATE,CWE-20,
 GHSA-9cph-cqqh-36pw,2020-09-04T15:29:25Z,"Malicious Package in babel-loqder",babel-loqder,0.0.0,,,CRITICAL,CWE-506,
+GHSA-9f3g-34x8-92jc,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor",vm2,3.9.6,,3.11.6,MODERATE,CWE-471,
 GHSA-9f72-qcpw-2hxc,2026-03-03T19:08:08Z,"OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs",openclaw,0,2026.2.24,,HIGH,CWE-200;CWE-284,
 GHSA-9f79-7pw8-3fj8,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf",openclaw,0,,2026.2.25,HIGH,CWE-22,
+GHSA-9fxx-mv6c-j5xp,2026-09-17T15:32:14Z,"Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE",vm2,3.11.4,,3.11.6,CRITICAL,CWE-913,
 GHSA-9ggv-8w38-r7pm,2026-06-19T19:18:49Z,"TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)",typeorm,0.1.12,0.3.29,,MODERATE,CWE-89,
 GHSA-9gvx-vj57-vqqx,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication",openclaw,0,2026.3.23,,MODERATE,CWE-288,
 GHSA-9gxr-rhx6-4jgv,2020-09-04T15:18:57Z,"Sandbox Breakout / Prototype Pollution in notevil",notevil,0,1.3.3,,MODERATE,CWE-1321,
@@ -8764,8 +8994,6 @@ GHSA-9h6g-pr28-7cqp,2024-01-31T22:42:54Z,"nodemailer ReDoS when trying to send a
 GHSA-9hc2-hjx8-q6pv,2026-07-14T19:52:41Z,"TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution",tidgi,0,,0.13.0,CRITICAL,CWE-94,
 GHSA-9hc2-w9gg-q6jw,2020-09-01T21:07:41Z,"Malicious Package in boogeyman",boogeyman,0.0.0,,,CRITICAL,CWE-506,
 GHSA-9hqj-38j2-5jgm,2020-09-01T21:19:23Z,"Command Injection in ascii-art",ascii-art,0,1.4.4,,LOW,CWE-77,
-GHSA-9hrv-gvrv-6gf2,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise,0,3.1.0,,MODERATE,CWE-918,
-GHSA-9hrv-gvrv-6gf2,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise-components,0,3.1.0,,MODERATE,CWE-918,
 GHSA-9j32-3m66-mc4m,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw: Hook mapping templates could bypass hook session-key opt-in",openclaw,0,2026.4.20,,MODERATE,CWE-863,
 GHSA-9m65-766c-r333,2026-05-14T16:37:10Z,"TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function","@tanstack/start-server-core",0,1.167.30,,MODERATE,CWE-502;CWE-843,
 GHSA-9mjp-gv34-3jcf,2020-09-02T18:37:35Z,"Malicious Package in aasync",aasync,0,,,CRITICAL,CWE-506,
@@ -8778,6 +9006,7 @@ GHSA-9ppg-jx86-fqw7,2026-02-19T15:17:10Z,"Unauthorized npm publish of cline@2.3.
 GHSA-9pr3-7449-977r,2020-09-02T18:21:26Z,"Cross-Site Scripting in express-cart",express-cart,0,,,LOW,CWE-79,
 GHSA-9px9-f7jw-fwhj,2020-09-03T15:49:37Z,"Command Injection in priest-runner",priest-runner,0.0.0,,,CRITICAL,CWE-77,
 GHSA-9q2p-vc84-2rwm,2026-03-09T19:54:46Z,"OpenClaw: system.run allow-always persistence included shell-commented payload tails",openclaw,0,2026.3.7,,MODERATE,CWE-436;CWE-863,
+GHSA-9q4r-4842-93vw,2026-10-02T22:42:20Z,"Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name",trigger.dev,0,4.5.6,,HIGH,CWE-639;CWE-89,
 GHSA-9q64-mpxx-87fg,2020-04-01T16:35:08Z,"Open Redirect in ecstatic",ecstatic,0,2.2.2,,HIGH,CWE-601,
 GHSA-9q64-mpxx-87fg,2020-04-01T16:35:08Z,"Open Redirect in ecstatic",ecstatic,3.0.0,3.3.2,,HIGH,CWE-601,
 GHSA-9q64-mpxx-87fg,2020-04-01T16:35:08Z,"Open Redirect in ecstatic",ecstatic,4.0.0,4.1.2,,HIGH,CWE-601,
@@ -8822,7 +9051,6 @@ GHSA-c27r-x354-4m68,2020-10-27T20:39:46Z,"xml-crypto's HMAC-SHA1 signatures can
 GHSA-c29c-2q9c-pc86,2026-07-02T16:43:38Z,"OpenClaw: Slack allowFrom could bind to mutable display names",openclaw,0,2026.5.3,,HIGH,CWE-290,
 GHSA-c2fv-2fmj-9xrx,2025-07-28T06:30:23Z,"Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability",ssrfcheck,0,1.2.0,,HIGH,CWE-918,
 GHSA-c2g6-57fp-22wp,2020-09-03T22:48:35Z,"Malicious Package in fuffer-xor",fuffer-xor,0.0.0,,,CRITICAL,CWE-506,
-GHSA-c2j3-45gr-mqc4,2026-07-21T19:41:07Z,"DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",dompurify,0,3.4.12,,LOW,CWE-184;CWE-693;CWE-79,
 GHSA-c35v-qwqg-87jc,2019-06-06T15:32:32Z,"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison",express-basic-auth,0,1.1.7,,LOW,CWE-208,
 GHSA-c3hq-7mxh-mqxf,2020-09-04T14:59:50Z,"Sandbox Breakout / Arbitrary Code Execution in lighter-vm",lighter-vm,0.0.0,,,CRITICAL,,
 GHSA-c3m8-x3cg-qm2c,2020-09-03T20:39:53Z,"Configuration Override in helmet-csp",helmet-csp,1.2.2,2.9.1,,MODERATE,,
@@ -8835,6 +9063,7 @@ GHSA-c53x-wwx2-pg96,2020-09-03T17:03:58Z,"Cross-Site Scripting in @berslucas/lil
 GHSA-c5j4-vw9m-xc95,2020-08-27T22:44:08Z,"Open Redirect in hekto",hekto,0,0.2.4,,LOW,,
 GHSA-c5xm-m64m-f2vq,2020-09-04T15:23:47Z,"Malicious Package in cxct",cxct,0.0.0,,,CRITICAL,CWE-506,
 GHSA-c6f3-3c98-2j2f,2020-09-02T21:39:46Z,"Malicious Package in jquerz",jquerz,0,,,CRITICAL,CWE-506,
+GHSA-c6fg-446q-cg94,2026-09-29T23:10:32Z,"adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path",adm-zip,0,0.6.1,,MODERATE,CWE-400;CWE-770,
 GHSA-c6h2-mpc6-232h,2020-08-27T22:26:15Z,"Command Injection in dns-sync",dns-sync,0,0.1.3,,MODERATE,,
 GHSA-c6m7-q6pr-c64r,2025-12-12T16:41:58Z,"Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components",@vitejs/plugin-rsc,0,0.5.7,,MODERATE,CWE-1395;CWE-497;CWE-502,
 GHSA-c7hr-448w-65px,2026-08-18T20:09:35Z,"MeshCentral has unsanitized data fields",meshcentral,0,1.1.60,,HIGH,CWE-20;CWE-74,
@@ -8894,6 +9123,7 @@ GHSA-crvj-3gj9-gm2p,2018-10-09T00:44:29Z,"High severity vulnerability that affec
 GHSA-cv3v-7846-6pxm,2020-09-03T21:15:19Z,"Unauthorized File Access in node-git-server",node-git-server,0.2.0,0.6.1,,HIGH,CWE-552,
 GHSA-cvfm-xjc8-f2vm,2020-09-03T15:46:36Z,"Denial of Service in @commercial/subtext",@commercial/subtext,5.1.1,5.1.2,,HIGH,,
 GHSA-cw28-63x4-37c3,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection",openclaw,0,2026.3.31,,MODERATE,CWE-367,
+GHSA-cw3j-28qq-x3xh,2026-07-01T00:34:02Z,"Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,,,MODERATE,CWE-113,
 GHSA-cwj3-vqpp-pmxr,2026-05-05T18:44:31Z,"OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes",openclaw,0,2026.4.23,,HIGH,CWE-862,
 GHSA-cx7r-634m-2q2h,2020-09-02T18:20:21Z,"Cross-Site Scripting in harp",harp,0,,,MODERATE,,
 GHSA-cxcw-jm67-3wwp,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication",openclaw,0,,,HIGH,CWE-306,
@@ -8938,8 +9168,10 @@ GHSA-ff6g-gm92-rf32,2020-09-03T19:42:06Z,"Malicious Package in coinstirng",coins
 GHSA-ff98-w8hj-qrxf,2026-03-03T21:39:26Z,"OpenClaw plugin runtime command execution is part of trusted plugin boundary",openclaw,0,2026.2.19,,MODERATE,CWE-78,
 GHSA-ffhm-8fwq-7q27,2026-06-13T00:34:32Z,"Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks",openclaw,0,2026.5.12,,HIGH,CWE-184,
 GHSA-ffr4-mrhv-vfr2,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw has browser trace/download path symlink escape in temp output handling",openclaw,0,,,MODERATE,CWE-59,
+GHSA-fg72-q65g-wm5w,2026-09-06T12:30:23Z,"Duplicate Advisory: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,,,HIGH,CWE-400,
 GHSA-fgp6-8g62-qx6w,2020-09-03T17:01:45Z,"Malicious Package in smartsearchwp",smartsearchwp,0,,,CRITICAL,CWE-506,
 GHSA-fhp4-pr5j-46m5,2026-06-26T20:55:18Z,"Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key",muhammara,0,6.0.5,,HIGH,CWE-476,
+GHSA-fj2x-mqqp-3v2w,2026-10-02T22:45:12Z,"Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values",trigger.dev,0,4.5.9,,MODERATE,CWE-532,
 GHSA-fj93-7wm4-8x2g,2020-09-02T21:22:47Z,"Cross-Site Scripting in jquery-mobile",jquery-mobile,0,,,HIGH,CWE-79,
 GHSA-fjh6-8679-9pch,2025-11-14T20:57:31Z,"Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change",flowise-ui,0,3.0.10,,HIGH,CWE-306;CWE-620,
 GHSA-fjm8-mgc9-mf65,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability",openclaw,0,2026.3.31,,MODERATE,CWE-497,
@@ -8991,6 +9223,7 @@ GHSA-g43v-9x7q-83pq,2026-05-21T20:43:58Z,"@hulumi/policies: HULUMI-H1 SecureBuck
 GHSA-g485-8j3v-p6x8,2026-05-05T18:28:32Z,"@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin","@tdurieux/anonymous_github",2.2.0,2.3.0,,HIGH,CWE-79;CWE-80,
 GHSA-g49q-jw42-6x85,2024-05-09T21:31:35Z,"thelounge may publicly disclose of all usernames/idents via port 113",thelounge,0,,4.4.3,LOW,,
 GHSA-g4m3-rpxr-h7vg,2020-09-03T19:52:25Z,"Malicious Package in mogodb-core",mogodb-core,0.0.0,,,CRITICAL,CWE-506,
+GHSA-g57g-f23g-4646,2026-09-29T23:44:04Z,"Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing",nodemailer,9.1.0,10.0.9,,MODERATE,CWE-20;CWE-436,
 GHSA-g5q2-fcg9-j526,2020-09-03T17:40:18Z,"Malicious Package in hsf-clients",hsf-clients,0.0.0,,,CRITICAL,CWE-506,
 GHSA-g64q-3vg8-8f93,2020-09-03T15:47:10Z,"Prototype Pollution in pez",pez,0.0.0,,,HIGH,CWE-1321,
 GHSA-g6f4-j6c2-w3p3,2018-10-09T00:39:43Z,"High severity vulnerability that affects uglify-js",uglify-js,0,2.4.24,,HIGH,,
@@ -9031,6 +9264,7 @@ GHSA-gfjr-xqhm-qvv3,2020-09-02T20:16:09Z,"Malicious Package in aysnc",aysnc,0,,,
 GHSA-gfm8-g3vm-53jh,2020-09-03T17:21:19Z,"Malicious Package in leetlog",leetlog,0.1.2,,,CRITICAL,CWE-506,
 GHSA-gfmx-pph7-g46x,2026-04-09T14:22:14Z,"OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade",openclaw,0,2026.4.8,,HIGH,CWE-501,
 GHSA-gfp8-mp24-5vxg,2026-05-21T20:43:27Z,"@hulumi/baseline: CloudTrail selector tampering events were not fully detected",@hulumi/baseline,0,1.3.2,,MODERATE,CWE-778,
+GHSA-gg6r-gp4c-89hp,2026-10-02T22:39:00Z,"Trigger.dev: V1 coordinator default-secret unauth Socket.IO",trigger.dev,0,4.5.4,,CRITICAL,CWE-200;CWE-798;CWE-862,
 GHSA-ggm6-h3mx-cmmp,2026-03-19T03:30:57Z,"Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags",openclaw,0,,2026.2.17,LOW,CWE-78,
 GHSA-ghvf-qf6h-g8x5,2026-08-20T18:42:21Z,"NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution",@nocobase/server,0,2.1.5,,HIGH,"CWE-209;CWE-434;CWE-73;CWE-829",
 GHSA-gj2h-2fpw-fhv9,2026-07-02T20:16:12Z,"@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration",@nuxt/ui,0,4.8.1,,MODERATE,CWE-200;CWE-598,
@@ -9112,6 +9346,7 @@ GHSA-h9h6-pwqv-j9hv,2026-06-16T21:32:00Z,"Duplicate Advisory: Bootstrap token re
 GHSA-h9wq-xcqx-mqxm,2023-07-11T22:46:19Z,"Vendure Cross Site Request Forgery vulnerability impacting all API requests",@vendure/core,0,2.0.3,,LOW,,
 GHSA-h9wr-xr4r-66fh,2020-09-03T18:20:20Z,"Cross-Site Scripting in dmn-js-properties-panel",dmn-js-properties-panel,0,0.3.0,,HIGH,CWE-79,
 GHSA-hc4w-hm59-9w88,2026-06-16T21:31:59Z,"Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment",openclaw,0,,2026.4.24,LOW,CWE-636,
+GHSA-hc6q-4vvg-jf79,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts",vm2,0,,3.11.6,CRITICAL,CWE-453,
 GHSA-hcm3-8f6r-6xwg,2026-07-02T16:54:44Z,"OpenClaw: Browser debug/export routes could reuse already-open blocked tabs",openclaw,0,2026.4.29,,MODERATE,CWE-862,
 GHSA-hfpr-jhpq-x4rm,2026-03-09T19:54:41Z,"OpenClaw: `operator.write` chat.send could reach admin-only config writes",openclaw,0,2026.3.7,,MODERATE,CWE-863,
 GHSA-hfwx-c7q6-g54c,2021-03-12T23:04:46Z,"Vulnerability allowing for reading internal HTTP resources",highcharts-export-server,0,2.1.0,,HIGH,CWE-552,
@@ -9130,6 +9365,7 @@ GHSA-hj5w-xgw9-w4rj,2020-09-03T19:41:44Z,"Malicious Package in coinstrng",coinst
 GHSA-hjwh-xvfw-qrwj,2026-08-19T19:32:46Z,"SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses",mcp-searxng,0,1.12.0,,MODERATE,CWE-209;CWE-532,
 GHSA-hm63-vwj4-mj2q,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure",openclaw,0,2026.3.22,,MODERATE,CWE-789,
 GHSA-hmfr-rx46-4jx2,2025-08-26T18:42:37Z,"GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation","@escape.tech/graphql-armor-max-depth",0,2.4.2,,MODERATE,CWE-400,
+GHSA-hmpr-c9rf-qcrf,2026-09-17T15:32:16Z,"Duplicate Advisory: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks",vm2,3.11.4,,3.11.6,HIGH,CWE-669,
 GHSA-hpfq-8wx8-cgqw,2019-06-13T18:59:18Z,"Cross-Site Scripting in ids-enterprise",ids-enterprise,0,4.18.2,,HIGH,CWE-79,
 GHSA-hpr5-wp7c-hh5q,2020-09-01T19:37:29Z,"Cross-Site Scripting in mrk.js",mrk.js,0,2.0.1,,HIGH,CWE-79,
 GHSA-hq75-xg7r-rx6c,2025-07-11T17:09:53Z,"Better Call routing bug can lead to Cache Deception",better-call,0,1.0.12,,MODERATE,CWE-525,
@@ -9146,9 +9382,11 @@ GHSA-hvqh-jw65-wcpq,2026-06-22T23:00:50Z,"devbridge-autocomplete has XSS in its
 GHSA-hvxq-j2r4-4jm8,2020-09-03T20:31:04Z,"Regular Expression Denial of Service in sql-injection",sql-injection,0.0.0,,,HIGH,,
 GHSA-hw9r-h9mr-4jff,2026-07-02T16:06:00Z,"OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
 GHSA-hwh3-fhf6-73x9,2020-09-04T15:36:09Z,"Malicious Package in bictoinjs-lib",bictoinjs-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-hwr5-cm8v-c76q,2026-09-17T15:32:14Z,"Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector",vm2,3.10.2,,3.11.6,CRITICAL,CWE-693,
 GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,0,1.123.67,,MODERATE,CWE-1321,
 GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-1321,
 GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,2.32.0,2.32.1,,MODERATE,CWE-1321,
+GHSA-hx4r-w6wj-j8fg,2026-10-01T15:17:42Z,"devalue: Residual sparse-array CPU amplification in uneval",devalue,0,5.9.3,,MODERATE,CWE-400;CWE-407,
 GHSA-hx4v-668p-g2qr,2026-05-29T18:31:33Z,"Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity",openclaw,0,2026.5.18,,HIGH,CWE-862,
 GHSA-hx5x-49mm-vmhw,2020-09-03T02:36:43Z,"SQL Injection in sails-mysql",sails-mysql,0,0.10.8,,HIGH,CWE-89,
 GHSA-hx78-272p-mqqh,2020-09-03T19:21:11Z,"Authorization Bypass in graphql-shield",graphql-shield,0,6.0.6,,LOW,CWE-285,
@@ -9235,6 +9473,7 @@ GHSA-jwm3-qcfw-c5pp,2026-06-16T22:39:46Z,"n8n: Python Code Node AST Validator By
 GHSA-jx3c-247h-cxwp,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code",openclaw,0,2026.3.31,,HIGH,CWE-829,
 GHSA-jxf5-7x3j-8j9m,2020-09-03T18:19:14Z,"Malicious Package in load-from-cwd-or-npm",load-from-cwd-or-npm,3.0.2,3.0.4,,CRITICAL,CWE-506,
 GHSA-jxh8-jh77-xh6g,2026-05-05T21:15:55Z,"@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts",@evomap/evolver,0,1.70.0-beta.5,,HIGH,CWE-78,
+GHSA-jxrp-r7gx-q4j8,2026-07-24T15:33:01Z,"Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",dompurify,0,,3.4.11,MODERATE,CWE-79,
 GHSA-jxrq-8fm4-9p58,2026-03-03T23:09:31Z,"OpenClaw: Zip extraction symlink traversal could write outside destination",openclaw,0,2026.2.22,,HIGH,CWE-59,
 GHSA-m2fp-c79h-rr79,2020-09-02T21:42:56Z,"Malicious Package in tensorplow",tensorplow,0,,,CRITICAL,CWE-506,
 GHSA-m36m-x4c5-rjxj,2020-09-01T19:01:58Z,"Silently Runs Cryptocoin Miner in hooka-tools",hooka-tools,0.0.0,,,LOW,,
@@ -9259,6 +9498,7 @@ GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect A
 GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior",@openzeppelin/contracts,4.3.0,4.4.2,,MODERATE,,
 GHSA-m734-r4g6-34f9,2019-06-04T19:36:17Z,"NoSQL Injection in loopback-connector-mongodb","loopback-connector-mongodb",0,3.6.0,,HIGH,CWE-89,
 GHSA-m794-qv59-gj7c,2020-09-03T17:03:22Z,"Malicious Package in signqle",signqle,0.0.0,,,CRITICAL,CWE-506,
+GHSA-m7cq-7f2q-f9fh,2026-09-17T15:32:14Z,"Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`",vm2,3.11.3,,3.11.6,CRITICAL,CWE-693,
 GHSA-m7jc-p4hf-xhwq,2026-07-22T12:32:17Z,"Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,0,,,HIGH,CWE-917,
 GHSA-m7qm-r2r5-f77q,2020-09-01T20:43:48Z,"Cross-Site Scripting in react-marked-markdown",react-marked-markdown,0.0.0,,,HIGH,CWE-79,
 GHSA-m837-xvxr-vqwg,2026-05-20T15:38:02Z,"Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage",flowise,0,3.1.2,,MODERATE,CWE-942,
@@ -9278,6 +9518,7 @@ GHSA-m9c9-mc2h-9wjw,2025-01-14T22:04:02Z,"Lodestar snappy checksum issue",@lodes
 GHSA-m9hw-7xfv-wqg7,2020-11-12T19:36:14Z,"Prototype Pollution in json-logic-js",json-logic-js,0,2.0.0,,HIGH,CWE-471,
 GHSA-m9r7-q9fc-qwx5,2020-09-03T17:22:24Z,"Malicious Package in maybemaliciouspackage",maybemaliciouspackage,0.0.0,,,CRITICAL,CWE-506,
 GHSA-mc84-xr9p-938r,2019-09-23T18:31:05Z,"High severity vulnerability that affects generator-jhipster",generator-jhipster,0,6.3.1,,HIGH,CWE-494;CWE-829,
+GHSA-mcm9-63f2-9j32,2026-10-01T15:17:29Z,"devalue: Repeated primitive strings cause quadratic expansion in uneval",devalue,0,5.9.3,,HIGH,CWE-400;CWE-409,
 GHSA-mf69-r24q-ghhr,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account",openclaw,2026.2.26,2026.3.31,,MODERATE,CWE-799,
 GHSA-mf74-qq7w-6j7v,2024-02-03T00:38:22Z,"Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images",remark-images-download,0,3.1.0,,MODERATE,,
 GHSA-mfc2-93pr-jf92,2020-10-01T17:10:15Z,"Malicious code in `loadyaml`",loadyaml,0,,1.0.2,CRITICAL,CWE-506,
@@ -9330,6 +9571,7 @@ GHSA-mxq6-vrrr-ppmg,2022-05-24T17:04:00Z,"Duplicate Advisory: tree-kill vulnerab
 GHSA-p2fh-f5fc-44hr,2026-07-02T16:18:02Z,"OpenClaw: memory-wiki ingest could read local files with operator.write scope",openclaw,0,2026.5.12,,MODERATE,CWE-732,
 GHSA-p2fr-6hmx-4528,2026-07-07T20:54:32Z,"@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators","@better-auth/oauth-provider",1.4.8,1.7.0-beta.4,,MODERATE,CWE-285;CWE-863,
 GHSA-p33q-w45h-2hcj,2020-09-02T18:30:03Z,"Malicious Package in 4equest",4equest,0,,,CRITICAL,CWE-506,
+GHSA-p3f5-w63m-mxph,2026-08-24T15:31:51Z,"Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",webpack-dev-middleware,0,,,HIGH,CWE-22,
 GHSA-p3h2-2j4p-p83g,2026-04-22T20:50:19Z,"MCPHub has Path Traversal via Malicious MCPB Manifest Name",@samanhappy/mcphub,0,0.12.13,,HIGH,CWE-22,
 GHSA-p3jx-g34v-q56j,2020-09-03T22:54:02Z,"Malicious Package in j3-sha3",j3-sha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p3m6-jr2h-hhxj,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config",openclaw,0,2026.4.20,,MODERATE,CWE-829,
@@ -9341,6 +9583,7 @@ GHSA-p4mf-4qvh-w8g5,2020-09-04T15:41:42Z,"Malicious Package in bitcionjslib",bit
 GHSA-p56r-jr4p-4wgh,2020-08-03T18:16:37Z,Withdrawn,whereis,0,0.4.1,,HIGH,,
 GHSA-p5p2-rhc3-wmf3,2020-09-03T17:03:31Z,"Malicious Package in siganle",siganle,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p62r-jf56-h429,2020-09-03T20:29:58Z,"Malicious Package in evil-package",evil-package,0.0.0,,,CRITICAL,CWE-506,
+GHSA-p634-w6r4-rjp2,2026-09-29T23:11:01Z,"adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content",adm-zip,0,0.6.1,,MODERATE,CWE-436;CWE-696,
 GHSA-p68j-q8j9-jwf5,2026-06-13T00:34:32Z,"Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload",openclaw,0,2026.4.22,,MODERATE,CWE-613,
 GHSA-p6j4-wvmc-vx2h,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete",openclaw,0,2026.3.22,,MODERATE,CWE-696,
 GHSA-p72p-rjr2-r439,2019-05-29T20:24:02Z,"Server-Side Request Forgery in terriajs-server",terriajs-server,0,2.7.4,,HIGH,CWE-918,
@@ -9353,6 +9596,7 @@ GHSA-p7qp-3fh7-pv4p,2020-09-03T22:24:04Z,"Malicious Package in buffur-xor",buffu
 GHSA-p7w7-4929-vpj5,2026-07-31T16:05:57Z,"`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation","@dynatrace-oss/dynatrace-mcp-server",0,2.0.0,,HIGH,CWE-306,
 GHSA-p8fm-w787-x6x3,2020-09-02T15:50:28Z,"Malicious Package in portionfatty12",portionfatty12,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p94w-42g3-f7h4,2020-03-06T01:16:00Z,"Holder can (re)create authentic credentials after receiving a credential in vp-toolkit",vp-toolkit,0,0.2.2,,HIGH,,
+GHSA-p98j-92pf-mc4p,2026-09-30T15:37:57Z,"DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS",dompurify,3.4.13,3.4.16,,LOW,CWE-79,
 GHSA-p9g3-vpvp-hcj5,2020-09-03T21:41:55Z,"Malicious Package in bufber-xor",bufber-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p9vv-3945-x93h,2020-09-02T15:47:10Z,"Cross-Site Scripting in semantic-ui-search",semantic-ui-search,0,,,HIGH,CWE-79,
 GHSA-pc2w-4mq8-32qw,2026-07-29T15:36:19Z,"@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate","@dynatrace-oss/dynatrace-mcp-server",0,1.8.7,,LOW,CWE-862,
@@ -9380,12 +9624,15 @@ GHSA-pm9v-325f-5g74,2020-09-02T21:30:11Z,"Malicious Package in saync",saync,0,,,
 GHSA-pmf3-2q63-jmp6,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)",openclaw,0,,2026.2.22,MODERATE,CWE-61,
 GHSA-pmgv-94f5-6w7w,2020-09-02T20:21:30Z,"Malicious Package in eact",eact,0,,,CRITICAL,CWE-506,
 GHSA-pmpg-2mxq-6xwr,2026-07-24T21:43:34Z," Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete",@budibase/server,0,,3.38.1,HIGH,CWE-89,
+GHSA-pp95-gc86-jq6q,2026-10-02T22:35:24Z,"Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)",trigger.dev,0,4.5.2,,HIGH,CWE-862,
 GHSA-ppwq-6v66-5m6j,2026-03-26T21:15:59Z,"OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status",openclaw,0,2026.3.22,,MODERATE,CWE-200;CWE-212;CWE-522,
 GHSA-pqh8-p93p-2rx7,2026-07-31T15:56:12Z,"@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL","@dynatrace-oss/dynatrace-mcp-server",0,2.1.1,,MODERATE,CWE-943,
 GHSA-pqhp-25j4-6hq9,2024-11-22T20:40:49Z,"smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables",smol-toml,0,1.3.1,,MODERATE,CWE-674,
 GHSA-pqhr-mp3f-hrpp,2026-03-31T23:26:29Z,"Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters",nuxt-og-image,0,6.2.5,,MODERATE,CWE-918,
 GHSA-pqpp-2363-649v,2020-09-02T18:22:30Z,"Cross-Site Scripting in buttle",buttle,0,,,MODERATE,CWE-79,
+GHSA-pqxw-g93w-hj9x,2026-10-02T22:39:48Z,"Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise",trigger.dev,0,4.5.6,,HIGH,CWE-1393;CWE-653,
 GHSA-pr66-whqj-rq5p,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message",openclaw,0,2026.3.31,,LOW,CWE-351,
+GHSA-prgh-xp8r-p3m5,2026-09-30T14:41:01Z,"Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)",nodemailer,9.1.0,10.0.5,,HIGH,CWE-400;CWE-407,
 GHSA-prmc-5v5w-c465,2021-04-06T17:32:38Z,"Client TLS credentials sent raw to server in npm package nats",nats,2.0.0-201,2.0.0-209,,CRITICAL,CWE-522,
 GHSA-pv6r-vchh-cxg9,2020-09-03T20:42:09Z,"Denial of Service in apostrophe",apostrophe,0,2.97.1,,LOW,CWE-400,
 GHSA-pvcr-8mvp-w8qr,2026-07-24T21:42:51Z," Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)",@budibase/server,0,,3.38.1,HIGH,CWE-285;CWE-345;CWE-352,
@@ -9411,12 +9658,11 @@ GHSA-q4gf-8mx6-v5v3,2026-04-10T15:35:47Z,"Next.js has a Denial of Service with S
 GHSA-q4h9-46xg-m3x9,2021-09-15T20:22:13Z,"UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable","@openzeppelin/contracts-upgradeable",4.1.0,4.3.2,,CRITICAL,,
 GHSA-q4pp-j36h-3gqg,2023-08-24T12:53:06Z,"Minimal `basti` IAM Policy Allows Shell Access",basti-cdk,0,1.0.1,,LOW,,
 GHSA-q4xx-mc3q-23x8,2025-08-14T12:30:22Z,"Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection",flowise,0,,3.0.5,CRITICAL,CWE-94,
+GHSA-q567-cr4x-96w4,2026-10-02T22:35:31Z,"Trigger.dev: Blind SSRF via alert-channel webhook",trigger.dev,0,4.5.2,,MODERATE,CWE-918,
 GHSA-q5pp-5q2h-g8rv,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,,,MODERATE,CWE-79,
-GHSA-q5pr-72pq-83v3,2026-03-23T21:44:55Z,"H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,2.0.1-rc.18,,MODERATE,CWE-400,
 GHSA-q643-w9jp-q2qg,2020-09-04T17:34:59Z,"Hardcoded Initialization Vector in parsel",parsel,0.0.0,,,HIGH,,
 GHSA-q67q-549q-p849,2025-09-15T20:11:39Z,"Flowise has arbitrary file access due to missing chat flow id validation",flowise,2.2.8,3.0.6,,CRITICAL,CWE-22,
 GHSA-q6mx-qvhp-fqmg,2026-07-15T12:32:03Z,"Duplicate Advisory: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,0,,,MODERATE,CWE-639,
-GHSA-q7jf-gf43-6x6p,2025-10-24T19:15:13Z,"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,4.10.3,,MODERATE,CWE-444,
 GHSA-q83v-hq3j-4pq3,2024-08-15T06:32:22Z,"Duplicate Advisory: Improper access control in Directus",directus,0,,10.13.0,MODERATE,CWE-639,
 GHSA-q849-wxrc-vqrp,2024-12-02T20:11:39Z,"hull.js Code Injection Vulnerability",hull.js,0.2.2,1.0.10,,CRITICAL,CWE-94,
 GHSA-q86m-697p-h7fh,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind",openclaw,0,,,MODERATE,CWE-367,
@@ -9448,6 +9694,7 @@ GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via ma
 GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency",@metamask/sdk-react,0.16.0,0.33.1,,MODERATE,CWE-506,
 GHSA-qjfh-xc44-rm9x,2020-09-03T16:49:43Z,"Path Traversal in file-static-server",file-static-server,0.0.0,,,HIGH,CWE-22,
 GHSA-qjpc-qf9m-xwmr,2026-07-02T16:43:53Z,"OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
+GHSA-qjrq-cvv4-3g9w,2026-09-08T00:30:22Z,"Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools",knowns,0,,,HIGH,CWE-22,
 GHSA-qm4q-f956-fg64,2020-09-03T17:39:13Z,"Malicious Package in luna-mock",luna-mock,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,2.0.0,2.25.3,,HIGH,CWE-79,
 GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,3.0.0,3.4.1,,HIGH,CWE-79,
@@ -9480,6 +9727,7 @@ GHSA-qwmf-95r9-gx9x,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's gateway
 GHSA-qwww-vcr4-c8h2,2026-07-24T16:44:43Z,"React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response",react-router,7.12.0,7.18.2,,HIGH,CWE-352,
 GHSA-qwww-vcr4-c8h2,2026-07-24T16:44:43Z,"React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response",react-router,8.0.0,8.3.0,,HIGH,CWE-352,
 GHSA-qx4v-6gc5-f2vv,2019-06-20T14:32:56Z,"Regular Expression Denial of Service",esm,0,3.1.0,,MODERATE,CWE-400,
+GHSA-qxpp-qjg8-x4jv,2026-10-02T19:31:17Z,"Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)",trigger.dev,0,4.5.2,,HIGH,CWE-639,
 GHSA-qxrj-x7rm-2h49,2020-09-03T17:05:59Z,"Malicious Package in dhkey",dhkey,0.0.0,,,CRITICAL,CWE-506,
 GHSA-r27j-894h-3w3p,2026-05-06T17:32:01Z,"mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`",icu-minify,0,4.9.2,,LOW,CWE-1321,
 GHSA-r27j-fxmq-rg2q,2026-06-13T00:34:32Z,"Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom",openclaw,0,2026.4.29,,HIGH,CWE-290,
@@ -9491,6 +9739,7 @@ GHSA-r2rg-683g-ff96,2020-09-03T19:40:12Z,"Malicious Package in axios-http",axios
 GHSA-r2vw-jgq9-jqx2,2020-09-03T15:54:11Z,"Improper Authorization in @sap-cloud-sdk/core",@sap-cloud-sdk/core,1.19.0,1.21.2,,HIGH,CWE-285,
 GHSA-r32x-jhw5-g48p,2020-09-03T17:08:20Z,"Cross-Site Scripting in eco",eco,0.0.0,,,HIGH,CWE-79,
 GHSA-r3hf-q8q7-fv2p,2023-08-09T12:51:51Z,"Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory",@nguniversal/common,16.1.0,16.1.2,,HIGH,CWE-79,
+GHSA-r3ph-w7gj-g6xm,2026-09-29T17:57:39Z,"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",js-yaml,5.0.0,5.4.1,,MODERATE,CWE-400;CWE-407,
 GHSA-r3v5-2grc-429h,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve",openclaw,0,2026.3.22,,HIGH,CWE-648,
 GHSA-r3vq-92c6-3mqf,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize - Unsafe fall-through in getWhereConditions",@sequelize/core,0,7.0.0-alpha.20,,HIGH,CWE-843,
 GHSA-r3xc-47qg-h929,2020-09-03T17:06:09Z,"Cross-Site Scripting in @ionic/core",@ionic/core,0,4.0.3,,HIGH,CWE-79,
@@ -9527,6 +9776,7 @@ GHSA-r863-p739-275c,2020-09-11T21:09:24Z,"Malicious Package in reuest",reuest,0,
 GHSA-r8hx-3qx6-hxq9,2020-09-03T19:41:14Z,"Malicious Package in commandre",commandre,0.0.0,,,CRITICAL,CWE-506,
 GHSA-r9cj-xj33-4q42,2020-09-03T22:21:54Z,"Malicious Package in buffgr-xor",buffgr-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-r9q4-w3fm-wrm2,2020-09-02T21:21:43Z,"Cross-Site Scripting in google-closure-library",google-closure-library,0,20190301.0.0,,MODERATE,CWE-79,
+GHSA-r9w8-h9r3-54w4,2026-10-01T15:15:56Z,"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation",devalue,0,5.9.3,,HIGH,CWE-789;CWE-843,
 GHSA-rc4v-99cr-pjcm,2023-10-17T14:21:16Z,"Prototype Pollution in ali-security/mongoose","@seal-security/mongoose-fixed",5.3.3,5.3.4,,CRITICAL,CWE-1321,
 GHSA-rc8f-r29c-chr6,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing",openclaw,0,,2026.3.24,MODERATE,CWE-307,
 GHSA-rch7-f4h5-x9rj,2019-08-23T00:04:52Z,"Identity Spoofing in libp2p-secio",libp2p-secio,0,0.9.0,,CRITICAL,CWE-290,
@@ -9535,6 +9785,7 @@ GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in t
 GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-78,
 GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,2.32.0,2.32.1,,HIGH,CWE-78,
 GHSA-rcv7-4w2m-gj9v,2020-09-03T23:24:26Z,"Malicious Package in sj-tw-test-security",sj-tw-test-security,0.0.0,,,CRITICAL,CWE-506,
+GHSA-rcw4-f5rp-g42v,2026-09-29T18:25:20Z,"adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0",adm-zip,0,0.6.1,,HIGH,CWE-409,
 GHSA-rcx4-77x4-hjx5,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata",openclaw,0,,2026.2.22-2,MODERATE,CWE-807,
 GHSA-rf75-g96h-j3rm,2026-04-02T21:32:52Z,"Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation",openclaw,0,2026.4.2,,MODERATE,CWE-184,
 GHSA-rffp-mc78-wjf7,2020-09-02T18:26:48Z,"Command Injection in cocos-utils",cocos-utils,0,,,HIGH,CWE-77,
@@ -9580,6 +9831,7 @@ GHSA-v52w-28xh-v562,2026-06-19T20:47:19Z,"Kozou: Unauthenticated MCP HTTP server
 GHSA-v52w-28xh-v562,2026-06-19T20:47:19Z,"Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)",@kozou/core,0,1.8.1,,HIGH,"CWE-1188;CWE-272;CWE-346;CWE-770",
 GHSA-v52w-28xh-v562,2026-06-19T20:47:19Z,"Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)",@kozou/mcp,0,1.8.1,,HIGH,"CWE-1188;CWE-272;CWE-346;CWE-770",
 GHSA-v52w-28xh-v562,2026-06-19T20:47:19Z,"Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)",kozou,0,1.8.1,,HIGH,"CWE-1188;CWE-272;CWE-346;CWE-770",
+GHSA-v53p-9fqp-m79j,2026-09-29T23:43:36Z,"Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service",nodemailer,0,10.0.6,,HIGH,CWE-1333;CWE-407,
 GHSA-v66p-w7qx-wv98,2020-09-04T17:29:34Z,"Authentication Bypass in express-laravel-passport",express-laravel-passport,0.0.0,,,CRITICAL,CWE-287,
 GHSA-v6cj-r88p-92rm,2019-09-30T19:31:59Z,"Buffer Overflow in centra",centra,0,2.4.0,,HIGH,CWE-119,
 GHSA-v6gv-fg46-h89j,2020-09-03T16:48:36Z,"Sensitive Data Exposure in put",put,0,,,LOW,CWE-200,
@@ -9591,13 +9843,13 @@ GHSA-v836-6xw4-9cx3,2026-08-17T17:32:57Z,"vm2 has Memory Exhaustion DoS via buff
 GHSA-v86x-f47q-f7f4,2020-09-11T21:09:24Z,"Unauthorized File Access in atompm",atompm,0,0.8.2,,HIGH,CWE-200,
 GHSA-v8g7-9qv2-j865,2020-09-04T16:38:55Z,"Malicious Package in bitcoin-osp",bitcoin-osp,0.0.0,,,CRITICAL,CWE-506,
 GHSA-v8j2-5f9p-fmh4,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload",openclaw,0,2026.4.23,,MODERATE,CWE-672,
-GHSA-v8w9-8mx6-g223,2026-03-11T00:31:47Z,"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })",hono,0,4.12.7,,MODERATE,CWE-1321,
 GHSA-v95x-h953-x7fg,2020-09-03T19:47:55Z,"Malicious Package in k0a_multer",k0a_multer,0.0.0,,,CRITICAL,CWE-506,
 GHSA-v99v-xgjx-7m7g,2020-09-02T18:40:47Z,"Malicious Package in asnyc",asnyc,0,,,CRITICAL,CWE-506,
 GHSA-v9wp-8r97-v6xg,2020-09-03T17:17:00Z,"Cross-Site Scripting in jquery.json-viewer",jquery.json-viewer,0,1.3.0,,HIGH,CWE-79,
 GHSA-vc6r-4x6g-mmqc,2019-06-11T16:16:23Z,"Path Traversal in m-server",m-server,0,1.4.2,,MODERATE,CWE-22,
 GHSA-vcg5-9xw6-r56c,2020-09-02T21:40:49Z,"Malicious Package in logsymbles",logsymbles,0,,,CRITICAL,CWE-506,
 GHSA-vcv2-r9jh-99m5,2026-06-19T15:12:58Z,"Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync",agentic-flow,0,2.0.14,,HIGH,CWE-78,
+GHSA-vcvr-r3jv-pc5j,2026-09-30T14:48:30Z,"Next.js: Remote Code Execution in next/og ImageResponse",next,16.2.0,16.3.6,,CRITICAL,CWE-1395,
 GHSA-vf5m-q45w-8mh9,2020-09-03T23:00:25Z,"Malicious Package in js-qha3",js-qha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-vf8q-pw7h-r2x2,2020-09-11T21:15:54Z,"Malicious Package in epress",epress,0,,,CRITICAL,CWE-506,
 GHSA-vg44-fw64-cpjx,2020-03-24T15:08:59Z,"Incorrect Account Used for Signing","@metamask/eth-ledger-bridge-keyring",0,0.2.2,,HIGH,CWE-287,
@@ -9683,7 +9935,9 @@ GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-lambda,0,2.14.2,,MODERATE,,
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-micro,0,2.14.2,,MODERATE,,
 GHSA-w46p-w7w2-fr9g,2026-07-22T12:32:17Z,"Duplicate Advisory:  AI Agents Project Viewer Privilege Escalation via run_node_tool",n8n,0,,,HIGH,CWE-863,
+GHSA-w47m-jpv2-qfw5,2026-09-10T18:31:45Z,"Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem",knowns,0,,,CRITICAL,CWE-73,
 GHSA-w48f-fwg7-ww6p,2026-04-04T04:24:27Z,"@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding",@stablelib/cbor,0,2.0.3,,HIGH,CWE-1321,
+GHSA-w4hm-rrxg-pxcf,2026-06-23T15:32:36Z,"Duplicate Advisory: Flowise Execute Flow function has an SSRF vulnerability",flowise,0,3.1.0,,MODERATE,CWE-918,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/core,0,,0.1.142,HIGH,,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/server,0,,0.56.0,HIGH,,
 GHSA-w4v6-g3wm-w36c,2026-07-02T16:48:45Z,"OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy",openclaw,0,2026.4.29,,CRITICAL,CWE-863,
@@ -9702,6 +9956,7 @@ GHSA-w6v6-49gh-mc9w,2026-04-16T21:22:49Z,"Flowise: Path Traversal in Vector Stor
 GHSA-w6v6-49gh-mc9w,2026-04-16T21:22:49Z,"Flowise: Path Traversal in Vector Store basePath",flowise-components,0,3.1.0,,MODERATE,CWE-22,
 GHSA-w6wx-jq6j-6mcj,2026-04-07T18:15:52Z,"OpenClaw: pnpm dlx approvals did not bind local script operands",openclaw,0,2026.4.2,,MODERATE,CWE-863,
 GHSA-w725-67p7-xv22,2020-09-03T17:05:04Z,"Command Injection in local-devices",local-devices,0,3.0.0,,HIGH,CWE-77,
+GHSA-w72q-x6w3-7rj3,2026-08-04T18:31:26Z,"Duplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions",@a2ui/web_core,0.9.0,,,MODERATE,CWE-79,
 GHSA-w7j5-j98m-w679,2026-03-03T22:25:13Z,"OpenClaw has multiple E2E/test Dockerfiles that run all processes as root",openclaw,0,2026.2.21,,HIGH,CWE-250,
 GHSA-w7m7-3xcf-mp48,2026-06-16T21:31:59Z,"Duplicate Advisory: Zalo allowFrom could bind to mutable display names",openclaw,0,,2026.5.2,HIGH,CWE-290,
 GHSA-w7q7-vjp8-7jv4,2019-06-06T15:30:16Z,"SQL Injection in typeorm",typeorm,0,0.1.15,,CRITICAL,CWE-89,
@@ -9723,6 +9978,7 @@ GHSA-w9q5-mvc6-5cw3,2020-09-03T21:45:13Z,"Malicious Package in bufder-xor",bufde
 GHSA-wc7q-qpm4-8pqv,2020-09-02T20:32:10Z,"Malicious Package in rrequest",rrequest,0,,,CRITICAL,CWE-506,
 GHSA-wch2-46wj-6x5j,2020-09-04T15:37:15Z,"Malicious Package in bip30",bip30,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wcm7-94wg-h74h,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override",openclaw,0,2026.3.28,,MODERATE,CWE-184,
+GHSA-wf3x-273g-mvxv,2026-10-01T15:17:13Z,"devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated",devalue,1.0.0,5.9.3,,LOW,CWE-400;CWE-789,
 GHSA-wf8q-wvv8-p8jf,2026-05-14T20:44:22Z,"@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation",@samanhappy/mcphub,0,0.12.15,,CRITICAL,CWE-290,
 GHSA-wfhx-6pcm-7m55,2020-09-03T16:46:22Z,"Path Traversal in ponse",ponse,0,2.0.2,,HIGH,CWE-22,
 GHSA-wfjh-3hq2-r276,2020-09-03T19:56:48Z,"Malicious Package in node-spdy",node-spdy,0.0.0,,,CRITICAL,CWE-506,
@@ -9752,10 +10008,9 @@ GHSA-wmpv-c2jp-j2xg,2021-11-15T23:28:18Z,"ERC1155Supply vulnerability in OpenZep
 GHSA-wmpv-c2jp-j2xg,2021-11-15T23:28:18Z,"ERC1155Supply vulnerability in OpenZeppelin Contracts",@openzeppelin/contracts,4.2.0,4.3.3,,LOW,,
 GHSA-wp2p-q35g-3rjj,2020-09-01T21:13:01Z,"Malicious Package in soket.io",soket.io,0,,,CRITICAL,CWE-506,
 GHSA-wpfc-3w63-g4hm,2020-09-01T21:09:48Z,"Malicious Package in axois",axois,0,,,CRITICAL,CWE-506,
-GHSA-wpqr-6v78-jr5g,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0,0.39.1,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
-GHSA-wpqr-6v78-jr5g,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0.40.0-preview.2,0.40.0-preview.3,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
 GHSA-wq64-hcrf-8m56,2026-07-22T12:32:17Z,"Duplicate Advisory: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",n8n,0,,,HIGH,CWE-269,
 GHSA-wq95-wr7m-26h4,2025-10-06T03:31:38Z,"Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot",flowise,0,3.0.5,,HIGH,CWE-79,
+GHSA-wqg3-r97q-73xm,2026-09-17T15:32:15Z,"Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape",vm2,3.9.6,,3.11.6,CRITICAL,CWE-693,
 GHSA-wqgq-mfvj-6qxp,2020-09-03T19:49:03Z,"Malicious Package in koa-body-parse",koa-body-parse,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wqgx-4q47-j2w5,2020-09-04T17:36:04Z,"Insecure Cryptography Algorithm in parsel",parsel,0.0.0,,,CRITICAL,CWE-327,
 GHSA-wqhw-frpx-5mmp,2020-09-02T16:01:33Z,"Command Injection in tomato",tomato,0,,,HIGH,CWE-77,
@@ -9800,6 +10055,7 @@ GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,0,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,3.0.0,3.3.2,,MODERATE,,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,4.0.0,4.1.2,,MODERATE,,
 GHSA-x565-32qp-m3vf,2024-04-11T21:30:30Z,"phin may include sensitive headers in subsequent requests after redirect",phin,0,3.7.1,,MODERATE,CWE-200,
+GHSA-x5rw-q4pp-hg5g,2026-10-01T15:15:13Z,"devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise",devalue,5.8.0,5.9.3,,HIGH,CWE-248;CWE-755,
 GHSA-x6ch-c6rv-f7wh,2020-09-02T18:34:22Z,"Malicious Package in asymc",asymc,0,,,CRITICAL,CWE-506,
 GHSA-x6gq-467r-hwcc,2020-09-01T21:14:05Z,"Malicious Package in soket.js",soket.js,0,,,CRITICAL,CWE-506,
 GHSA-x6m6-5hrf-fh6r,2020-09-01T21:26:50Z,"Denial of Service in markdown-it-toc-and-anchor","markdown-it-toc-and-anchor",0,4.2.0,,HIGH,CWE-400,
@@ -9851,6 +10107,7 @@ GHSA-xppm-jmw6-fhmf,2026-06-20T18:31:29Z,"Duplicate Advisory: Cross-site scripti
 GHSA-xppm-jmw6-fhmf,2026-06-20T18:31:29Z,"Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components",nuxt,4.0.0,4.4.7,,LOW,CWE-79,
 GHSA-xpr6-2hgm-4wwp,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution",openclaw,0,2026.4.23,,HIGH,CWE-427,
 GHSA-xq3g-m3j8-2vmm,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels",openclaw,0,,,HIGH,CWE-770,
+GHSA-xq74-c7jx-8w5j,2026-09-17T15:32:15Z,"Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store",vm2,3.11.3,,3.11.6,CRITICAL,CWE-732,
 GHSA-xq7h-vwjp-5vrh,2026-03-25T17:30:46Z,"@grackle-ai/powerline Runs Without Authentication by Default",@grackle-ai/powerline,0,0.70.1,,MODERATE,CWE-306,
 GHSA-xr3g-4gg5-w3wq,2020-09-03T17:06:14Z,"Malicious Package in degbu",degbu,0.0.0,,,CRITICAL,CWE-506,
 GHSA-xr4f-mjxj-w6w5,2026-07-02T16:55:09Z,"OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes",openclaw,0,2026.5.4,,HIGH,CWE-863,
@@ -9876,3 +10133,4 @@ GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notat
 GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service",n8n,2.32.0,2.32.1,,HIGH,CWE-1321,
 GHSA-xx4c-jj58-r7x6,2021-11-19T20:14:23Z,"Inefficient Regular Expression Complexity in Validator.js",validator,11.1.0,13.7.0,,MODERATE,CWE-1333,
 GHSA-xxj4-96ph-g6j6,2026-03-31T12:31:36Z,"Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path",openclaw,0,2026.3.11,,MODERATE,CWE-367,
+GHSA-xxv7-2vv3-h682,2026-10-02T19:31:33Z,"Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL",trigger.dev,0,4.5.2,,HIGH,CWE-918,