@openrewrite/recipes-nodejs 0.51.0 → 0.51.1

package/dist/resources/advisories-npm.csv

@@ -4500,9 +4500,10 @@ CVE-2025-70948,2026-03-05T21:30:49Z,"@perfood/couch-auth has a host header injec
 CVE-2025-70949,2026-03-05T21:30:49Z,"@perfood/couch-auth has an Observable Timing Discrepancy ",@perfood/couch-auth,0,,0.26.0,HIGH,CWE-208,
 CVE-2025-71319,2025-04-02T15:04:58Z,"image-size Denial of Service via Infinite Loop during Image Processing",image-size,1.1.0,1.2.1,,HIGH,CWE-770;CWE-835,
 CVE-2025-71319,2025-04-02T15:04:58Z,"image-size Denial of Service via Infinite Loop during Image Processing",image-size,2.0.0,2.0.2,,HIGH,CWE-770;CWE-835,
-CVE-2025-71329,2026-06-10T15:31:30Z,"image-size: JXL and HEIF parsers allow denial of service through infinite loops",image-size,0,,2.0.2,HIGH,CWE-835,
-CVE-2025-71330,2026-06-10T15:31:30Z,"image-size: ICNS parser allows denial of service through an infinite loop",image-size,0,,2.0.2,HIGH,CWE-835,
+CVE-2025-71329,2026-06-10T15:31:30Z,"image-size: JXL and HEIF parsers allow denial of service through infinite loops",image-size,1.2.0,2.0.3,,HIGH,CWE-835,
+CVE-2025-71330,2026-06-10T15:31:30Z,"image-size: ICNS parser allows denial of service through an infinite loop",image-size,0.6.3,2.0.3,,HIGH,CWE-835,
 CVE-2025-71332,2025-04-07T18:55:13Z,"FlowiseDB vulnerable to SQL Injection by authenticated users",flowise,0,,2.2.7,MODERATE,CWE-564,
+CVE-2025-71381,2025-10-24T19:15:13Z,"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,4.10.3,,MODERATE,CWE-444,
 CVE-2025-71401,2025-12-01T21:29:48Z,"Better Auth affected by external request basePath modification DoS",better-auth,0,1.4.2,,HIGH,CWE-73;CWE-770,
 CVE-2025-7338,2025-07-17T21:01:54Z,"Multer vulnerable to Denial of Service via unhandled exception from malformed request",multer,1.4.4-lts.1,2.0.2,,HIGH,CWE-248,
 CVE-2025-7339,2025-07-17T21:17:19Z,"on-headers is vulnerable to http response header manipulation",on-headers,0,1.1.0,,LOW,CWE-241,
@@ -4537,8 +4538,88 @@ CVE-2026-0824,2026-01-10T15:31:22Z,"QuestDB UI's Web Console is Vulnerable to Cr
 CVE-2026-0933,2026-01-21T23:00:35Z,"Wrangler affected by OS Command Injection in `wrangler pages deploy`",wrangler,2.0.15,3.114.17,,HIGH,CWE-78,
 CVE-2026-0933,2026-01-21T23:00:35Z,"Wrangler affected by OS Command Injection in `wrangler pages deploy`",wrangler,4.0.0,4.59.1,,HIGH,CWE-78,
 CVE-2026-0969,2026-02-12T03:31:01Z,"next-mdx-remote affected by arbitrary code execution in React server-side rendering of untrusted MDX content",next-mdx-remote,4.3.0,6.0.0,,HIGH,CWE-94,
+CVE-2026-10032,2026-10-02T22:55:49Z,"@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions",@a2ui/web_core,0.9.0,0.10.2,,CRITICAL,CWE-79,
+CVE-2026-101894,2026-09-29T23:49:42Z,"@xhmikosr/decompress: Path traversal via symlink chain",@xhmikosr/decompress,0,10.2.2,,CRITICAL,CWE-22;CWE-59,
+CVE-2026-101894,2026-09-29T23:49:42Z,"@xhmikosr/decompress: Path traversal via symlink chain",@xhmikosr/decompress,11.0.0,11.1.4,,CRITICAL,CWE-22;CWE-59,
+CVE-2026-101894,2026-09-29T23:49:42Z,"@xhmikosr/decompress: Path traversal via symlink chain",decompress,0,,4.2.1,CRITICAL,CWE-22;CWE-59,
+CVE-2026-101895,2026-09-28T21:31:21Z,"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE",@angular/platform-server,0,,19.2.25,HIGH,CWE-400;CWE-835,
+CVE-2026-101895,2026-09-28T21:31:21Z,"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE",@angular/platform-server,20.0.0,20.3.31,,HIGH,CWE-400;CWE-835,
+CVE-2026-101895,2026-09-28T21:31:21Z,"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE",@angular/platform-server,21.0.0,21.2.23,,HIGH,CWE-400;CWE-835,
+CVE-2026-101895,2026-09-28T21:31:21Z,"Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE",@angular/platform-server,22.0.0,22.1.6,,HIGH,CWE-400;CWE-835,
+CVE-2026-101896,2026-09-30T15:40:47Z,"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",@angular/router,0,,19.2.25,HIGH,CWE-400;CWE-770,
+CVE-2026-101896,2026-09-30T15:40:47Z,"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",@angular/router,20.0.0,20.3.32,,HIGH,CWE-400;CWE-770,
+CVE-2026-101896,2026-09-30T15:40:47Z,"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",@angular/router,21.0.0,21.2.24,,HIGH,CWE-400;CWE-770,
+CVE-2026-101896,2026-09-30T15:40:47Z,"Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",@angular/router,22.0.0,22.2.0,,HIGH,CWE-400;CWE-770,
+CVE-2026-101898,2026-09-30T15:02:14Z,"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls",axios,1.13.0,1.20.0,,HIGH,CWE-918,
+CVE-2026-101899,2026-09-30T15:32:30Z,"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges",axios,1.15.0,1.20.0,,MODERATE,CWE-693,
+CVE-2026-101900,2026-09-30T15:34:46Z,"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders",axios,1.12.0,1.20.0,,MODERATE,CWE-1321;CWE-693;CWE-74,
+CVE-2026-101901,2026-09-30T15:01:07Z,"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization",axios,1.13.0,1.20.0,,HIGH,CWE-400,
+CVE-2026-101902,2026-09-30T15:12:49Z,"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method",axios,0.27.2,0.34.0,,MODERATE,CWE-1321,
+CVE-2026-101902,2026-09-30T15:12:49Z,"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method",axios,1.0.0,1.20.0,,MODERATE,CWE-1321,
+CVE-2026-101903,2026-09-30T15:03:21Z,"Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)",axios,1.16.1,1.20.0,,HIGH,CWE-1333,
+CVE-2026-101904,2026-09-30T15:35:14Z,"Axios: Header Injection via Inherited headers After Minimal Interceptor",axios,1.0.0,1.20.0,,MODERATE,CWE-1321;CWE-74,
+CVE-2026-101905,2026-09-30T15:32:51Z,"Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection",axios,1.15.2,1.20.0,,HIGH,CWE-1321;CWE-441,
+CVE-2026-101906,2026-09-30T15:03:02Z,"Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location",axios,1.15.0,1.20.0,,HIGH,CWE-1333;CWE-400,
+CVE-2026-101907,2026-09-30T15:31:58Z,"Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF",axios,1.17.0,1.20.0,,HIGH,CWE-441;CWE-601,
+CVE-2026-101908,2026-09-30T15:13:16Z,"Axios: Prototype pollution gadget in fetch adapter can alter outbound requests",axios,1.7.0,1.20.0,,MODERATE,CWE-1321,
+CVE-2026-101909,2026-09-30T15:02:45Z,"Axios: Prototype Pollution Gadget in axios toFormData Options",axios,0.28.0,0.34.0,,HIGH,CWE-1321,
+CVE-2026-101909,2026-09-30T15:02:45Z,"Axios: Prototype Pollution Gadget in axios toFormData Options",axios,1.15.1,1.20.0,,HIGH,CWE-1321,
+CVE-2026-101910,2026-09-28T20:43:03Z,"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass",ip-address,10.2.0,10.5.1,,MODERATE,CWE-918,
+CVE-2026-101911,2026-09-29T23:46:39Z,"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process",ip-address,0,10.7.1,,MODERATE,CWE-400;CWE-770,
+CVE-2026-101912,2026-09-29T23:46:52Z,"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range",ip-address,0,10.7.1,,MODERATE,CWE-697;CWE-843,
+CVE-2026-101913,2026-09-28T20:43:55Z,"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts",ip-address,0,10.5.1,,MODERATE,CWE-697;CWE-918,
+CVE-2026-101914,2026-09-28T19:43:51Z,"@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches",@grpc/grpc-js-xds,0,1.13.1,,MODERATE,CWE-187;CWE-863,
+CVE-2026-101914,2026-09-28T19:43:51Z,"@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches",@grpc/grpc-js-xds,1.14.0,1.14.1,,MODERATE,CWE-187;CWE-863,
+CVE-2026-101915,2026-09-30T15:35:41Z,"@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages",@grpc/grpc-js,0,1.13.6,,LOW,CWE-550,
+CVE-2026-101915,2026-09-30T15:35:41Z,"@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages",@grpc/grpc-js,1.14.0,1.14.5,,LOW,CWE-550,
+CVE-2026-101916,2026-09-30T15:35:53Z,"@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized",@grpc/grpc-js,0,1.13.6,,HIGH,CWE-295,
+CVE-2026-101916,2026-09-30T15:35:53Z,"@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized",@grpc/grpc-js,1.14.0,1.14.5,,HIGH,CWE-295,
+CVE-2026-102276,2026-09-29T23:44:58Z,"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",brace-expansion,0,1.1.19,,HIGH,CWE-400;CWE-674,
+CVE-2026-102276,2026-09-29T23:44:58Z,"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",brace-expansion,2.0.0,2.1.5,,HIGH,CWE-400;CWE-674,
+CVE-2026-102276,2026-09-29T23:44:58Z,"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",brace-expansion,3.0.0,3.0.7,,HIGH,CWE-400;CWE-674,
+CVE-2026-102276,2026-09-29T23:44:58Z,"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",brace-expansion,4.0.0,5.0.10,,HIGH,CWE-400;CWE-674,
+CVE-2026-102277,2026-09-29T23:45:39Z,"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",brace-expansion,0,1.1.21,,MODERATE,CWE-400;CWE-407,
+CVE-2026-102277,2026-09-29T23:45:39Z,"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",brace-expansion,2.0.0,2.1.7,,MODERATE,CWE-400;CWE-407,
+CVE-2026-102277,2026-09-29T23:45:39Z,"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",brace-expansion,3.0.0,3.0.9,,MODERATE,CWE-400;CWE-407,
+CVE-2026-102277,2026-09-29T23:45:39Z,"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",brace-expansion,4.0.0,5.0.12,,MODERATE,CWE-400;CWE-407,
+CVE-2026-102278,2026-09-29T23:45:17Z,"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",brace-expansion,0,1.1.20,,HIGH,CWE-400;CWE-674,
+CVE-2026-102278,2026-09-29T23:45:17Z,"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",brace-expansion,2.0.0,2.1.6,,HIGH,CWE-400;CWE-674,
+CVE-2026-102278,2026-09-29T23:45:17Z,"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",brace-expansion,3.0.0,3.0.8,,HIGH,CWE-400;CWE-674,
+CVE-2026-102278,2026-09-29T23:45:17Z,"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",brace-expansion,4.0.0,5.0.11,,HIGH,CWE-400;CWE-674,
+CVE-2026-102281,2026-09-29T23:54:44Z,"Nest: Remote process termination via a deeply nested microservice message pattern",@nestjs/microservices,0,11.2.4,,HIGH,CWE-248;CWE-674,
+CVE-2026-102281,2026-09-29T23:54:44Z,"Nest: Remote process termination via a deeply nested microservice message pattern",@nestjs/microservices,12.0.0,12.0.2,,HIGH,CWE-248;CWE-674,
+CVE-2026-102282,2026-09-29T18:24:57Z,"adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation",adm-zip,0,0.6.1,,HIGH,CWE-732,
+CVE-2026-102599,2026-09-29T23:44:33Z,"Socket.IO: Engine.IO Protocol Revision Mismatch DoS",engine.io,6.6.0,6.6.10,,HIGH,CWE-248,
+CVE-2026-102672,2026-09-29T18:06:59Z,"Electron: Local race condition in Squirrel.Mac update installation on macOS",electron,0,39.8.10,,MODERATE,CWE-367,
+CVE-2026-102672,2026-09-29T18:06:59Z,"Electron: Local race condition in Squirrel.Mac update installation on macOS",electron,40.0.0-alpha.1,41.10.5,,MODERATE,CWE-367,
+CVE-2026-102672,2026-09-29T18:06:59Z,"Electron: Local race condition in Squirrel.Mac update installation on macOS",electron,42.0.0-alpha.1,42.0.0-beta.2,,MODERATE,CWE-367,
+CVE-2026-102673,2026-09-29T18:05:34Z,"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab",electron,0,41.10.4,,HIGH,CWE-346;CWE-693,
+CVE-2026-102673,2026-09-29T18:05:34Z,"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab",electron,42.0.0-alpha.1,42.5.2,,HIGH,CWE-346;CWE-693,
+CVE-2026-102673,2026-09-29T18:05:34Z,"Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab",electron,43.0.0-alpha.1,43.0.0,,HIGH,CWE-346;CWE-693,
+CVE-2026-102674,2026-09-29T18:05:11Z,"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions",electron,0,41.10.6,,HIGH,CWE-266;CWE-693,
+CVE-2026-102674,2026-09-29T18:05:11Z,"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions",electron,42.0.0-alpha.1,42.9.2,,HIGH,CWE-266;CWE-693,
+CVE-2026-102674,2026-09-29T18:05:11Z,"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions",electron,43.0.0-alpha.1,43.4.1,,HIGH,CWE-266;CWE-693,
+CVE-2026-102674,2026-09-29T18:05:11Z,"Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions",electron,44.0.0-alpha.1,44.0.0-beta.5,,HIGH,CWE-266;CWE-693,
+CVE-2026-102675,2026-09-29T18:04:24Z,"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled",electron,0,41.10.6,,HIGH,CWE-346,
+CVE-2026-102675,2026-09-29T18:04:24Z,"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled",electron,42.0.0-alpha.1,42.9.2,,HIGH,CWE-346,
+CVE-2026-102675,2026-09-29T18:04:24Z,"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled",electron,43.0.0-alpha.1,43.4.1,,HIGH,CWE-346,
+CVE-2026-102675,2026-09-29T18:04:24Z,"Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled",electron,44.0.0-alpha.1,44.0.0-beta.5,,HIGH,CWE-346,
+CVE-2026-102676,2026-09-29T18:02:18Z,"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions",electron,0,41.10.6,,HIGH,CWE-1188;CWE-269,
+CVE-2026-102676,2026-09-29T18:02:18Z,"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions",electron,42.0.0-alpha.1,42.9.2,,HIGH,CWE-1188;CWE-269,
+CVE-2026-102676,2026-09-29T18:02:18Z,"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions",electron,43.0.0-alpha.1,43.4.1,,HIGH,CWE-1188;CWE-269,
+CVE-2026-102676,2026-09-29T18:02:18Z,"Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions",electron,44.0.0-alpha.1,44.0.0-beta.5,,HIGH,CWE-1188;CWE-269,
+CVE-2026-102677,2026-09-29T18:02:01Z,"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer",electron,42.3.3,42.10.0,,HIGH,CWE-20;CWE-345,
+CVE-2026-102677,2026-09-29T18:02:01Z,"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer",electron,43.0.0-beta.1,43.5.0,,HIGH,CWE-20;CWE-345,
+CVE-2026-102677,2026-09-29T18:02:01Z,"Electron: Sandboxed preload code cache can be poisoned by a compromised renderer",electron,44.0.0-alpha.1,44.0.0-beta.6,,HIGH,CWE-20;CWE-345,
 CVE-2026-10281,2026-06-01T21:30:42Z,"Claw Orchestrator is missing authentication for the component API Endpoint","@enderfga/claw-orchestrator",0,3.5.6,,MODERATE,CWE-287,
 CVE-2026-10291,2026-06-02T00:31:57Z,"Claw Orchestrator has inefficient regular expression complexity via validateRegex()","@enderfga/claw-orchestrator",0,3.7.1,,MODERATE,CWE-1333;CWE-400,
+CVE-2026-102983,2026-09-30T23:40:12Z,"Astro: Netlify Image CDN allowlist bypass enables SSRF",@astrojs/netlify,5.2.0,8.2.4,,MODERATE,CWE-625;CWE-918,
+CVE-2026-102984,2026-09-30T23:29:40Z,"Astro: Malformed port in the Host header can crash the Node adapter",@astrojs/node,0,11.1.3,,HIGH,CWE-248,
+CVE-2026-102990,2026-10-01T14:42:42Z,"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)",basic-ftp,0,6.2.1,,HIGH,CWE-1333,
+CVE-2026-102992,2026-10-01T15:03:33Z,"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env",piscina,0,4.9.4,,CRITICAL,CWE-1321,
+CVE-2026-102992,2026-10-01T15:03:33Z,"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env",piscina,5.0.0,5.3.2,,CRITICAL,CWE-1321,
+CVE-2026-102992,2026-10-01T15:03:33Z,"piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env",piscina,6.0.0-rc.1,6.0.0-rc.5,,CRITICAL,CWE-1321,
+CVE-2026-104861,2026-10-02T23:18:02Z,"probe-image-size: Quadratic-time Denial of Service in the SVG Parser",probe-image-size,0,7.4.0,,HIGH,CWE-1333;CWE-400,
 CVE-2026-10690,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to SSRF","@wonderwhy-er/desktop-commander",0,,0.2.37,LOW,CWE-918,
 CVE-2026-10691,2026-06-03T00:30:27Z,"DesktopCommanderMCP is vulnerable to Uncontrolled Resource Consumption","@wonderwhy-er/desktop-commander",0,0.2.39,,LOW,CWE-400,
 CVE-2026-10732,2026-06-05T09:33:46Z,"decompress: Arbitrary File Write via Archive Extraction (Zip Slip)",decompress,0,,4.2.1,MODERATE,CWE-22;CWE-29,
@@ -4564,9 +4645,14 @@ CVE-2026-12151,2026-06-19T14:22:01Z,"undici WebSocket client vulnerable to denia
 CVE-2026-12208,2026-06-15T03:30:32Z,"jsonata: Function Binding Prototype Pollution via hasOwnProperty Override",jsonata,0,1.8.8,,MODERATE,CWE-94,
 CVE-2026-12208,2026-06-15T03:30:32Z,"jsonata: Function Binding Prototype Pollution via hasOwnProperty Override",jsonata,2.0.0,2.2.1,,MODERATE,CWE-94,
 CVE-2026-1245,2026-01-20T21:31:34Z,"binary-parser library has a code injection vulnerability",binary-parser,0,2.3.0,,MODERATE,CWE-94,
+CVE-2026-12537,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0,0.39.1,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
+CVE-2026-12537,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0.40.0-preview.2,0.40.0-preview.3,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
 CVE-2026-12590,2026-07-20T23:23:26Z,"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",body-parser,0,1.20.6,,LOW,CWE-770,
 CVE-2026-12590,2026-07-20T23:23:26Z,"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement",body-parser,2.0.0,2.3.0,,LOW,CWE-770,
 CVE-2026-12644,2026-06-19T06:31:56Z,"ts-deepmerge: Prototype Method Override leads to DoS",ts-deepmerge,0,8.0.0,,MODERATE,CWE-248,
+CVE-2026-12866,2026-06-23T06:30:41Z,"expr-eval vulnerable to Code Execution",expr-eval,0,,2.0.2,CRITICAL,CWE-94,
+CVE-2026-12957,2026-09-24T19:13:53Z,"Language Servers for AWS Vulnerable to Arbitrary Code Execution",@aws/lsp-codewhisperer,0,0.0.113,,HIGH,CWE-732,
+CVE-2026-12958,2026-09-24T19:15:39Z,"Language Servers for AWS vulnerable to arbitrary file write",@aws/lsp-codewhisperer,0,0.0.117,,HIGH,CWE-61,
 CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,0,1.1.16,,HIGH,CWE-400;CWE-407,
 CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,2.0.0,2.1.2,,HIGH,CWE-400;CWE-407,
 CVE-2026-13149,2026-07-20T20:51:09Z,"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups",brace-expansion,3.0.0,5.0.7,,HIGH,CWE-400;CWE-407,
@@ -4588,6 +4674,7 @@ CVE-2026-14643,2026-08-03T19:32:12Z,"undici vulnerable to cross-user information
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,0,1.123.17,,CRITICAL,CWE-95,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,2.0.0,2.4.5,,CRITICAL,CWE-95,
 CVE-2026-1470,2026-01-27T15:30:32Z,"n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution",n8n,2.5.0,2.5.1,,CRITICAL,CWE-95,
+CVE-2026-14802,2026-07-06T09:30:27Z," react-dev-utils openBrowser permits command injection on macOS",react-dev-utils,0,,5.0.1,MODERATE,CWE-77,
 CVE-2026-15074,2026-07-24T16:43:21Z,"@fastify/static vulnerable to route guard bypass via path traversal",@fastify/static,0,10.1.1,,HIGH,CWE-22,
 CVE-2026-1513,2026-01-28T03:30:30Z,"billboard.js is vulnerable to XSS during chart option binding",billboard.js,0,3.18.0,,HIGH,CWE-79,
 CVE-2026-15157,2026-08-03T19:33:53Z,"undici vulnerable to CRLF Injection via blob-like body 'type' property",undici,0,6.28.0,,MODERATE,CWE-93,
@@ -4618,11 +4705,22 @@ CVE-2026-16729,2026-08-03T19:30:52Z,"undici vulnerable to cookie attribute injec
 CVE-2026-16729,2026-08-03T19:30:52Z,"undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields",undici,8.0.0,8.9.0,,MODERATE,CWE-74,
 CVE-2026-16732,2026-09-02T15:14:06Z,"fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count",fastify,5.8.3,5.12.1,,MODERATE,CWE-348,
 CVE-2026-1721,2026-02-13T03:31:23Z,"Cloudflare Agents is Vulnerable to Reflected Cross-Site Scripting in the AI Playground's OAuth callback handler",agents,0,0.3.10,,MODERATE,CWE-79,
+CVE-2026-17495,2026-09-29T23:46:02Z,"moment vulnerable to Path Traversal via crafted non-string locale name",moment,2.29.2,2.31.0,,MODERATE,CWE-27,
 CVE-2026-1774,2026-02-10T18:30:38Z,"CASL Ability is Vulnerable to Prototype Pollution",@casl/ability,2.4.0,6.7.5,,CRITICAL,CWE-1321,
+CVE-2026-18149,2026-09-29T18:22:34Z,"undici vulnerable to Denial of Service via orphaned RetryHandler response body",undici,7.11.0,7.29.1,,MODERATE,CWE-772,
+CVE-2026-18149,2026-09-29T18:22:34Z,"undici vulnerable to Denial of Service via orphaned RetryHandler response body",undici,8.0.0,8.10.2,,MODERATE,CWE-772,
 CVE-2026-18446,2026-08-03T19:16:43Z,"fast-uri vulnerable to host confusion via backslash authority introducer",fast-uri,0,2.4.4,,HIGH,CWE-436,
 CVE-2026-18446,2026-08-03T19:16:43Z,"fast-uri vulnerable to host confusion via backslash authority introducer",fast-uri,3.0.0,3.1.5,,HIGH,CWE-436,
 CVE-2026-18446,2026-08-03T19:16:43Z,"fast-uri vulnerable to host confusion via backslash authority introducer",fast-uri,4.0.0,4.1.2,,HIGH,CWE-436,
 CVE-2026-18504,2026-09-02T15:13:23Z,"fastify vulnerable to schema validation bypass via root primitive coercion mismatch",fastify,0,5.12.1,,MODERATE,CWE-20,
+CVE-2026-18540,2026-09-29T18:22:07Z,"undici vulnerable to downstream response splitting via retry interceptor",undici,0,6.28.1,,LOW,CWE-444,
+CVE-2026-18540,2026-09-29T18:22:07Z,"undici vulnerable to downstream response splitting via retry interceptor",undici,7.0.0,7.29.1,,LOW,CWE-444,
+CVE-2026-18540,2026-09-29T18:22:07Z,"undici vulnerable to downstream response splitting via retry interceptor",undici,8.0.0,8.10.2,,LOW,CWE-444,
+CVE-2026-19481,2026-10-02T23:16:36Z,"@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header",@fastify/busboy,1.0.0,3.2.1,,HIGH,CWE-754,
+CVE-2026-19484,2026-10-02T23:16:17Z,"@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary",@fastify/busboy,3.1.0,3.2.1,,HIGH,CWE-1322;CWE-835,
+CVE-2026-19534,2026-09-29T18:21:33Z,"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",undici,6.7.0,6.28.1,,HIGH,CWE-248;CWE-252,
+CVE-2026-19534,2026-09-29T18:21:33Z,"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",undici,7.0.0,7.29.1,,HIGH,CWE-248;CWE-252,
+CVE-2026-19534,2026-09-29T18:21:33Z,"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol",undici,8.0.0,8.10.2,,HIGH,CWE-248;CWE-252,
 CVE-2026-19693,2026-08-17T15:30:40Z,"extract-zip allows arbitrary file writes through symlink archive entries",extract-zip,0,,2.0.1,HIGH,CWE-22,
 CVE-2026-2130,2026-02-08T03:30:27Z,"mcp-maigret vulnerable to command injection",mcp-maigret,0,1.0.13,,MODERATE,CWE-74;CWE-77,
 CVE-2026-21440,2026-01-02T18:58:32Z,"AdonisJS Path Traversal in Multipart File Handling",@adonisjs/bodyparser,0,10.1.2,,CRITICAL,CWE-22,
@@ -7333,18 +7431,34 @@ CVE-2026-56268,2026-05-20T15:45:19Z,"Flowise: Cross-Workspace Chatflow Disclosur
 CVE-2026-56269,2026-04-16T21:22:36Z,"Flowise: Weak Default Token Hash Secret",flowise,0,3.1.0,,MODERATE,CWE-798,
 CVE-2026-56270,2026-04-16T21:20:05Z,"Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request",flowise,0,3.1.0,,MODERATE,CWE-306;CWE-312,
 CVE-2026-56272,2026-03-05T21:54:31Z,"Flowise has Insufficient Password Salt Rounds",flowise,0,3.0.13,,MODERATE,CWE-328;CWE-916,
+CVE-2026-56275,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise,0,3.1.0,,MODERATE,CWE-918,
+CVE-2026-56275,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise-components,0,3.1.0,,MODERATE,CWE-918,
+CVE-2026-56301,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,3.18.0,3.21.7,,MODERATE,CWE-276,
+CVE-2026-56301,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
 CVE-2026-56317,2026-06-16T23:38:47Z,"Cross-site scripting via <NoScript> slot content in Nuxt's head components",nuxt,0,3.21.7,,LOW,CWE-79,
 CVE-2026-56317,2026-06-16T23:38:47Z,"Cross-site scripting via <NoScript> slot content in Nuxt's head components",nuxt,4.0.0,4.4.7,,LOW,CWE-79,
-CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,3.5.0,3.21.7,,MODERATE,CWE-79;CWE-601,
-CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,4.0.0,4.4.7,,MODERATE,CWE-79;CWE-601,
+CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,3.5.0,3.21.7,,MODERATE,CWE-601;CWE-79,
+CVE-2026-56326,2026-06-16T13:47:52Z,"Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option, and protocol-relative bypass in `reloadNuxtApp`",nuxt,4.0.0,4.4.7,,MODERATE,CWE-601;CWE-79,
 CVE-2026-56348,2026-05-19T16:17:43Z,"n8n: Credential exfiltration via Allowed HTTP Request Domains Bypass",n8n,0,2.20.0,,MODERATE,CWE-918,
 CVE-2026-56351,2026-02-26T15:56:31Z,"n8n: SQL Injection in MySQL, PostgreSQL, and Microsoft SQL nodes",n8n,0,2.4.0,,MODERATE,CWE-89,
 CVE-2026-56357,2026-02-26T15:58:34Z,"n8n: Webhook Forgery on Github Webhook Trigger",n8n,0,1.123.15,,MODERATE,CWE-290,
 CVE-2026-56357,2026-02-26T15:58:34Z,"n8n: Webhook Forgery on Github Webhook Trigger",n8n,2.0.0,2.5.0,,MODERATE,CWE-290,
 CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,0,1.123.25,,MODERATE,CWE-79,
 CVE-2026-56358,2026-03-27T18:05:47Z,"n8n has a Stored XSS Vulnerability in its Form Trigger",n8n,2.0.0-rc.0,2.11.2,,MODERATE,CWE-79,
+CVE-2026-56669,2026-09-23T21:54:50Z,"elysia has Inefficient Algorithmic Complexity and Interpretation Conflict",elysia,0,1.4.29,,HIGH,CWE-407;CWE-436,
+CVE-2026-56675,2026-09-23T18:12:26Z,"9router /v1 APIs has unauthenticated access via reverse proxy locality collapse",9router,0,0.5.2,,HIGH,"CWE-287;CWE-290;CWE-306;CWE-441",
+CVE-2026-56676,2026-09-23T18:12:28Z,"9router: Image prefetch DNS rebinding allows SSRF to internal services",9router,0,0.5.2,,HIGH,CWE-367;CWE-918,
 CVE-2026-56677,2026-08-17T21:58:43Z,"9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint",9router,0,,0.5.4,HIGH,CWE-306;CWE-918,
+CVE-2026-56678,2026-09-23T18:12:30Z,"9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding",9router,0,0.5.6,,MODERATE,CWE-20;CWE-918,
+CVE-2026-56679,2026-09-23T18:12:33Z,"9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade",9router,0,0.5.4,,HIGH,CWE-915,
+CVE-2026-56681,2026-09-22T16:34:06Z,"9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header",9router,0,0.5.8,,HIGH,CWE-807,
+CVE-2026-56682,2026-09-22T16:34:18Z,"9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header",9router,0,0.5.8,,MODERATE,CWE-307;CWE-807,
+CVE-2026-56744,2026-09-24T19:32:00Z,"`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction","@bsv/wallet-toolbox-client",1.1.47,2.4.0,,HIGH,CWE-1288,
+CVE-2026-56744,2026-09-24T19:32:00Z,"`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction","@bsv/wallet-toolbox-mobile",1.3.21,2.4.0,,HIGH,CWE-1288,
+CVE-2026-56744,2026-09-24T19:32:00Z,"`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction",@bsv/wallet-toolbox,1.1.47,2.4.0,,HIGH,CWE-1288,
 CVE-2026-56761,2026-04-16T01:02:24Z,"hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSR",hono,0,4.12.14,,MODERATE,CWE-79,
+CVE-2026-56762,2026-04-08T00:17:02Z,"Hono missing validation of cookie name on write path in setCookie()",hono,0,4.12.12,,MODERATE,CWE-113;CWE-20,
+CVE-2026-56763,2026-03-11T00:31:47Z,"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })",hono,0,4.12.7,,MODERATE,CWE-1321,
 CVE-2026-56812,2026-09-03T20:30:33Z,"Phoenix: Presence keys colliding with `Object.prototype` members break existence checks",phoenix,1.2.0-rc.0,1.5.15,,MODERATE,CWE-754,
 CVE-2026-56812,2026-09-03T20:30:33Z,"Phoenix: Presence keys colliding with `Object.prototype` members break existence checks",phoenix,1.6.0-rc.0,1.6.17,,MODERATE,CWE-754,
 CVE-2026-56812,2026-09-03T20:30:33Z,"Phoenix: Presence keys colliding with `Object.prototype` members break existence checks",phoenix,1.7.0-rc.0,1.7.24,,MODERATE,CWE-754,
@@ -7359,6 +7473,7 @@ CVE-2026-57138,2026-06-18T14:26:32Z,"npm PraisonAI codeMode sandbox escape via F
 CVE-2026-57139,2026-06-18T14:26:48Z,"npm PraisonAI MCPServer exposes unauthenticated HTTP tools/call",praisonai,1.5.0,1.7.2,,CRITICAL,CWE-1188;CWE-306;CWE-862,
 CVE-2026-57140,2026-06-18T14:26:42Z,"npm PraisonAI AgentOS exposes unauthenticated agent listing and invocation",praisonai,1.6.0,1.7.2,,CRITICAL,CWE-306,
 CVE-2026-57141,2026-06-18T14:26:37Z,"PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool",praisonai,0,1.7.2,,CRITICAL,CWE-94,
+CVE-2026-57439,2026-09-24T19:24:30Z,"CyberChef: Prototype pollution in Series Chart operation",cyberchef,0,11.2.0,,MODERATE,CWE-1321;CWE-79,
 CVE-2026-57441,2026-06-18T14:30:43Z,"MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence",@bitbonsai/mcpvault,0,0.11.4,,MODERATE,CWE-178;CWE-41,
 CVE-2026-57442,2026-06-19T21:42:24Z,"MCPVault: PathFilter restricted directories (.git/.obsidian/node_modules) only denied at vault root, not nested",@bitbonsai/mcpvault,0,0.11.5,,MODERATE,CWE-22;CWE-538,
 CVE-2026-57494,2026-06-18T17:20:55Z,"AgenticMail: Cross-agent task authorization bypass in AgenticMail API",@agenticmail/api,0,0.9.64,,HIGH,CWE-639;CWE-862,
@@ -7370,6 +7485,10 @@ CVE-2026-5758,2026-04-15T18:31:58Z,"Mafintosh's protocol-buffers-schema is vulne
 CVE-2026-58191,2026-09-01T18:54:53Z,"Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes",@appium/base-driver,0,10.7.0,,MODERATE,CWE-489;CWE-79,
 CVE-2026-58230,2026-08-11T03:31:56Z,"SAP Approuter has an Information Disclosure vulnerability",@sap/approuter,0,23.0.0,,HIGH,CWE-601,
 CVE-2026-58263,2026-07-31T19:12:40Z,"Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier",jodit,0,4.12.28,,HIGH,CWE-79;CWE-83,
+CVE-2026-58269,2026-09-22T14:46:30Z,"Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`",@sync-in/server,0,2.4.0,,HIGH,CWE-288,
+CVE-2026-58270,2026-09-22T14:47:56Z,"Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`",@sync-in/server,0,2.4.0,,MODERATE,CWE-1333,
+CVE-2026-58271,2026-09-22T14:44:43Z,"@sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`",@sync-in/server,0,2.4.0,,MODERATE,CWE-307,
+CVE-2026-58272,2026-09-22T14:49:23Z,"Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)",@sync-in/server,0,2.4.1,,MODERATE,CWE-208,
 CVE-2026-5831,2026-04-09T03:31:14Z,"Agions taskflow-ai vulnerable to os command injection in src/mcp/server/handlers.ts",taskflow-ai,0,2.1.9,,MODERATE,CWE-77,
 CVE-2026-5832,2026-04-09T03:31:15Z,"api-lab-mcp vulnerable to SSRF",api-lab-mcp,0,,0.2.1,MODERATE,CWE-918,
 CVE-2026-5833,2026-04-09T06:30:27Z,"awwaiid mcp-server-taskwarrior vulnerable to command injection",mcp-server-taskwarrior,0,,1.0.1,LOW,CWE-74,
@@ -7383,6 +7502,7 @@ CVE-2026-59149,2026-09-11T22:04:32Z,"@Mockoon/commons-server: Path traversal in
 CVE-2026-59149,2026-09-11T22:04:32Z,"@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)",@mockoon/commons-server,0,9.7.0,,MODERATE,CWE-22;CWE-23,
 CVE-2026-59158,2026-09-09T23:47:44Z,"Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients",nuxt-ollama,1.2.26,1.3.1,,HIGH,CWE-522,
 CVE-2026-59160,2026-09-09T23:47:55Z,"@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run",@yeger/turbo-graph,0,2.8.12,,HIGH,CWE-306,
+CVE-2026-59167,2026-09-24T14:57:55Z,"SunEditor: Critical XSS vulnerability - sanitizer bypass",suneditor,0,2.47.11,,CRITICAL,CWE-79,
 CVE-2026-59176,2026-09-09T23:49:20Z,"functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import",functype-mcp-server,0,1.4.4,,HIGH,CWE-829,
 CVE-2026-59179,2026-09-09T23:51:59Z,"@openhop/server: Path Traversal in Flow ID File Operations",@openhop/server,0,0.3.6,,HIGH,CWE-22,
 CVE-2026-59206,2026-07-22T21:57:21Z,"n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration",n8n,0,1.123.61,,HIGH,CWE-1321,
@@ -7406,6 +7526,7 @@ CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via
 CVE-2026-59259,2026-07-22T22:21:20Z,"n8n: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,2.28.0,2.28.1,,MODERATE,CWE-639,
 CVE-2026-59710,2026-07-07T00:30:59Z,"showdown allows stored cross-site scripting through table header ID injection",showdown,0,,2.1.0,MODERATE,CWE-79,
 CVE-2026-59711,2026-07-06T21:30:43Z,"showdown metadata title handling allows cross-site scripting",showdown,0,,2.1.0,MODERATE,CWE-79,
+CVE-2026-59723,2026-09-24T19:48:34Z,"Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)",cline,0,3.0.30,,HIGH,CWE-346,
 CVE-2026-59724,2026-08-31T21:28:12Z,"Socket.IO: Engine.IO WebTransport SID DoS",engine.io,6.5.0,6.6.7,,HIGH,CWE-20,
 CVE-2026-59725,2026-07-20T21:49:54Z,"Socket.IO: Engine.IO Polling Transport Connection Exhaustion",engine.io,4.1.0,6.6.7,,HIGH,CWE-404,
 CVE-2026-59727,2026-07-20T23:21:02Z,"Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands",astro,3.10.0,7.0.4,,LOW,CWE-116;CWE-79;CWE-83,
@@ -7456,9 +7577,17 @@ CVE-2026-61556,2026-09-03T17:45:26Z,"LiquidJS has an infinite loop vulnerability
 CVE-2026-61559,2026-09-15T20:57:28Z,"@zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery",@zereight/mcp-gitlab,0.0.1,2.1.27,,CRITICAL,CWE-918,
 CVE-2026-61560,2026-09-16T13:48:28Z,"@zereight/mcp-gitlab: Unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover",@zereight/mcp-gitlab,0,2.1.27,,CRITICAL,CWE-22,
 CVE-2026-61568,2026-09-15T20:54:55Z,"@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport",@zereight/mcp-gitlab,0,2.1.30,,CRITICAL,CWE-350,
+CVE-2026-61612,2026-09-22T14:51:20Z,"@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509","@aborruso/ckan-mcp-server",0,0.4.108,,MODERATE,CWE-918,
+CVE-2026-61647,2026-09-22T14:43:26Z,"@roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory","@roomi-fields/notebooklm-mcp",1.6.0,2.0.3,,HIGH,CWE-22;CWE-73,
+CVE-2026-61685,2026-09-23T21:51:59Z,"ReactPress has SQL injection via dynamic column names in TypeORM query builders",@fecommunity/reactpress,0,3.7.0,,HIGH,CWE-89,
 CVE-2026-61704,2026-09-02T21:29:57Z,"link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897",link-preview-js,0,4.0.4,,HIGH,CWE-918,
+CVE-2026-61742,2026-09-24T19:36:57Z,"DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution",@bytebase/dbhub,0,0.22.5,,CRITICAL,CWE-306;CWE-346,
+CVE-2026-61782,2026-09-24T19:42:10Z,"@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata",@rsdoctor/rspack-plugin,0,1.5.16,,HIGH,CWE-200,
+CVE-2026-61784,2026-09-24T19:33:23Z,"xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS",xhtml-purifier,0,0.4.3,,MODERATE,CWE-116;CWE-79,
+CVE-2026-61788,2026-09-24T19:37:59Z,"@bytebase/dbhub's read-only mode does not prevent database writes",@bytebase/dbhub,0,0.22.6,,HIGH,CWE-184;CWE-636;CWE-863,
 CVE-2026-61793,2026-09-17T14:48:55Z,"Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter",nuxt-og-image,6.0.2,6.7.0,,MODERATE,"CWE-1188;CWE-20;CWE-441;CWE-749;CWE-918",
 CVE-2026-61824,2026-08-21T20:54:56Z,"Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors",defuddle,0,0.19.1,,HIGH,CWE-116;CWE-79,
+CVE-2026-61834,2026-09-28T14:01:15Z,"scim-patch: Mutation of Inherited Built-in Method Objects",scim-patch,0,0.9.2,,MODERATE,CWE-1321;CWE-915,
 CVE-2026-61835,2026-07-20T21:47:17Z,"Directus: SSRF Protection Bypass via 0.0.0.0 in File Import",directus,0,12.0.0,,HIGH,CWE-918,
 CVE-2026-61836,2026-07-20T21:48:15Z,"Directus: Authorization-dependent response served from unsegmented cache key",directus,0,12.0.0,,HIGH,CWE-524;CWE-639,
 CVE-2026-6216,2026-04-13T21:30:45Z,"DbGate has cross site scripting via the  SVG Icon String Handler component",dbgate-web,0,7.1.5,,LOW,CWE-79,
@@ -7467,9 +7596,11 @@ CVE-2026-62680,2026-09-02T14:54:48Z,"Orval: Generation-time SSRF + remote/local
 CVE-2026-62681,2026-09-03T19:17:32Z,"Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)",orval,0,8.21.0,,CRITICAL,CWE-116;CWE-1336;CWE-94,
 CVE-2026-62682,2026-09-03T19:06:52Z,"Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)",orval,0,8.21.0,,CRITICAL,CWE-116;CWE-1336;CWE-94,
 CVE-2026-6270,2026-04-16T22:29:04Z,"@fastify/middie vulnerable to middleware authentication bypass in child plugin scopes",@fastify/middie,0,9.3.2,,CRITICAL,CWE-436,
+CVE-2026-62985,2026-09-22T19:54:18Z,"request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the Node.js process",request-filtering-agent,0,3.2.1,,HIGH,CWE-248,
 CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,0,7.5.2,,MODERATE,CWE-918,
 CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,7.6.0,7.6.5,,MODERATE,CWE-918,
 CVE-2026-63004,2026-08-21T19:14:45Z,"Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers",unleash-server,8.0.0,8.0.2,,MODERATE,CWE-918,
+CVE-2026-63116,2026-09-22T19:56:34Z,"deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes",@deepstream/server,10.1.0,10.1.1,,HIGH,CWE-862,
 CVE-2026-63123,2026-08-19T21:56:36Z,"Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root",@tinacms/cli,0,2.5.2,,MODERATE,CWE-352,
 CVE-2026-63188,2026-08-19T20:24:06Z,"logto-tunnel serves files outside --experience-path via path traversal",@logto/tunnel,0,0.3.9,,HIGH,CWE-22,
 CVE-2026-6321,2026-05-08T17:15:09Z,"fast-uri vulnerable to path traversal via percent-encoded dot segments",fast-uri,0,2.4.1,,HIGH,CWE-22,
@@ -7482,7 +7613,7 @@ CVE-2026-63376,2026-09-03T20:55:32Z,"toml-node: Prototype Pollution Leads to `Ob
 CVE-2026-63397,2026-07-16T21:30:38Z,"Genql: inject arbitrary JavaScript or TypeScript via a GraphQL schema",@genql/cli,0,6.3.4,,HIGH,CWE-116,
 CVE-2026-63421,2026-08-21T20:55:11Z,"Keystone vulnerable to `graphql.maxTake` bypass with negative `take`",@keystone-6/core,0,6.5.3,,HIGH,CWE-20;CWE-480,
 CVE-2026-63459,2026-09-17T14:49:34Z,"Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions",@vendure/dashboard,0,3.6.5,,HIGH,CWE-79,
-CVE-2026-63460,2026-09-17T14:49:56Z,"Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends",vendure/core,0,3.6.5,,HIGH,CWE-1333,
+CVE-2026-63460,2026-09-17T14:49:56Z,"Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends",@vendure/core,0,3.6.5,,HIGH,CWE-1333,
 CVE-2026-63461,2026-09-17T14:50:02Z,"Vendure: Shop API list queries can return non-public entities when filterOperator is OR",@vendure/core,1.0.0,3.6.5,,MODERATE,CWE-200,
 CVE-2026-63462,2026-08-21T19:14:37Z,"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter",unleash-server,0,7.5.2,,HIGH,CWE-674,
 CVE-2026-63462,2026-08-21T19:14:37Z,"Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter",unleash-server,7.6.0,7.6.5,,HIGH,CWE-674,
@@ -7491,6 +7622,8 @@ CVE-2026-63466,2026-08-21T19:14:52Z,"Unleash: Global Mustache.escape override di
 CVE-2026-63472,2026-09-17T14:50:22Z,"Vendure affected by external-authentication account takeover: external login linked to a pre-existing account by email without verification",@vendure/core,0,3.7.0,,CRITICAL,CWE-287,
 CVE-2026-63506,2026-09-17T14:59:00Z,"Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site",@tinacms/auth,0,1.1.4,,HIGH,CWE-639,
 CVE-2026-63506,2026-09-17T14:59:00Z,"Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted site",next-tinacms-azure,0,15.0.1,,HIGH,CWE-639,
+CVE-2026-63627,2026-09-22T20:34:17Z,"mppx: Gas Draining with padding",mppx,0,0.8.2,,MODERATE,CWE-20,
+CVE-2026-63628,2026-09-22T20:34:19Z,"mppx: Gas Draining with access list",mppx,0,0.8.2,,MODERATE,CWE-20,
 CVE-2026-63640,2026-08-18T18:00:16Z,"MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables",magicmirror,0,2.37.0,,MODERATE,CWE-200,
 CVE-2026-63641,2026-08-18T17:26:41Z,"MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions",magicmirror,0,2.37.0,,LOW,CWE-284,
 CVE-2026-63642,2026-08-18T17:26:46Z,"MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery",magicmirror,0,2.37.0,,MODERATE,CWE-918,
@@ -7567,6 +7700,7 @@ CVE-2026-65912,2026-04-03T03:46:07Z,"DOMPurify ADD_ATTR predicate skips URI vali
 CVE-2026-65913,2026-04-03T03:45:08Z,"DOMPurify USE_PROFILES prototype pollution allows event handlers",dompurify,0,3.3.2,,MODERATE,CWE-1321,
 CVE-2026-65914,2026-03-27T20:41:29Z,"DOMPurify is vulnerable to mutation-XSS via Re-Contextualization ",dompurify,0,3.3.2,,MODERATE,CWE-79,
 CVE-2026-6594,2026-04-20T03:34:41Z,"Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization",@brikcss/merge,0,,1.3.1,MODERATE,CWE-1321;CWE-94,
+CVE-2026-66010,2026-07-21T19:41:07Z,"DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",dompurify,0,3.4.12,,LOW,CWE-184;CWE-693;CWE-79,
 CVE-2026-66062,2026-08-07T16:50:02Z,"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header",@sveltejs/kit,0,2.70.2,,MODERATE,CWE-1333,
 CVE-2026-67213,2026-07-29T15:31:12Z,"nanoid: custom generators can loop indefinitely when size is zero",nanoid,0,3.3.18,,HIGH,CWE-835,
 CVE-2026-67213,2026-07-29T15:31:12Z,"nanoid: custom generators can loop indefinitely when size is zero",nanoid,4.0.0,5.1.6,,HIGH,CWE-835,
@@ -7860,6 +7994,7 @@ CVE-2026-73844,2026-09-03T14:49:10Z,"CKAN MCP Server: Information disclosure via
 CVE-2026-73845,2026-09-02T14:52:21Z,"CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)","@aborruso/ckan-mcp-server",0,0.4.112,,MODERATE,CWE-20;CWE-625;CWE-918,
 CVE-2026-73846,2026-09-03T14:49:22Z,"CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning","@aborruso/ckan-mcp-server",0,0.4.112,,MODERATE,CWE-345;CWE-436,
 CVE-2026-7446,2026-04-30T00:31:22Z,"mcp-server-semgrep has a Command Injection issue",mcp-server-semgrep,0,1.0.1,,MODERATE,CWE-77,
+CVE-2026-75510,2026-09-22T20:34:35Z,"Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme",@novu/js,0,3.18.0,,MODERATE,CWE-79,
 CVE-2026-75604,2026-09-08T20:51:40Z,"Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",next,13.4.0,15.5.24,,CRITICAL,CWE-22,
 CVE-2026-75604,2026-09-08T20:51:40Z,"Next.js: Unauthenticated Remote Code Execution on windows-hosted servers",next,16.0.0,16.3.3,,CRITICAL,CWE-22,
 CVE-2026-75856,2026-09-04T18:05:12Z,"CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning",codewhale,0.8.41,0.8.64,,CRITICAL,CWE-918,
@@ -7890,11 +8025,16 @@ CVE-2026-75975,2026-09-02T15:43:30Z,"fast-uri vulnerable to server-side request
 CVE-2026-75975,2026-09-02T15:43:30Z,"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",fast-uri,3.0.0,3.1.6,,HIGH,CWE-20;CWE-918,
 CVE-2026-75975,2026-09-02T15:43:30Z,"fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization",fast-uri,4.0.0,4.1.3,,HIGH,CWE-20;CWE-918,
 CVE-2026-7600,2026-05-02T03:31:13Z,"yii2-mcp-server has a Command Injection Issue",yii2-mcp-server,0,,1.0.2,LOW,CWE-77,
+CVE-2026-76169,2026-09-30T23:45:34Z,"fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers",fastify,4.0.0,5.12.2,,HIGH,CWE-288,
 CVE-2026-76172,2026-09-02T15:41:53Z,"fast-uri vulnerable to host confusion via percent-encoded scheme normalization",fast-uri,2.3.1,2.4.5,,HIGH,CWE-177,
 CVE-2026-76172,2026-09-02T15:41:53Z,"fast-uri vulnerable to host confusion via percent-encoded scheme normalization",fast-uri,3.0.0,3.1.6,,HIGH,CWE-177,
 CVE-2026-76172,2026-09-02T15:41:53Z,"fast-uri vulnerable to host confusion via percent-encoded scheme normalization",fast-uri,4.0.0,4.1.3,,HIGH,CWE-177,
 CVE-2026-7645,2026-05-02T18:30:27Z,"sublinear-time-solver has a Path Traversal Issue",sublinear-time-solver,0,,1.5.0,MODERATE,CWE-22,
+CVE-2026-76844,2026-09-29T16:59:18Z,"webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",webpack-dev-middleware,0,7.4.6,,HIGH,CWE-22,
+CVE-2026-76844,2026-09-29T16:59:18Z,"webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",webpack-dev-middleware,8.0.0,8.3.0,,HIGH,CWE-22,
 CVE-2026-76845,2026-08-24T15:31:51Z,"adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite",adm-zip,0.5.9,,0.6.0,MODERATE,CWE-59,
+CVE-2026-76909,2026-09-22T20:34:38Z,"Unleash: CR-approval email renders user-controlled raw HTML",unleash-server,0,8.0.3,,LOW,CWE-79,
+CVE-2026-76910,2026-09-22T20:34:40Z,"Unleash: Clone-feature lets a user copy a feature from a project they cannot read",unleash-server,0,8.0.3,,MODERATE,CWE-639,
 CVE-2026-76969,2026-09-08T03:31:13Z,"@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)",@sap/cds-mtxs,0,1.18.4,,CRITICAL,CWE-522,
 CVE-2026-76969,2026-09-08T03:31:13Z,"@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)",@sap/cds-mtxs,2.0.2,2.7.7,,CRITICAL,CWE-522,
 CVE-2026-76969,2026-09-08T03:31:13Z,"@sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)",@sap/cds-mtxs,3.0.1,3.9.7,,CRITICAL,CWE-522,
@@ -7905,12 +8045,15 @@ CVE-2026-77078,2026-09-08T21:30:20Z,"multer vulnerable to Denial of Service via
 CVE-2026-77301,2026-09-18T17:18:01Z,"adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)",adm-zip,0,0.6.1,,HIGH,CWE-789,
 CVE-2026-77360,2026-09-17T14:52:37Z,"oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass",@orpc/server,0,1.14.8,,MODERATE,CWE-113,
 CVE-2026-7738,2026-05-04T09:31:09Z,"@puchunjie/doc-tools-mcp has a Path Traversal Issue",@puchunjie/doc-tools-mcp,0,,1.0.18,LOW,CWE-22,
+CVE-2026-77394,2026-09-23T21:24:11Z,"OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget",@openc3/vue-common,5.0.6,7.3.0,,HIGH,CWE-79,
 CVE-2026-77413,2026-08-21T20:57:07Z,"JSONata: Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
 CVE-2026-77413,2026-08-21T20:57:07Z,"JSONata: Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.0,,CRITICAL,CWE-94,
 CVE-2026-77414,2026-08-21T20:58:01Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
 CVE-2026-77414,2026-08-21T20:58:01Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.1,,CRITICAL,CWE-94,
 CVE-2026-77415,2026-08-21T21:04:19Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,0,1.8.8,,CRITICAL,CWE-94,
 CVE-2026-77415,2026-08-21T21:04:19Z,"JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions",jsonata,2.0.0,2.2.1,,CRITICAL,CWE-94,
+CVE-2026-77425,2026-09-22T20:36:39Z,"Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log",unleash-server,0,8.0.3,,MODERATE,CWE-639;CWE-863,
+CVE-2026-77426,2026-09-22T20:36:42Z,"Unleash: Missing await on permission check + cross-project IDOR in admin API",unleash-server,0,8.0.3,,HIGH,CWE-639;CWE-862,
 CVE-2026-77465,2026-09-03T20:56:13Z,"toml-node: Uncontrolled Recursion",toml,0,4.2.0,,HIGH,CWE-674,
 CVE-2026-77615,2026-09-18T13:11:59Z,"Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text",paella-core,0,1.50.6,,HIGH,CWE-79,
 CVE-2026-7768,2026-05-08T17:13:38Z,"@fastify/accepts-serializer Vulnerable to Denial of Service via Unbounded Accept Header Cache Growth","@fastify/accepts-serializer",0,6.0.4,,HIGH,CWE-770,
@@ -7963,6 +8106,9 @@ CVE-2026-83616,2026-09-08T21:03:28Z,"xmldom: Processing Instruction Target Injec
 CVE-2026-83617,2026-09-08T21:03:17Z,"xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator",@xmldom/xmldom,0.9.11,0.9.12,,HIGH,CWE-625;CWE-91,
 CVE-2026-83618,2026-09-08T21:02:25Z,"xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator",@xmldom/xmldom,0.9.10,0.9.12,,HIGH,CWE-625;CWE-91,
 CVE-2026-83619,2026-09-08T21:01:09Z,"xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser",@xmldom/xmldom,0.7.0,0.8.15,,HIGH,CWE-1333;CWE-400,
+CVE-2026-84292,2026-09-28T21:24:39Z,"fast-uri vulnerable to authority injection via an unvalidated port in serialize",fast-uri,0,2.4.6,,HIGH,CWE-116,
+CVE-2026-84292,2026-09-28T21:24:39Z,"fast-uri vulnerable to authority injection via an unvalidated port in serialize",fast-uri,3.0.0,3.1.7,,HIGH,CWE-116,
+CVE-2026-84292,2026-09-28T21:24:39Z,"fast-uri vulnerable to authority injection via an unvalidated port in serialize",fast-uri,4.0.0,4.1.4,,HIGH,CWE-116,
 CVE-2026-84363,2026-09-08T21:22:50Z,"Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials",hono,0,4.13.5,,MODERATE,CWE-444,
 CVE-2026-84364,2026-09-08T21:23:02Z,"Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion",hono,0,4.13.5,,MODERATE,CWE-400,
 CVE-2026-84365,2026-09-08T21:23:51Z,"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory",hono,0,4.13.5,,MODERATE,CWE-22,
@@ -7985,10 +8131,33 @@ CVE-2026-84373,2026-09-08T20:46:45Z,"Vitest: Path Traversal / Arbitrary File Rea
 CVE-2026-84375,2026-09-08T21:24:51Z,"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",js-yaml,3.0.0,3.15.2,,HIGH,CWE-400;CWE-407,
 CVE-2026-84375,2026-09-08T21:24:51Z,"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",js-yaml,4.0.0,4.3.2,,HIGH,CWE-400;CWE-407,
 CVE-2026-84376,2026-09-08T21:26:02Z,"Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base",astro,0,7.2.4,,MODERATE,CWE-187,
+CVE-2026-84394,2026-09-28T21:23:35Z,"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority",fast-uri,2.4.5,2.4.6,,HIGH,CWE-436,
+CVE-2026-84394,2026-09-28T21:23:35Z,"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority",fast-uri,3.1.6,3.1.7,,HIGH,CWE-436,
+CVE-2026-84394,2026-09-28T21:23:35Z,"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority",fast-uri,4.1.3,4.1.4,,HIGH,CWE-436,
+CVE-2026-84428,2026-09-30T23:44:27Z,"fastify vulnerable to header validation bypass via incomplete schema case normalization",fastify,0,5.12.2,,HIGH,CWE-178,
+CVE-2026-84469,2026-09-30T23:44:58Z,"fastify vulnerable to request validation bypass via skipped boolean false schemas",fastify,0,5.12.2,,HIGH,CWE-20,
+CVE-2026-84504,2026-09-30T23:45:45Z,"fastify vulnerable to request body replacement via an async validation result collision",fastify,0,5.12.2,,HIGH,CWE-20,
+CVE-2026-84890,2026-09-29T18:20:37Z,"undici vulnerable to Denial of Service via unbounded decompression of compressed responses",undici,7.15.0,7.29.1,,MODERATE,CWE-770,
+CVE-2026-84890,2026-09-29T18:20:37Z,"undici vulnerable to Denial of Service via unbounded decompression of compressed responses",undici,8.0.0,8.10.2,,MODERATE,CWE-770,
+CVE-2026-84933,2026-09-29T18:19:58Z,"undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches",undici,7.0.0,7.29.1,,MODERATE,CWE-200;CWE-524,
+CVE-2026-84933,2026-09-29T18:19:58Z,"undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches",undici,8.0.0,8.10.2,,MODERATE,CWE-200;CWE-524,
+CVE-2026-84947,2026-09-29T18:18:51Z,"undici vulnerable to response truncation via oversized chunked responses in the dump interceptor",undici,7.1.0,7.29.1,,LOW,CWE-20;CWE-248,
+CVE-2026-84947,2026-09-29T18:18:51Z,"undici vulnerable to response truncation via oversized chunked responses in the dump interceptor",undici,8.0.0,8.10.2,,LOW,CWE-20;CWE-248,
+CVE-2026-84961,2026-09-29T18:17:15Z,"undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool",undici,7.24.1,7.29.1,,HIGH,CWE-295,
+CVE-2026-84961,2026-09-29T18:17:15Z,"undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool",undici,8.0.0,8.10.2,,HIGH,CWE-295,
 CVE-2026-84992,2026-09-18T17:17:36Z,"md-editor-v3: XSS via fenced-code language rendering bypass",md-editor-v3,0,6.5.4,,MODERATE,CWE-79,
+CVE-2026-85008,2026-09-29T18:16:28Z,"undici vulnerable to caching and replay of unsafe HTTP method responses",undici,7.0.0,7.29.1,,LOW,CWE-345,
+CVE-2026-85008,2026-09-29T18:16:28Z,"undici vulnerable to caching and replay of unsafe HTTP method responses",undici,8.0.0,8.10.2,,LOW,CWE-345,
+CVE-2026-85014,2026-09-29T18:10:32Z,"undici vulnerable to Denial of Service via WebSocketStream unclean close",undici,7.0.0,7.29.1,,MODERATE,CWE-248;CWE-754,
+CVE-2026-85014,2026-09-29T18:10:32Z,"undici vulnerable to Denial of Service via WebSocketStream unclean close",undici,8.0.0,8.10.2,,MODERATE,CWE-248;CWE-754,
+CVE-2026-85024,2026-09-28T21:42:37Z,"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",undici,6.25.0,6.28.1,,MODERATE,CWE-248,
+CVE-2026-85024,2026-09-28T21:42:37Z,"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",undici,7.28.0,7.29.1,,MODERATE,CWE-248,
+CVE-2026-85024,2026-09-28T21:42:37Z,"undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression",undici,8.1.0,8.10.2,,MODERATE,CWE-248,
 CVE-2026-85061,2026-09-08T20:50:47Z,"MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip",maplibre-gl,0,6.4.1,,CRITICAL,CWE-79,
 CVE-2026-85062,2026-09-08T20:51:57Z,"Colord: Slow rejection of oversized malformed color strings",colord,0,2.9.4,,MODERATE,CWE-1333,
 CVE-2026-85063,2026-09-08T18:01:39Z,"node-csv: Prototype replacement still reachable via columns path",csv-parse,0,7.0.2,,MODERATE,CWE-1321,
+CVE-2026-85152,2026-09-29T18:15:13Z,"undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors",undici,8.10.0,8.10.2,,HIGH,CWE-346,
+CVE-2026-85393,2026-09-03T21:31:15Z,"node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements",node-forge,0,,1.4.0,HIGH,CWE-347,
 CVE-2026-85715,2026-09-17T16:30:00Z,"ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion",exifreader,0,4.41.1,,HIGH,CWE-789;CWE-835,
 CVE-2026-85730,2026-09-09T18:07:11Z,"smol-toml: Denial of Service via malformed TOML documents",smol-toml,0,1.7.1,,HIGH,CWE-606;CWE-835,
 CVE-2026-86038,2026-09-17T17:29:31Z,"libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID",@libp2p/gossipsub,15.0.0,16.0.5,,HIGH,CWE-345;CWE-347,
@@ -8026,7 +8195,13 @@ CVE-2026-86084,2026-09-10T21:07:24Z,"n8n: Disabled OIDC SSO Endpoints Remain Act
 CVE-2026-86084,2026-09-10T21:07:24Z,"n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions",n8n,2.38.0,2.38.2,,MODERATE,CWE-288,
 CVE-2026-86085,2026-09-10T21:13:24Z,"n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints",n8n,0,2.37.7,,MODERATE,CWE-862,
 CVE-2026-86085,2026-09-10T21:13:24Z,"n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints",n8n,2.38.0,2.38.2,,MODERATE,CWE-862,
+CVE-2026-86250,2026-03-23T21:44:55Z,"H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,2.0.1-rc.18,,MODERATE,CWE-400,
+CVE-2026-86439,2026-09-25T19:32:05Z,"Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools",knowns,0,0.30.0,,HIGH,CWE-22;CWE-306;CWE-863,
+CVE-2026-86472,2026-09-29T23:54:25Z,"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",fast-uri,0,2.4.7,,MODERATE,CWE-178,
+CVE-2026-86472,2026-09-29T23:54:25Z,"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",fast-uri,3.0.0,3.1.8,,MODERATE,CWE-178,
+CVE-2026-86472,2026-09-29T23:54:25Z,"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets",fast-uri,4.0.0,4.1.5,,MODERATE,CWE-178,
 CVE-2026-8657,2026-05-16T06:30:29Z," jsondiffpatch patch APIs are vulnerable to prototype pollution",jsondiffpatch,0,0.7.6,,HIGH,CWE-1321,
+CVE-2026-86818,2026-09-29T23:51:16Z,"fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization",fast-uri,4.1.3,4.1.5,,MODERATE,CWE-172;CWE-436,
 CVE-2026-86993,2026-09-10T21:07:45Z,"n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check",n8n,0,1.123.76,,MODERATE,CWE-862,
 CVE-2026-86993,2026-09-10T21:07:45Z,"n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check",n8n,2.0.0,2.37.7,,MODERATE,CWE-862,
 CVE-2026-86993,2026-09-10T21:07:45Z,"n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check",n8n,2.38.0,2.38.2,,MODERATE,CWE-862,
@@ -8043,6 +8218,7 @@ CVE-2026-8766,2026-05-18T00:31:36Z,"@kilocode/cli Vulnerable to Exposure of Sens
 CVE-2026-8769,2026-05-18T00:31:37Z,"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",@ai-sdk/provider-utils,0,3.0.28,,LOW,CWE-400,
 CVE-2026-8769,2026-05-18T00:31:37Z,"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",@ai-sdk/provider-utils,4.0.0-beta.10,4.0.33,,LOW,CWE-400,
 CVE-2026-8769,2026-05-18T00:31:37Z,"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue",@ai-sdk/provider-utils,5.0.0-beta.0,5.0.1,,LOW,CWE-400,
+CVE-2026-87859,2026-09-28T21:33:08Z,"morgan vulnerable to Log Injection via unescaped double quote in quoted log fields",morgan,0,1.12.1,,MODERATE,CWE-117,
 CVE-2026-88056,2026-09-10T20:19:43Z,"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR",@angular/platform-server,0,,19.2.25,HIGH,CWE-918,
 CVE-2026-88056,2026-09-10T20:19:43Z,"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR",@angular/platform-server,20.0.0,20.3.30,,HIGH,CWE-918,
 CVE-2026-88056,2026-09-10T20:19:43Z,"Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR",@angular/platform-server,21.0.0,21.2.22,,HIGH,CWE-918,
@@ -8055,24 +8231,49 @@ CVE-2026-88057,2026-09-10T20:18:02Z,"Angular: Sanitization bypass via directive
 CVE-2026-88057,2026-09-10T20:18:02Z,"Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",@angular/core,20.0.0,20.3.28,,MODERATE,CWE-79,
 CVE-2026-88057,2026-09-10T20:18:02Z,"Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",@angular/core,21.0.0,21.2.20,,MODERATE,CWE-79,
 CVE-2026-88057,2026-09-10T20:18:02Z,"Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",@angular/core,22.0.0,22.1.0,,MODERATE,CWE-79,
+CVE-2026-88058,2026-09-28T20:39:26Z,"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements",@angular/platform-server,0,,19.2.25,HIGH,CWE-116;CWE-79,
+CVE-2026-88058,2026-09-28T20:39:26Z,"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements",@angular/platform-server,20.0.0,20.3.30,,HIGH,CWE-116;CWE-79,
+CVE-2026-88058,2026-09-28T20:39:26Z,"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements",@angular/platform-server,21.0.0,21.2.22,,HIGH,CWE-116;CWE-79,
+CVE-2026-88058,2026-09-28T20:39:26Z,"Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements",@angular/platform-server,22.0.0,22.1.4,,HIGH,CWE-116;CWE-79,
 CVE-2026-88059,2026-09-10T20:19:19Z,"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",@angular/common,0,,19.2.25,MODERATE,CWE-200;CWE-524,
 CVE-2026-88059,2026-09-10T20:19:19Z,"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",@angular/common,20.0.0,20.3.28,,MODERATE,CWE-200;CWE-524,
 CVE-2026-88059,2026-09-10T20:19:19Z,"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",@angular/common,21.0.0,21.2.20,,MODERATE,CWE-200;CWE-524,
 CVE-2026-88059,2026-09-10T20:19:19Z,"Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",@angular/common,22.0.0,22.1.1,,MODERATE,CWE-200;CWE-524,
-CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,0,,19.2.25,HIGH,CWE-79;CWE-116,
-CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,20.0.0,20.3.30,,HIGH,CWE-79;CWE-116,
-CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,21.0.0,21.2.22,,HIGH,CWE-79;CWE-116,
-CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,22.0.0,22.1.4,,HIGH,CWE-79;CWE-116,
+CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,0,,19.2.25,HIGH,CWE-116;CWE-79,
+CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,20.0.0,20.3.30,,HIGH,CWE-116;CWE-79,
+CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,21.0.0,21.2.22,,HIGH,CWE-116;CWE-79,
+CVE-2026-88060,2026-09-10T20:25:25Z,"Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements",@angular/platform-server,22.0.0,22.1.4,,HIGH,CWE-116;CWE-79,
 CVE-2026-88062,2026-09-10T21:22:12Z," OmniRoute ACP Custom-Agent Remote Code Execution (RCE)",omniroute,0,,3.8.50,CRITICAL,CWE-306;CWE-94,
 CVE-2026-8813,2026-05-29T17:58:37Z,"ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag",exifreader,2.10.0,4.39.0,,HIGH,CWE-1284,
 CVE-2026-8814,2026-05-29T17:52:26Z,"ExifReader is vulnerable to denial of service via unbounded decompression of image metadata",exifreader,4.20.0,4.39.0,,MODERATE,CWE-409,
+CVE-2026-88932,2026-09-28T21:34:58Z,"multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads",multer,2.2.0,2.4.0,,MODERATE,CWE-400;CWE-459,
 CVE-2026-88976,2026-09-17T20:32:47Z,"@platejs/core HTML deserialization can trigger browser behavior during parsing",@platejs/core,0,53.3.11,,MODERATE,CWE-79,
 CVE-2026-88976,2026-09-17T20:32:47Z,"@platejs/core HTML deserialization can trigger browser behavior during parsing",@platejs/core,54.0.0-beta.0,,54.0.0-beta.1,MODERATE,CWE-79,
 CVE-2026-91127,2026-09-18T17:19:42Z,"File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer",@file-viewer/doc,0,2.3.1,,HIGH,CWE-79;CWE-83,
 CVE-2026-91127,2026-09-18T17:19:42Z,"File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer",msdoc-viewer,0,0.2.2,,HIGH,CWE-79;CWE-83,
+CVE-2026-92081,2026-09-30T23:53:44Z,"fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses",fastify,0,5.12.5,,MODERATE,CWE-248,
+CVE-2026-92708,2026-10-01T15:18:06Z,"devalue: `stringify`/`uneval` serialize shared memory",devalue,5.1.0,5.9.3,,HIGH,CWE-200;CWE-226,
 CVE-2026-9277,2026-06-09T14:27:15Z,"shell-quote quote() does not escape newlines in object .op values",shell-quote,1.1.0,1.8.4,,CRITICAL,CWE-77;CWE-78,
+CVE-2026-92935,2026-10-01T15:34:58Z,"vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE",vm2,3.11.4,3.11.7,,CRITICAL,CWE-913,
+CVE-2026-92937,2026-10-01T15:32:10Z,"vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection",vm2,3.11.6,3.11.7,,CRITICAL,CWE-693;CWE-94,
+CVE-2026-92938,2026-10-01T15:29:04Z,"vm2 allows a sandboxed plugin to execute native code through `node:sqlite`",vm2,3.11.3,3.11.7,,CRITICAL,CWE-693,
+CVE-2026-92939,2026-10-01T15:28:36Z,"vm2 crypto builtin loads attacker native code through setEngine",vm2,3.11.3,3.11.7,,CRITICAL,CWE-114,
+CVE-2026-92940,2026-10-01T15:38:26Z,"vm2 exposes host HTTPS credentials and TLS traffic through globalAgent",vm2,3.11.3,3.11.7,,CRITICAL,CWE-668,
+CVE-2026-92941,2026-10-01T15:27:28Z,"vm2 NodeVM can replace the host process TLS trust store",vm2,3.11.3,3.11.7,,CRITICAL,CWE-732,
+CVE-2026-92944,2026-10-01T15:28:07Z,"vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector",vm2,3.10.2,3.11.7,,CRITICAL,CWE-693;CWE-913,
+CVE-2026-92945,2026-10-01T15:26:45Z,"vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted",vm2,0,3.11.7,,MODERATE,CWE-22;CWE-863,
+CVE-2026-92948,2026-10-01T15:41:31Z,"vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape",vm2,3.9.6,3.11.7,,CRITICAL,CWE-693,
+CVE-2026-92949,2026-10-01T15:35:25Z,"vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor",vm2,3.9.6,3.11.7,,MODERATE,CWE-471;CWE-693,
+CVE-2026-92950,2026-10-01T15:40:45Z,"vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts",vm2,0,3.11.7,,HIGH,CWE-1188;CWE-453;CWE-829,
+CVE-2026-92951,2026-10-01T15:37:19Z,"vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package",vm2,0,3.11.7,,CRITICAL,CWE-706;CWE-829;CWE-863,
+CVE-2026-92952,2026-10-01T15:42:15Z,"vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks",vm2,3.11.4,3.11.7,,MODERATE,CWE-669,
+CVE-2026-92957,2026-10-01T15:36:01Z,"vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process",vm2,0,3.11.7,,CRITICAL,CWE-269;CWE-284,
+CVE-2026-92958,2026-10-01T15:36:48Z,"vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes",vm2,0,3.11.7,,HIGH,CWE-269;CWE-284,
 CVE-2026-9358,2026-05-26T13:30:30Z,"postcss-selector-parser allows denial of service through uncontrolled AST recursion",postcss-selector-parser,6.1.0,6.1.3,,LOW,CWE-404,
 CVE-2026-9358,2026-05-26T13:30:30Z,"postcss-selector-parser allows denial of service through uncontrolled AST recursion",postcss-selector-parser,7.1.0,7.1.3,,LOW,CWE-404,
+CVE-2026-93687,2026-09-18T18:31:41Z,"braces vulnerable to stack-exhaustion denial of service through deeply nested patterns",braces,0,,3.0.3,HIGH,CWE-674,
+CVE-2026-93748,2026-09-18T18:31:44Z,"http-cache-semantics max-stale handling can disclose cross-user cached responses",http-cache-semantics,0,,4.2.0,HIGH,CWE-524,
+CVE-2026-93981,2026-09-30T23:46:16Z,"hono/jsx renders plain strings unescaped in boundary components, leading to XSS",hono,0,4.13.7,,MODERATE,CWE-79,
 CVE-2026-9495,2026-05-26T13:30:54Z,"@koa/router has an Access Control Bypass",@koa/router,14.0.0,15.0.0,,MODERATE,CWE-284,
 CVE-2026-9496,2026-05-26T13:30:54Z,"pacote is vulnerable to Denial of Service (DoS) via the addGitSha function",pacote,11.2.7,21.5.1,,HIGH,CWE-1333;CWE-400,
 CVE-2026-9520,2026-05-26T13:30:53Z,"Blitz has a Cross-site Scripting issue",blitz,0,,3.0.2,LOW,CWE-79,
@@ -8081,11 +8282,13 @@ CVE-2026-9673,2026-05-28T06:31:09Z,"json-2-csv vulnerable to CSV Injection via t
 CVE-2026-9675,2026-06-18T14:28:10Z,"undici WebSocket client vulnerable to denial of service via cumulative fragment bypass",undici,8.0.0,8.5.0,,HIGH,CWE-400;CWE-770,
 CVE-2026-9678,2026-06-18T14:28:13Z,"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",undici,7.0.0,7.28.0,,MODERATE,CWE-524,
 CVE-2026-9678,2026-06-18T14:28:13Z,"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass",undici,8.0.0,8.5.0,,MODERATE,CWE-524,
+CVE-2026-96780,2026-10-02T22:39:16Z,"figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width",figlet,0,1.11.3,,HIGH,CWE-835,
 CVE-2026-9679,2026-06-19T14:21:30Z,"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",undici,0,6.27.0,,MODERATE,CWE-93,
 CVE-2026-9679,2026-06-19T14:21:30Z,"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",undici,7.0.0,7.28.0,,MODERATE,CWE-93,
 CVE-2026-9679,2026-06-19T14:21:30Z,"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",undici,8.0.0,8.5.0,,MODERATE,CWE-93,
 CVE-2026-9697,2026-06-18T14:28:21Z,"undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent",undici,7.23.0,7.28.0,,HIGH,CWE-295,
 CVE-2026-9697,2026-06-18T14:28:21Z,"undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent",undici,8.0.0,8.5.0,,HIGH,CWE-295,
+CVE-2026-97711,2026-09-30T15:40:05Z,"Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies",serialize-javascript,7.1.1,7.1.2,,LOW,CWE-79;CWE-80,
 GHSA-224h-p7p5-rh85,2020-09-01T17:32:26Z,"Directory Traversal in wenluhong1",wenluhong1,0.0.0,,,HIGH,CWE-22,
 GHSA-224p-v68g-5g8f,2025-08-26T18:45:55Z,"GraphQL Armor Max-Depth Plugin Bypass via fragment caching","@escape.tech/graphql-armor-max-depth",0,2.4.2,,MODERATE,CWE-400,
 GHSA-226w-6hhj-69hp,2020-09-03T19:06:52Z,"Malicious Package in cal_rd",cal_rd,0.0.0,,,CRITICAL,CWE-506,
@@ -8101,12 +8304,13 @@ GHSA-23q2-5gf8-gjpp,2024-04-19T17:26:32Z,"Enabling Authentication does not close
 GHSA-23vw-mhv5-grv5,2020-09-03T15:48:43Z,"Denial of Service in @hapi/hapi",@hapi/hapi,0,18.4.1,,HIGH,,
 GHSA-23vw-mhv5-grv5,2020-09-03T15:48:43Z,"Denial of Service in @hapi/hapi",@hapi/hapi,19.0.0,19.1.1,,HIGH,,
 GHSA-24v3-254g-jv85,2025-12-19T21:32:35Z,"Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature",@tutao/tutanota-utils,0,314.251111.0,,LOW,CWE-1021;CWE-79,
+GHSA-253c-mchw-3w2r,2026-09-29T17:57:56Z,"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds",markdown-it,0,14.3.1,,MODERATE,CWE-400;CWE-407,
+GHSA-253c-mchw-3w2r,2026-09-29T17:57:56Z,"markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds",markdown-it,15.0.0,15.0.1,,MODERATE,CWE-400;CWE-407,
 GHSA-255r-pghp-r5wh,2020-09-03T17:05:34Z,"Malicious Package in hdeky",hdeky,0.0.0,,,CRITICAL,CWE-506,
 GHSA-2563-83p7-f34p,2020-09-02T20:24:41Z,"Malicious Package in requestt",requestt,0,,,CRITICAL,CWE-506,
 GHSA-25v4-mcx4-hh35,2020-09-04T17:28:28Z,"Cross-Site Scripting in atlasboard-atlassian-package","atlasboard-atlassian-package",0.0.0,,,HIGH,CWE-79,
 GHSA-268h-hp4c-crq3,2026-06-15T17:36:06Z,"Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection",nodemailer,0,8.0.9,,MODERATE,CWE-93,
 GHSA-26hg-crh6-mjrw,2021-02-23T21:28:28Z,"Directory Traversal",list-n-stream,0,0.0.11,,HIGH,,
-GHSA-26pp-8wgv-hjvm,2026-04-08T00:17:02Z,"Hono missing validation of cookie name on write path in setCookie()",hono,0,4.12.12,,MODERATE,CWE-113,
 GHSA-26w7-cxv4-gfx2,2026-09-08T21:26:16Z,"Astro: Remote code execution through AVIF image optimization",astro,0,7.2.8,,CRITICAL,CWE-125;CWE-787,
 GHSA-26wg-9xf2-q495,2026-04-14T23:23:01Z,"Novu has a XSS sanitization bypass",novu/api,0,3.15.0,,HIGH,CWE-79,
 GHSA-277h-px4m-62q8,2024-10-03T19:46:12Z,"@saltcorn/server arbitrary file zip read and download when downloading auto backups",@saltcorn/server,0,1.0.0-beta.14,,MODERATE,CWE-22,
@@ -8116,11 +8320,15 @@ GHSA-27v7-qhfv-rqq8,2019-05-30T17:26:30Z,"Insecure Credential Storage in web3",w
 GHSA-2858-xg23-26fp,2026-03-03T21:18:56Z,"OpenClaw: Node camera URL payload host-binding bypass allowed gateway fetch pivots",openclaw,2026.2.13,2026.3.2,,MODERATE,CWE-918,
 GHSA-28f4-mjfq-qrvf,2020-09-03T22:18:40Z,"Malicious Package in buffes-xor",buffes-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-28hp-fgcr-2r4h,2019-06-27T17:25:42Z,"Cross-Site Scripting via JSONP",angular,0,1.6.0,,MODERATE,CWE-79,
+GHSA-28q4-xrqh-9479,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process",vm2,0,,3.11.6,CRITICAL,CWE-269,
 GHSA-28qq-5f47-r5x2,2026-01-23T06:31:23Z,"Duplicate Advisory: gemini-mcp-tool vulnerable to OS command injection and @file exfiltration via prompt quoting (CVE-2026-0755)",gemini-mcp-tool,1.1.2,1.1.6,,CRITICAL,CWE-78,
 GHSA-28xh-wpgr-7fm8,2019-06-20T15:35:49Z,"Command Injection in open",open,0,6.0.0,,CRITICAL,CWE-77,
 GHSA-28xx-8j99-m32j,2020-09-01T20:37:25Z,"Malicious Package in nginxbeautifier",nginxbeautifier,1.0.14,1.0.15,,CRITICAL,CWE-506,
 GHSA-2944-57xv-2682,2026-07-02T19:07:44Z,"@asymmetric-effort/specifyjs: `data:` URI allowed without size restriction","@asymmetric-effort/specifyjs",0,0.2.136,,MODERATE,CWE-918,
 GHSA-29fh-xcjr-p7rx,2020-09-03T17:02:22Z,"Malicious Package in web3-eht",web3-eht,0.0.0,,,CRITICAL,CWE-506,
+GHSA-29h2-jr22-frmh,2026-09-25T19:31:08Z,"OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet","@openzeppelin/confidential-contracts",0,0.3.2,,HIGH,CWE-284,
+GHSA-29h2-jr22-frmh,2026-09-25T19:31:08Z,"OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet","@openzeppelin/confidential-contracts",0.4.0-rc.0,0.4.2,,HIGH,CWE-284,
+GHSA-29h2-jr22-frmh,2026-09-25T19:31:08Z,"OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet","@openzeppelin/confidential-contracts",0.5.0-rc.0,0.5.2,,HIGH,CWE-284,
 GHSA-2c83-wfv3-q25f,2021-09-07T23:07:56Z,"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown",rebber,0,5.2.1,,CRITICAL,CWE-78,
 GHSA-2cf5-4w76-r9qv,2020-09-04T14:57:38Z,"Arbitrary Code Execution in handlebars",handlebars,0,3.0.8,,HIGH,CWE-94,
 GHSA-2cf5-4w76-r9qv,2020-09-04T14:57:38Z,"Arbitrary Code Execution in handlebars",handlebars,4.0.0,4.5.2,,HIGH,CWE-94,
@@ -8178,6 +8386,7 @@ GHSA-2w9p-xf5h-qwj3,2023-03-27T03:30:16Z,"Duplicate Advisory: pullit Command Inj
 GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,0,1.123.67,,HIGH,CWE-200;CWE-843;CWE-918,
 GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-200;CWE-843;CWE-918,
 GHSA-2x35-3fw4-9jr4,2026-07-22T22:09:11Z,"n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion",n8n,2.32.0,2.32.1,,HIGH,CWE-200;CWE-843;CWE-918,
+GHSA-2x6f-57hp-86fx,2026-06-23T15:32:36Z,"Duplicate Advisory: Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
 GHSA-2x7j-588g-ccc2,2026-09-08T21:33:17Z,"Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list",nodemailer,0,9.1.0,,HIGH,CWE-400;CWE-407,
 GHSA-2xgg-r2wc-c5r2,2026-07-24T21:26:19Z,"Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector",@budibase/server,0,,3.38.1,HIGH,CWE-89,
 GHSA-2xp4-qhr4-xqm2,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: HTTP operator endpoints lack browser-origin validation in trusted-proxy mode",openclaw,0,2026.3.31,,LOW,CWE-352,
@@ -8261,6 +8470,7 @@ GHSA-3r78-rqg8-95gg,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's voice-c
 GHSA-3rw8-4xrq-3f7p,2025-03-17T21:30:34Z,"Duplicate Advisory: Uptime Kuma ReDoS vulnerability",uptime-kuma,1.23.0,,2.0.0-dev.0,MODERATE,CWE-1333,
 GHSA-3v3j-737j-7g74,2026-06-16T21:31:59Z,"Duplicate Advisory: Linux and macOS exec allowlists skipped configured argument patterns",openclaw,0,,,HIGH,CWE-693,
 GHSA-3w6x-gv34-mqpf,2026-03-26T21:24:34Z,"OpenClaw's mutating internal ACP chat commands missed operator.admin scope enforcement",openclaw,0,2026.3.22,,HIGH,CWE-862,
+GHSA-3wcj-gjvf-fvch,2026-07-11T15:30:23Z,"Duplicate Advisory: Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })",hono,0,,,MODERATE,CWE-1321,
 GHSA-3wqh-h42r-x8fq,2020-09-03T15:46:22Z,"Denial of Service in @hapi/content",@hapi/content,0,5.0.2,,HIGH,,
 GHSA-3wqp-prf6-2m72,2026-07-02T17:08:08Z,"OpenClaw: Feishu dynamic-agent bindings could miss configWrites enforcement",openclaw,0,2026.5.6,,LOW,CWE-862,
 GHSA-3xc7-xg67-pw99,2019-06-05T20:43:10Z,"Sensitive Data Exposure in sequelize-cli",sequelize-cli,0,,5.4.0,LOW,CWE-532,
@@ -8271,10 +8481,12 @@ GHSA-43vf-2x6g-p2m5,2020-09-02T21:33:26Z,"Malicious Package in browserift",brows
 GHSA-442j-39wm-28r2,2026-03-29T15:16:37Z,"Handlebars.js has a Property Access Validation Bypass in container.lookup",handlebars,4.0.0,4.7.9,,LOW,CWE-367,
 GHSA-44c9-4rg5-qjgq,2026-03-19T03:30:57Z,"Duplicate Advisory: web_search citation redirect SSRF via private-network-allowing policy",openclaw,0,,,MODERATE,CWE-918,
 GHSA-44vf-8ffm-v2qh,2020-09-02T15:42:47Z,"Sensitive Data Exposure in rails-session-decoder",rails-session-decoder,0.0.0,,,HIGH,,
+GHSA-456v-xq2p-r4cj,2026-09-28T13:59:43Z,"code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)",code-ollama,0,0.36.1,,HIGH,CWE-78,
 GHSA-457r-cqc8-9vj9,2022-11-23T15:39:50Z,"sweetalert2 v10.16.10 and above contains hidden functionality",sweetalert2,10.16.10,11.22.4,,LOW,CWE-912,
 GHSA-4627-w373-375v,2020-09-11T21:22:24Z,"Malicious Package in grunt-radical",grunt-radical,0.0.14,0.0.13,,CRITICAL,,
 GHSA-464c-974j-9xm6,2026-07-24T16:44:20Z,"AWS CDK CodeBuild S3 Log Encryption Boolean Inversion",@aws-cdk/aws-codebuild,1.75.0,,1.204.0,LOW,CWE-311;CWE-682,
 GHSA-464c-974j-9xm6,2026-07-24T16:44:20Z,"AWS CDK CodeBuild S3 Log Encryption Boolean Inversion",aws-cdk-lib,0,2.253.0,,LOW,CWE-311;CWE-682,
+GHSA-4672-hwv6-gq62,2026-10-02T22:42:40Z,"Trigger.dev: Cross-environment deployment cancel",trigger.dev,0,4.5.6,,MODERATE,CWE-639,
 GHSA-46fh-8fc5-xcwx,2020-09-03T18:09:16Z,"Prototype Pollution in lodash.defaultsdeep",lodash.defaultsdeep,0,4.6.1,,HIGH,CWE-1321,
 GHSA-46j5-6fg5-4gv3,2025-12-18T09:30:30Z,"Duplicate Advisory: Nodemailer is vulnerable to DoS through Uncontrolled Recursion",nodemailer,0,7.0.11,,MODERATE,CWE-674;CWE-703,
 GHSA-474h-prjg-mmw3,2026-03-03T21:31:57Z,"OpenClaw: Sandboxed sessions_spawn(runtime=""acp"") bypassed sandbox inheritance and allowed host ACP initialization",openclaw,0,2026.3.2,,HIGH,CWE-269,
@@ -8315,6 +8527,7 @@ GHSA-4m3v-q747-pc6h,2026-07-02T17:13:01Z,"OpenClaw: Mattermost slash token revoc
 GHSA-4mhr-cxr4-2prm,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests",openclaw,2026.4.5,2026.4.20,,MODERATE,CWE-441,
 GHSA-4pmg-jgm5-3jg6,2020-09-02T21:16:26Z,"Malicious Package in erquest",erquest,0,,,CRITICAL,CWE-506,
 GHSA-4q2f-8g74-qm56,2020-09-03T17:18:05Z,"Cross-Site Scripting in takeapeek",takeapeek,0.0.0,,,HIGH,CWE-79,
+GHSA-4q55-j62x-fr9h,2026-10-01T15:13:23Z,"devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion",devalue,0,5.9.3,,MODERATE,CWE-1321,
 GHSA-4q8f-5xxj-946r,2020-09-03T02:40:51Z,"Command Injection in addax",addax,0,1.1.0,,HIGH,CWE-77,
 GHSA-4qgr-57jq-93vh,2026-06-16T21:31:59Z,"Duplicate Advisory: Workspace .env STATE_DIRECTORY could influence bundled runtime dependency roots",openclaw,0,,,HIGH,CWE-426,
 GHSA-4qhx-g9wp-g9m6,2019-06-14T16:09:01Z,"Failure to sanitize quotes which can lead to sql injection in squel",squel,0,,5.13.0,CRITICAL,CWE-74;CWE-89,
@@ -8347,8 +8560,6 @@ GHSA-52rh-5rpj-c3w6,2022-05-05T16:00:50Z,"Improper handling of multiline message
 GHSA-5326-6f73-m96w,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw macOS companion app (beta): allowlist parsing mismatch for system.run shell chains",openclaw,0,,,MODERATE,CWE-184,
 GHSA-5327-gfq5-8f4m,2020-09-03T21:56:23Z,"Malicious Package in buffer-xmr",buffer-xmr,0.0.0,,,CRITICAL,CWE-506,
 GHSA-533p-g2hq-qr26,2020-09-04T17:16:35Z,"Command Injection in treekill",treekill,0.0.0,,,HIGH,CWE-77,
-GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,3.18.0,3.21.7,,MODERATE,CWE-276,
-GHSA-534h-c3cw-v3h9,2026-06-16T13:49:10Z,"Nuxt dev server vite-node IPC socket is world-connectable on Linux",nuxt,4.0.0,4.4.7,,MODERATE,CWE-276,
 GHSA-534w-2vm4-89xr,2026-03-03T23:18:26Z,"OpenClaw's Zalo group sender allowlist bypass permits unauthorized GROUP dispatch",openclaw,0,2026.2.24,,MODERATE,CWE-284;CWE-863,
 GHSA-536f-268f-6gxc,2020-09-03T22:17:36Z,"Malicious Package in buffermxor",buffermxor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-53mj-mc38-q894,2020-09-01T19:40:41Z,"Remote Memory Exposure in openwhisk",openwhisk,0,3.3.1,,MODERATE,,
@@ -8358,6 +8569,7 @@ GHSA-54qm-37qr-w5wq,2020-09-04T15:04:20Z,"Sandbox Breakout / Arbitrary Code Exec
 GHSA-54xq-cgqr-rpm3,2023-11-16T17:14:15Z,"sharp vulnerability in libwebp dependency CVE-2023-4863",sharp,0,0.32.6,,HIGH,,
 GHSA-553v-f69r-656j,2026-03-03T21:39:10Z,"OpenClaw unpaired device identity can bypass operator pairing and self-assign operator scopes with shared auth",openclaw,2026.2.22,2026.2.25,,MODERATE,CWE-863,
 GHSA-559q-92vx-xvjp,2020-09-03T17:44:36Z,"Malicious Package in qingting",qingting,0.0.0,,,CRITICAL,CWE-506,
+GHSA-55cm-p4ww-685g,2026-06-23T15:32:37Z,"Duplicate Advisory: Hono missing validation of cookie name on write path in setCookie()",hono,0,4.12.12,,MODERATE,CWE-113;CWE-20,
 GHSA-55q2-fjhq-7xh7,2026-08-07T15:30:47Z,"DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS",dompurify,0,3.4.13,,MODERATE,CWE-79,
 GHSA-5634-rv46-48jf,2020-09-03T17:13:45Z,"Cross-Site Scripting in bleach",bleach,0.0.0,,,HIGH,CWE-79,
 GHSA-5635-9mvj-r6hp,2020-09-03T02:34:39Z,"Malicious Package in vue-backbone",vue-backbone,0.1.2,0.1.3,,CRITICAL,CWE-506,
@@ -8369,6 +8581,7 @@ GHSA-56x4-j7p9-fcf9,2022-08-30T20:31:21Z,"Command Injection in moment-timezone",
 GHSA-5799-3xg7-rfrv,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: SSH sandbox tar upload follows symlinks, enabling arbitrary file write on remote host",openclaw,0,2026.3.31,,HIGH,CWE-59,
 GHSA-57cf-349j-352g,2019-06-12T16:37:00Z,"Out-of-bounds Read in npmconf",npmconf,0,2.1.3,,MODERATE,CWE-125,
 GHSA-57gh-m6rq-54cf,2026-04-03T02:53:58Z,"OpenClaw: Self-Whitelisting in appendLocalMediaParentRoots Allows Arbitrary File Read & Credential Exfiltration",openclaw,0,2026.3.31,,HIGH,CWE-552,
+GHSA-5843-9mh5-hhgw,2026-09-17T15:32:14Z,"Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent",vm2,3.11.3,,3.11.6,CRITICAL,CWE-668,
 GHSA-5847-rm3g-23mw,2026-03-03T00:38:48Z,"OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants",openclaw,0,2026.2.22,,MODERATE,CWE-770,
 GHSA-5854-jvxx-2cg9,2020-09-03T15:46:57Z,"Denial of Service in content",content,0,,4.0.6,HIGH,,
 GHSA-588m-9qg5-35pq,2020-09-03T17:19:09Z,"Reverse Tabnabbing in quill",quill,0,1.3.7,,MODERATE,CWE-1022,
@@ -8381,6 +8594,7 @@ GHSA-593v-wcqx-hq2w,2021-09-07T22:57:58Z,"Incorrect version tags linked to exter
 GHSA-5947-m4fg-xhqg,2020-09-03T18:08:10Z,"Prototype Pollution in lodash.mergewith",lodash.mergewith,0,4.6.1,,HIGH,CWE-1321,
 GHSA-59f3-7227-wmh4,2026-05-21T20:47:44Z,"@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails",@hulumi/policies,0,1.3.2,,HIGH,CWE-693,
 GHSA-59fh-9f3p-7m39,2026-05-20T15:44:40Z,"Flowise: Mass Assignment in PUT /api/v1/user Allows Authenticated Users to Override Password Hash and Bypass Password Change Verification",flowise,0,3.1.2,,MODERATE,CWE-915,
+GHSA-59h8-w5q6-mfmp,2026-10-02T22:39:57Z,"Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId",trigger.dev,0,4.5.5,,MODERATE,CWE-306,
 GHSA-59x8-7wx6-4hj9,2020-09-03T17:47:52Z,"Malicious Package in secure_identity_login_module","secure_identity_login_module",0.0.0,,,CRITICAL,CWE-506,
 GHSA-59xc-5v89-r7pr,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Synology Chat Webhook Pre-Auth Rate-Limit Bypass Enables Brute-Force Guessing of Webhook Token",openclaw,0,2026.3.28,,MODERATE,CWE-307,
 GHSA-59xv-588h-2vmm,2026-04-10T19:30:32Z,"@saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal Handler",@saltcorn/data,0,1.4.5,,LOW,CWE-89,
@@ -8469,6 +8683,7 @@ GHSA-65p7-pjj8-ggmr,2021-09-23T23:18:42Z,"Member account takeover",ghost,3.18.0,
 GHSA-65p7-pjj8-ggmr,2021-09-23T23:18:42Z,"Member account takeover",ghost,4.0.0,4.15.1,,MODERATE,,
 GHSA-65p8-3hm4-h9h8,2019-08-23T00:04:48Z,"Denial of Service in rgb2hex",rgb2hex,0,0.1.6,,MODERATE,CWE-400,
 GHSA-65xx-c85x-wg76,2020-09-04T17:20:52Z,"Command Injection in plotter",plotter,0.0.0,,,CRITICAL,CWE-77,
+GHSA-6623-4q32-82v8,2026-09-19T12:32:10Z,"Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS",hono,0,,,LOW,CWE-79,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,0,1.123.55,,MODERATE,CWE-863,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.0.0-rc.0,2.25.7,,MODERATE,CWE-863,
 GHSA-664h-gpgq-h6xx,2026-06-17T13:55:59Z,"n8n: Wrong OAuth Scope on Evaluation Test Runs Endpoints",n8n,2.26.0,2.26.2,,MODERATE,CWE-863,
@@ -8500,11 +8715,15 @@ GHSA-6f72-9gxx-98mj,2026-05-06T21:31:42Z,"Duplicate Advisory: OpenClaw: OpenShel
 GHSA-6f93-xj8r-jp82,2020-09-03T22:28:21Z,"Malicious Package in bunfer-xor",bunfer-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-6fcr-9h9g-23fq,2020-09-02T21:50:51Z,"Denial of Service in ipfs-bitswap",ipfs-bitswap,0,0.24.1,,MODERATE,CWE-400,
 GHSA-6fh5-8wq8-w3wr,2020-09-04T15:09:55Z,"Prototype Pollution in unflatten",unflatten,0.0.0,,,HIGH,CWE-1321,
+GHSA-6fvh-fgmg-3x7v,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package",vm2,0,,3.11.6,CRITICAL,CWE-706,
 GHSA-6g25-pc82-vfwp,2026-03-03T00:39:40Z,"OpenClaw: macOS beta onboarding exposed PKCE verifier via OAuth state",openclaw,0,2026.2.25,,MODERATE,CWE-200,
+GHSA-6h2x-m376-mqjq,2026-09-29T18:07:42Z,"joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`",joi,17.2.0,17.13.7,,HIGH,CWE-1333,
+GHSA-6h2x-m376-mqjq,2026-09-29T18:07:42Z,"joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`",joi,18.0.0,18.2.6,,HIGH,CWE-1333,
 GHSA-6hqm-hm2v-3p2p,2026-08-01T15:30:27Z,"Duplicate Advisory: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios",axios,1.0.0,,,MODERATE,CWE-183,
 GHSA-6hxq-p678-4hr2,2026-09-04T17:33:20Z,"SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor",@simplewebauthn/server,0,13.3.2,,LOW,CWE-295;CWE-296,
 GHSA-6jg8-7333-554w,2019-10-04T17:56:12Z,"Sandbox Breakout in realms-shim",realms-shim,0,1.2.0,,CRITICAL,,
 GHSA-6jg8-7333-554w,2019-10-04T17:56:12Z,"Sandbox Breakout in realms-shim",ses,0,0.6.3,,CRITICAL,,
+GHSA-6jgm-4w45-vh8j,2026-09-17T15:32:14Z,"Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine",vm2,3.11.3,,3.11.6,CRITICAL,CWE-114,
 GHSA-6jm4-83g2-35gv,2026-06-16T21:31:57Z,"Duplicate Advisory: memory-wiki shared search could miss session visibility checks",openclaw,0,,,MODERATE,CWE-862,
 GHSA-6jrj-vc65-c983,2024-08-26T15:17:40Z,"unzip-stream allows Arbitrary File Write via artifact extraction",unzip-stream,0,0.3.2,,HIGH,CWE-22,
 GHSA-6m6m-j2hm-pxrg,2020-09-03T17:37:05Z,"Malicious Package in cicada-render",cicada-render,0.0.0,,,CRITICAL,CWE-506,
@@ -8521,6 +8740,7 @@ GHSA-6qqj-rx4w-r3cj,2020-08-31T22:48:44Z,"CSRF Vulnerability in jquery-ujs",jque
 GHSA-6r5x-hmgg-7h53,2019-07-15T19:46:01Z,"Remote code execution in Handlebars.js",handlebars,0,4.1.0,,MODERATE,,
 GHSA-6rmx-gvvg-vh6j,2026-03-09T19:52:47Z,"OpenClaw's hooks count non-POST requests toward auth lockout",openclaw,0,2026.3.7,,MODERATE,CWE-307;CWE-799,
 GHSA-6v7q-wjvx-w8wg,2026-04-10T20:18:23Z,"basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands",basic-ftp,0,5.2.2,,HIGH,CWE-93,
+GHSA-6vj9-mwq6-2f5v,2026-09-28T21:56:05Z,"Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosure",nodemailer,5.0.0,10.0.2,,MODERATE,CWE-295,
 GHSA-6x2m-hqfw-hvpj,2026-03-02T22:29:45Z,"OpenClaw: Node exec approvals could be replayed across nodes",openclaw,0,2026.2.23,,MODERATE,CWE-285;CWE-863,
 GHSA-6x2m-p4xp-wg22,2026-06-19T21:42:36Z,"Network-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups",network-ai,0,5.12.2,,MODERATE,CWE-22;CWE-59,
 GHSA-6x33-pw7p-hmpq,2020-09-04T17:59:49Z,"Denial of Service in http-proxy",http-proxy,0,1.18.1,,HIGH,CWE-184;CWE-693,
@@ -8561,6 +8781,7 @@ GHSA-78p3-fwcq-62c2,2024-10-03T19:50:59Z,"@saltcorn/server Remote Code Execution
 GHSA-796m-2973-wc5q,2026-03-03T22:23:45Z,"OpenClaw has exec allowlist/safeBins policy-runtime mismatch via env -S wrapper interpretation",openclaw,0,2026.2.23,,MODERATE,CWE-436,
 GHSA-798h-g4j5-5537,2023-01-11T15:30:28Z,"Duplicate Advisory: PapaParse Inefficient Regular Expression Complexity vulnerability",papaparse,0,5.2.0,,HIGH,CWE-1333,
 GHSA-799q-f2px-wx8c,2025-03-28T21:30:46Z,"Duplicate Advisory: @alizeait/unflatto Prototype Pollution via `exports.unflatto` Method",@alizeait/unflatto,0,,1.0.2,HIGH,CWE-1321,
+GHSA-7c3p-84r8-h79q,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes",vm2,0,,3.11.6,HIGH,CWE-269,
 GHSA-7cg8-pq9v-x98q,2019-10-21T21:58:55Z,"Sandbox Breakout in realms-shim",realms-shim,0,1.2.1,,CRITICAL,,
 GHSA-7cgc-fjv4-52x6,2023-05-24T16:43:58Z,"Malware in pre-build binaries of bignum",bignum,0.12.2,0.13.1,,CRITICAL,CWE-506,
 GHSA-7cp4-jw97-3rc2,2025-05-01T03:31:17Z,"Duplicate Advisory: @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint","@cloudflare/workers-oauth-provider",0,0.0.5,,MODERATE,CWE-601,
@@ -8610,6 +8831,7 @@ GHSA-7xf9-74cp-8hx3,2020-09-03T22:59:21Z,"Malicious Package in js-cha3",js-cha3,
 GHSA-7xfq-xh6v-4mrm,2020-09-01T20:27:53Z,"Malicious Package in json-serializer",json-serializer,2.0.10,2.0.11,,CRITICAL,CWE-506,
 GHSA-7xmq-g46g-f8pv,2026-03-02T21:55:47Z,"OpenClaw: Sandbox media TOCTOU could read files outside sandbox root",openclaw,0,2026.3.1,,HIGH,CWE-367;CWE-59,
 GHSA-7xp7-m392-h92c,2026-05-05T21:15:32Z,"@evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoS",@evomap/evolver,0,1.70.0-beta.5,,MODERATE,CWE-400,
+GHSA-8238-w5pm-2374,2026-09-29T23:10:09Z,"adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)",adm-zip,0,0.6.1,,HIGH,CWE-248;CWE-400,
 GHSA-82gw-wqw6-r2cf,2026-03-19T03:30:57Z,"Duplicate Advisory: Command Injection via unescaped environment assignments in Windows Scheduled Task script generation",openclaw,0,,2026.2.17,MODERATE,CWE-78,
 GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",derby,0,2.3.2,,LOW,CWE-1321,
 GHSA-82jv-9wjw-pqh6,2024-04-17T22:26:37Z,"Prototype pollution in emit function",derby,3.0.0,3.0.2,,LOW,CWE-1321,
@@ -8695,6 +8917,7 @@ GHSA-8mm3-2mcj-cx6r,2020-09-11T21:09:24Z,"Malicious Package in angluar-cli",angl
 GHSA-8mmf-qp7j-2w24,2020-09-02T21:35:33Z,"Malicious Package in colour-string",colour-string,0,,,CRITICAL,CWE-506,
 GHSA-8mpm-q7mh-8fvh,2026-03-18T16:09:42Z,"Capgo CLI: symlink-following local secret writes enable arbitrary file overwrite + world-readable credentials (0600 missing)",@capgo/cli,0,7.84.6,,HIGH,CWE-276;CWE-377;CWE-59,
 GHSA-8mr2-f9wf-hcfq,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw reuses the gateway auth token in the owner ID prompt hashing fallback",openclaw,0,2026.2.22,,LOW,CWE-522,
+GHSA-8mvv-mcc3-xwhh,2026-09-17T15:32:15Z,"Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted",vm2,0,,3.11.6,LOW,CWE-22,
 GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",@sequelize/core,0,7.0.0-alpha.20,,CRITICAL,CWE-790,
 GHSA-8mwq-mj73-qv68,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements",sequelize,0,6.29.0,,CRITICAL,CWE-790,
 GHSA-8pf2-vj79-4wxg,2026-04-28T00:31:41Z,"Duplicate Advisory: OpenClaw: MSTeams thread history bypasses sender allowlist via Graph API",openclaw,0,2026.3.31,,MODERATE,CWE-441,
@@ -8712,6 +8935,7 @@ GHSA-8rgj-285w-qcq4,2025-02-10T17:59:09Z,"Unknown vulnerability in Coinbase Wall
 GHSA-8v5f-hp78-jgxq,2019-06-06T15:30:33Z,"Signature Verification Bypass in jwt-simple",jwt-simple,0,0.5.3,,HIGH,CWE-347,
 GHSA-8vj3-jgcf-77jv,2020-09-02T20:26:49Z,"Malicious Package in requeest",requeest,0,,,CRITICAL,CWE-506,
 GHSA-8vvx-qvq9-5948,2025-03-14T18:48:44Z,"Flowise allows arbitrary file write to RCE",flowise,0,,2.2.7,CRITICAL,CWE-94,
+GHSA-8vvx-rff5-p5rq,2026-09-29T18:23:50Z,"Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoS",nodemailer,0,10.0.2,,MODERATE,CWE-674,
 GHSA-8w57-jfpm-945m,2019-06-11T16:16:07Z,"Denial of Service in http-proxy-agent",http-proxy-agent,0,2.1.0,,HIGH,CWE-400,
 GHSA-8w9j-6wg6-qv4f,2020-09-03T19:41:17Z,"Malicious Package in axioss",axioss,0.0.0,,,CRITICAL,CWE-506,
 GHSA-8wc6-vgrq-x6cf,2026-02-13T20:53:58Z,"Child processes spawned by Renovate incorrectly have full access to environment variables",renovate,42.68.1,42.96.3,,MODERATE,CWE-269,
@@ -8737,6 +8961,8 @@ GHSA-92jp-89mq-4374,2026-04-17T20:08:01Z,"OpenClaw: Sandbox noVNC helper route e
 GHSA-93rg-2xm5-2p9v,2026-05-04T21:14:17Z,"OpenClaw's Gateway Control UI bootstrap config required Gateway auth",openclaw,0,2026.4.22,,MODERATE,CWE-287,
 GHSA-943q-mwmv-hhvh,2026-03-02T23:32:22Z,"OpenClaw: Gateway /tools/invoke tool escalation + ACP permission auto-approval",openclaw,0,2026.2.14,,HIGH,CWE-78,
 GHSA-95cg-3r4g-7w6j,2020-09-03T23:01:29Z,"Malicious Package in js-rha3",js-rha3,0.0.0,,,CRITICAL,CWE-506,
+GHSA-96h4-vgxj-gvm2,2026-09-30T14:44:21Z,"Nest: Unbounded memory growth in the NestJS TCP microservice transport",@nestjs/microservices,0,11.2.5,,MODERATE,CWE-770,
+GHSA-96h4-vgxj-gvm2,2026-09-30T14:44:21Z,"Nest: Unbounded memory growth in the NestJS TCP microservice transport",@nestjs/microservices,12.0.0,12.0.3,,MODERATE,CWE-770,
 GHSA-96qw-h329-v5rg,2026-01-08T21:13:37Z,"Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles",shakapacker,0,9.5.0,,HIGH,CWE-200,
 GHSA-97mg-3cr6-3x4c,2020-09-04T17:27:23Z,"Remote Code Execution in mongodb-query-parser",mongodb-query-parser,0,2.0.0,,CRITICAL,,
 GHSA-97mp-9g5c-6c93,2020-09-04T16:50:48Z,"Malicious Package in bs58chcek",bs58chcek,0.0.0,,,CRITICAL,CWE-506,
@@ -8750,12 +8976,16 @@ GHSA-992f-wf4w-x36v,2020-09-01T21:16:13Z,"Prototype Pollution in merge-objects",
 GHSA-9959-c6q6-6qp3,2017-10-24T18:33:36Z,"Moderate severity vulnerability that affects validator",validator,0,2.0.0,,MODERATE,,
 GHSA-99pg-hqvx-r4gf,2025-09-15T20:00:39Z,"Flowise has an Arbitrary File Read",flowise,3.0.5,3.0.6,,CRITICAL,CWE-22,
 GHSA-9c3v-684m-579c,2026-07-01T22:09:28Z,"OpenClaw MCP SSE redirects could forward Authorization headers",openclaw,0,2026.6.5,,MODERATE,CWE-200;CWE-522;CWE-601,
+GHSA-9c5c-9qcx-q35q,2026-09-30T14:41:39Z,"@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets",@nestjs/platform-fastify,0,11.2.4,,HIGH,CWE-288;CWE-436,
+GHSA-9c5c-9qcx-q35q,2026-09-30T14:41:39Z,"@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets",@nestjs/platform-fastify,12.0.0,12.0.2,,HIGH,CWE-288;CWE-436,
 GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,0,1.123.67,,MODERATE,CWE-20,
 GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-20,
 GHSA-9cmh-xcqm-5hqr,2026-07-22T23:18:39Z,"n8n: Cross-Tenant Module-Cache Poisoning in the JS Task Runner",n8n,2.32.0,2.32.1,,MODERATE,CWE-20,
 GHSA-9cph-cqqh-36pw,2020-09-04T15:29:25Z,"Malicious Package in babel-loqder",babel-loqder,0.0.0,,,CRITICAL,CWE-506,
+GHSA-9f3g-34x8-92jc,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor",vm2,3.9.6,,3.11.6,MODERATE,CWE-471,
 GHSA-9f72-qcpw-2hxc,2026-03-03T19:08:08Z,"OpenClaw: Native prompt image auto-load did not honor tools.fs.workspaceOnly in sandboxed runs",openclaw,0,2026.2.24,,HIGH,CWE-200;CWE-284,
 GHSA-9f79-7pw8-3fj8,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw: workspace path guard bypass on non-existent out-of-root symlink leaf",openclaw,0,,2026.2.25,HIGH,CWE-22,
+GHSA-9fxx-mv6c-j5xp,2026-09-17T15:32:14Z,"Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE",vm2,3.11.4,,3.11.6,CRITICAL,CWE-913,
 GHSA-9ggv-8w38-r7pm,2026-06-19T19:18:49Z,"TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)",typeorm,0.1.12,0.3.29,,MODERATE,CWE-89,
 GHSA-9gvx-vj57-vqqx,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Gateway Canvas local-direct requests bypass Canvas HTTP and WebSocket authentication",openclaw,0,2026.3.23,,MODERATE,CWE-288,
 GHSA-9gxr-rhx6-4jgv,2020-09-04T15:18:57Z,"Sandbox Breakout / Prototype Pollution in notevil",notevil,0,1.3.3,,MODERATE,CWE-1321,
@@ -8764,8 +8994,6 @@ GHSA-9h6g-pr28-7cqp,2024-01-31T22:42:54Z,"nodemailer ReDoS when trying to send a
 GHSA-9hc2-hjx8-q6pv,2026-07-14T19:52:41Z,"TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Module Auto-Execution",tidgi,0,,0.13.0,CRITICAL,CWE-94,
 GHSA-9hc2-w9gg-q6jw,2020-09-01T21:07:41Z,"Malicious Package in boogeyman",boogeyman,0.0.0,,,CRITICAL,CWE-506,
 GHSA-9hqj-38j2-5jgm,2020-09-01T21:19:23Z,"Command Injection in ascii-art",ascii-art,0,1.4.4,,LOW,CWE-77,
-GHSA-9hrv-gvrv-6gf2,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise,0,3.1.0,,MODERATE,CWE-918,
-GHSA-9hrv-gvrv-6gf2,2026-04-16T21:23:17Z,"Flowise Execute Flow function has an SSRF vulnerability",flowise-components,0,3.1.0,,MODERATE,CWE-918,
 GHSA-9j32-3m66-mc4m,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw: Hook mapping templates could bypass hook session-key opt-in",openclaw,0,2026.4.20,,MODERATE,CWE-863,
 GHSA-9m65-766c-r333,2026-05-14T16:37:10Z,"TanStack Start - Server Core: Inbound server-function request deserialization could invoke a sibling client-referenced server function","@tanstack/start-server-core",0,1.167.30,,MODERATE,CWE-502;CWE-843,
 GHSA-9mjp-gv34-3jcf,2020-09-02T18:37:35Z,"Malicious Package in aasync",aasync,0,,,CRITICAL,CWE-506,
@@ -8778,6 +9006,7 @@ GHSA-9ppg-jx86-fqw7,2026-02-19T15:17:10Z,"Unauthorized npm publish of cline@2.3.
 GHSA-9pr3-7449-977r,2020-09-02T18:21:26Z,"Cross-Site Scripting in express-cart",express-cart,0,,,LOW,CWE-79,
 GHSA-9px9-f7jw-fwhj,2020-09-03T15:49:37Z,"Command Injection in priest-runner",priest-runner,0.0.0,,,CRITICAL,CWE-77,
 GHSA-9q2p-vc84-2rwm,2026-03-09T19:54:46Z,"OpenClaw: system.run allow-always persistence included shell-commented payload tails",openclaw,0,2026.3.7,,MODERATE,CWE-436;CWE-863,
+GHSA-9q4r-4842-93vw,2026-10-02T22:42:20Z,"Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name",trigger.dev,0,4.5.6,,HIGH,CWE-639;CWE-89,
 GHSA-9q64-mpxx-87fg,2020-04-01T16:35:08Z,"Open Redirect in ecstatic",ecstatic,0,2.2.2,,HIGH,CWE-601,
 GHSA-9q64-mpxx-87fg,2020-04-01T16:35:08Z,"Open Redirect in ecstatic",ecstatic,3.0.0,3.3.2,,HIGH,CWE-601,
 GHSA-9q64-mpxx-87fg,2020-04-01T16:35:08Z,"Open Redirect in ecstatic",ecstatic,4.0.0,4.1.2,,HIGH,CWE-601,
@@ -8822,7 +9051,6 @@ GHSA-c27r-x354-4m68,2020-10-27T20:39:46Z,"xml-crypto's HMAC-SHA1 signatures can
 GHSA-c29c-2q9c-pc86,2026-07-02T16:43:38Z,"OpenClaw: Slack allowFrom could bind to mutable display names",openclaw,0,2026.5.3,,HIGH,CWE-290,
 GHSA-c2fv-2fmj-9xrx,2025-07-28T06:30:23Z,"Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability",ssrfcheck,0,1.2.0,,HIGH,CWE-918,
 GHSA-c2g6-57fp-22wp,2020-09-03T22:48:35Z,"Malicious Package in fuffer-xor",fuffer-xor,0.0.0,,,CRITICAL,CWE-506,
-GHSA-c2j3-45gr-mqc4,2026-07-21T19:41:07Z,"DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",dompurify,0,3.4.12,,LOW,CWE-184;CWE-693;CWE-79,
 GHSA-c35v-qwqg-87jc,2019-06-06T15:32:32Z,"express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison",express-basic-auth,0,1.1.7,,LOW,CWE-208,
 GHSA-c3hq-7mxh-mqxf,2020-09-04T14:59:50Z,"Sandbox Breakout / Arbitrary Code Execution in lighter-vm",lighter-vm,0.0.0,,,CRITICAL,,
 GHSA-c3m8-x3cg-qm2c,2020-09-03T20:39:53Z,"Configuration Override in helmet-csp",helmet-csp,1.2.2,2.9.1,,MODERATE,,
@@ -8835,6 +9063,7 @@ GHSA-c53x-wwx2-pg96,2020-09-03T17:03:58Z,"Cross-Site Scripting in @berslucas/lil
 GHSA-c5j4-vw9m-xc95,2020-08-27T22:44:08Z,"Open Redirect in hekto",hekto,0,0.2.4,,LOW,,
 GHSA-c5xm-m64m-f2vq,2020-09-04T15:23:47Z,"Malicious Package in cxct",cxct,0.0.0,,,CRITICAL,CWE-506,
 GHSA-c6f3-3c98-2j2f,2020-09-02T21:39:46Z,"Malicious Package in jquerz",jquerz,0,,,CRITICAL,CWE-506,
+GHSA-c6fg-446q-cg94,2026-09-29T23:10:32Z,"adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path",adm-zip,0,0.6.1,,MODERATE,CWE-400;CWE-770,
 GHSA-c6h2-mpc6-232h,2020-08-27T22:26:15Z,"Command Injection in dns-sync",dns-sync,0,0.1.3,,MODERATE,,
 GHSA-c6m7-q6pr-c64r,2025-12-12T16:41:58Z,"Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components",@vitejs/plugin-rsc,0,0.5.7,,MODERATE,CWE-1395;CWE-497;CWE-502,
 GHSA-c7hr-448w-65px,2026-08-18T20:09:35Z,"MeshCentral has unsanitized data fields",meshcentral,0,1.1.60,,HIGH,CWE-20;CWE-74,
@@ -8894,6 +9123,7 @@ GHSA-crvj-3gj9-gm2p,2018-10-09T00:44:29Z,"High severity vulnerability that affec
 GHSA-cv3v-7846-6pxm,2020-09-03T21:15:19Z,"Unauthorized File Access in node-git-server",node-git-server,0.2.0,0.6.1,,HIGH,CWE-552,
 GHSA-cvfm-xjc8-f2vm,2020-09-03T15:46:36Z,"Denial of Service in @commercial/subtext",@commercial/subtext,5.1.1,5.1.2,,HIGH,,
 GHSA-cw28-63x4-37c3,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Voice-call Plivo replay mutates in-process callback origin before replay rejection",openclaw,0,2026.3.31,,MODERATE,CWE-367,
+GHSA-cw3j-28qq-x3xh,2026-07-01T00:34:02Z,"Duplicate Advisory: Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,,,MODERATE,CWE-113,
 GHSA-cwj3-vqpp-pmxr,2026-05-05T18:44:31Z,"OpenClaw's gateway config mutation guard allowed unsafe model-driven config writes",openclaw,0,2026.4.23,,HIGH,CWE-862,
 GHSA-cx7r-634m-2q2h,2020-09-02T18:20:21Z,"Cross-Site Scripting in harp",harp,0,,,MODERATE,,
 GHSA-cxcw-jm67-3wwp,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw's andbox browser noVNC observer lacked VNC authentication",openclaw,0,,,HIGH,CWE-306,
@@ -8938,8 +9168,10 @@ GHSA-ff6g-gm92-rf32,2020-09-03T19:42:06Z,"Malicious Package in coinstirng",coins
 GHSA-ff98-w8hj-qrxf,2026-03-03T21:39:26Z,"OpenClaw plugin runtime command execution is part of trusted plugin boundary",openclaw,0,2026.2.19,,MODERATE,CWE-78,
 GHSA-ffhm-8fwq-7q27,2026-06-13T00:34:32Z,"Duplicate Advisory: OpenClaw: PowerShell encoded-command aliases could miss exec allowlist checks",openclaw,0,2026.5.12,,HIGH,CWE-184,
 GHSA-ffr4-mrhv-vfr2,2026-03-21T03:31:14Z,"Duplicate Advisory: OpenClaw has browser trace/download path symlink escape in temp output handling",openclaw,0,,,MODERATE,CWE-59,
+GHSA-fg72-q65g-wm5w,2026-09-06T12:30:23Z,"Duplicate Advisory: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,,,HIGH,CWE-400,
 GHSA-fgp6-8g62-qx6w,2020-09-03T17:01:45Z,"Malicious Package in smartsearchwp",smartsearchwp,0,,,CRITICAL,CWE-506,
 GHSA-fhp4-pr5j-46m5,2026-06-26T20:55:18Z,"Muhammara has a NULL pointer dereference in LZWDecode filter when DecodeParms omits EarlyChange key",muhammara,0,6.0.5,,HIGH,CWE-476,
+GHSA-fj2x-mqqp-3v2w,2026-10-02T22:45:12Z,"Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values",trigger.dev,0,4.5.9,,MODERATE,CWE-532,
 GHSA-fj93-7wm4-8x2g,2020-09-02T21:22:47Z,"Cross-Site Scripting in jquery-mobile",jquery-mobile,0,,,HIGH,CWE-79,
 GHSA-fjh6-8679-9pch,2025-11-14T20:57:31Z,"Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change",flowise-ui,0,3.0.10,,HIGH,CWE-306;CWE-620,
 GHSA-fjm8-mgc9-mf65,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability",openclaw,0,2026.3.31,,MODERATE,CWE-497,
@@ -8991,6 +9223,7 @@ GHSA-g43v-9x7q-83pq,2026-05-21T20:43:58Z,"@hulumi/policies: HULUMI-H1 SecureBuck
 GHSA-g485-8j3v-p6x8,2026-05-05T18:28:32Z,"@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin","@tdurieux/anonymous_github",2.2.0,2.3.0,,HIGH,CWE-79;CWE-80,
 GHSA-g49q-jw42-6x85,2024-05-09T21:31:35Z,"thelounge may publicly disclose of all usernames/idents via port 113",thelounge,0,,4.4.3,LOW,,
 GHSA-g4m3-rpxr-h7vg,2020-09-03T19:52:25Z,"Malicious Package in mogodb-core",mogodb-core,0.0.0,,,CRITICAL,CWE-506,
+GHSA-g57g-f23g-4646,2026-09-29T23:44:04Z,"Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing",nodemailer,9.1.0,10.0.9,,MODERATE,CWE-20;CWE-436,
 GHSA-g5q2-fcg9-j526,2020-09-03T17:40:18Z,"Malicious Package in hsf-clients",hsf-clients,0.0.0,,,CRITICAL,CWE-506,
 GHSA-g64q-3vg8-8f93,2020-09-03T15:47:10Z,"Prototype Pollution in pez",pez,0.0.0,,,HIGH,CWE-1321,
 GHSA-g6f4-j6c2-w3p3,2018-10-09T00:39:43Z,"High severity vulnerability that affects uglify-js",uglify-js,0,2.4.24,,HIGH,,
@@ -9031,6 +9264,7 @@ GHSA-gfjr-xqhm-qvv3,2020-09-02T20:16:09Z,"Malicious Package in aysnc",aysnc,0,,,
 GHSA-gfm8-g3vm-53jh,2020-09-03T17:21:19Z,"Malicious Package in leetlog",leetlog,0.1.2,,,CRITICAL,CWE-506,
 GHSA-gfmx-pph7-g46x,2026-04-09T14:22:14Z,"OpenClaw: Lower-trust background runtime output is injected into trusted `System:` events, and local async exec completion misses the intended `exec-event` downgrade",openclaw,0,2026.4.8,,HIGH,CWE-501,
 GHSA-gfp8-mp24-5vxg,2026-05-21T20:43:27Z,"@hulumi/baseline: CloudTrail selector tampering events were not fully detected",@hulumi/baseline,0,1.3.2,,MODERATE,CWE-778,
+GHSA-gg6r-gp4c-89hp,2026-10-02T22:39:00Z,"Trigger.dev: V1 coordinator default-secret unauth Socket.IO",trigger.dev,0,4.5.4,,CRITICAL,CWE-200;CWE-798;CWE-862,
 GHSA-ggm6-h3mx-cmmp,2026-03-19T03:30:57Z,"Duplicate Advisory: safeBins stdin-only bypass via sort output and recursive grep flags",openclaw,0,,2026.2.17,LOW,CWE-78,
 GHSA-ghvf-qf6h-g8x5,2026-08-20T18:42:21Z,"NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution",@nocobase/server,0,2.1.5,,HIGH,"CWE-209;CWE-434;CWE-73;CWE-829",
 GHSA-gj2h-2fpw-fhv9,2026-07-02T20:16:12Z,"@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration",@nuxt/ui,0,4.8.1,,MODERATE,CWE-200;CWE-598,
@@ -9112,6 +9346,7 @@ GHSA-h9h6-pwqv-j9hv,2026-06-16T21:32:00Z,"Duplicate Advisory: Bootstrap token re
 GHSA-h9wq-xcqx-mqxm,2023-07-11T22:46:19Z,"Vendure Cross Site Request Forgery vulnerability impacting all API requests",@vendure/core,0,2.0.3,,LOW,,
 GHSA-h9wr-xr4r-66fh,2020-09-03T18:20:20Z,"Cross-Site Scripting in dmn-js-properties-panel",dmn-js-properties-panel,0,0.3.0,,HIGH,CWE-79,
 GHSA-hc4w-hm59-9w88,2026-06-16T21:31:59Z,"Duplicate Advisory: Empty-scope device re-pairing could confuse caller scope containment",openclaw,0,,2026.4.24,LOW,CWE-636,
+GHSA-hc6q-4vvg-jf79,2026-09-17T15:32:16Z,"Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts",vm2,0,,3.11.6,CRITICAL,CWE-453,
 GHSA-hcm3-8f6r-6xwg,2026-07-02T16:54:44Z,"OpenClaw: Browser debug/export routes could reuse already-open blocked tabs",openclaw,0,2026.4.29,,MODERATE,CWE-862,
 GHSA-hfpr-jhpq-x4rm,2026-03-09T19:54:41Z,"OpenClaw: `operator.write` chat.send could reach admin-only config writes",openclaw,0,2026.3.7,,MODERATE,CWE-863,
 GHSA-hfwx-c7q6-g54c,2021-03-12T23:04:46Z,"Vulnerability allowing for reading internal HTTP resources",highcharts-export-server,0,2.1.0,,HIGH,CWE-552,
@@ -9130,6 +9365,7 @@ GHSA-hj5w-xgw9-w4rj,2020-09-03T19:41:44Z,"Malicious Package in coinstrng",coinst
 GHSA-hjwh-xvfw-qrwj,2026-08-19T19:32:46Z,"SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses",mcp-searxng,0,1.12.0,,MODERATE,CWE-209;CWE-532,
 GHSA-hm63-vwj4-mj2q,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Remote media error responses could trigger unbounded memory allocation before failure",openclaw,0,2026.3.22,,MODERATE,CWE-789,
 GHSA-hmfr-rx46-4jx2,2025-08-26T18:42:37Z,"GraphQL Armor Max-Depth Plugin Bypass via Introspection Query Obfuscation","@escape.tech/graphql-armor-max-depth",0,2.4.2,,MODERATE,CWE-400,
+GHSA-hmpr-c9rf-qcrf,2026-09-17T15:32:16Z,"Duplicate Advisory: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks",vm2,3.11.4,,3.11.6,HIGH,CWE-669,
 GHSA-hpfq-8wx8-cgqw,2019-06-13T18:59:18Z,"Cross-Site Scripting in ids-enterprise",ids-enterprise,0,4.18.2,,HIGH,CWE-79,
 GHSA-hpr5-wp7c-hh5q,2020-09-01T19:37:29Z,"Cross-Site Scripting in mrk.js",mrk.js,0,2.0.1,,HIGH,CWE-79,
 GHSA-hq75-xg7r-rx6c,2025-07-11T17:09:53Z,"Better Call routing bug can lead to Cache Deception",better-call,0,1.0.12,,MODERATE,CWE-525,
@@ -9146,9 +9382,11 @@ GHSA-hvqh-jw65-wcpq,2026-06-22T23:00:50Z,"devbridge-autocomplete has XSS in its
 GHSA-hvxq-j2r4-4jm8,2020-09-03T20:31:04Z,"Regular Expression Denial of Service in sql-injection",sql-injection,0.0.0,,,HIGH,,
 GHSA-hw9r-h9mr-4jff,2026-07-02T16:06:00Z,"OpenClaw: Scoped chat.send route inheritance could bypass admin command scope gates",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
 GHSA-hwh3-fhf6-73x9,2020-09-04T15:36:09Z,"Malicious Package in bictoinjs-lib",bictoinjs-lib,0.0.0,,,CRITICAL,CWE-506,
+GHSA-hwr5-cm8v-c76q,2026-09-17T15:32:14Z,"Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector",vm2,3.10.2,,3.11.6,CRITICAL,CWE-693,
 GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,0,1.123.67,,MODERATE,CWE-1321,
 GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,2.0.0-rc.0,2.31.5,,MODERATE,CWE-1321,
 GHSA-hx4h-vr3m-45vh,2026-07-22T22:13:04Z,"n8n: Prototype Pollution via VM Expression Engine Sandbox Escape Leads to Denial of Service",n8n,2.32.0,2.32.1,,MODERATE,CWE-1321,
+GHSA-hx4r-w6wj-j8fg,2026-10-01T15:17:42Z,"devalue: Residual sparse-array CPU amplification in uneval",devalue,0,5.9.3,,MODERATE,CWE-400;CWE-407,
 GHSA-hx4v-668p-g2qr,2026-05-29T18:31:33Z,"Duplicate Advisory: OpenClaw: QQBot native approval buttons did not enforce configured approver identity",openclaw,0,2026.5.18,,HIGH,CWE-862,
 GHSA-hx5x-49mm-vmhw,2020-09-03T02:36:43Z,"SQL Injection in sails-mysql",sails-mysql,0,0.10.8,,HIGH,CWE-89,
 GHSA-hx78-272p-mqqh,2020-09-03T19:21:11Z,"Authorization Bypass in graphql-shield",graphql-shield,0,6.0.6,,LOW,CWE-285,
@@ -9235,6 +9473,7 @@ GHSA-jwm3-qcfw-c5pp,2026-06-16T22:39:46Z,"n8n: Python Code Node AST Validator By
 GHSA-jx3c-247h-cxwp,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Workspace `.env` can override the bundled hooks root and load attacker hook code",openclaw,0,2026.3.31,,HIGH,CWE-829,
 GHSA-jxf5-7x3j-8j9m,2020-09-03T18:19:14Z,"Malicious Package in load-from-cwd-or-npm",load-from-cwd-or-npm,3.0.2,3.0.4,,CRITICAL,CWE-506,
 GHSA-jxh8-jh77-xh6g,2026-05-05T21:15:55Z,"@evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scripts",@evomap/evolver,0,1.70.0-beta.5,,HIGH,CWE-78,
+GHSA-jxrp-r7gx-q4j8,2026-07-24T15:33:01Z,"Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.",dompurify,0,,3.4.11,MODERATE,CWE-79,
 GHSA-jxrq-8fm4-9p58,2026-03-03T23:09:31Z,"OpenClaw: Zip extraction symlink traversal could write outside destination",openclaw,0,2026.2.22,,HIGH,CWE-59,
 GHSA-m2fp-c79h-rr79,2020-09-02T21:42:56Z,"Malicious Package in tensorplow",tensorplow,0,,,CRITICAL,CWE-506,
 GHSA-m36m-x4c5-rjxj,2020-09-01T19:01:58Z,"Silently Runs Cryptocoin Miner in hooka-tools",hooka-tools,0.0.0,,,LOW,,
@@ -9259,6 +9498,7 @@ GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect A
 GHSA-m6w8-fq7v-ph4m,2022-01-13T16:09:36Z,"GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior",@openzeppelin/contracts,4.3.0,4.4.2,,MODERATE,,
 GHSA-m734-r4g6-34f9,2019-06-04T19:36:17Z,"NoSQL Injection in loopback-connector-mongodb","loopback-connector-mongodb",0,3.6.0,,HIGH,CWE-89,
 GHSA-m794-qv59-gj7c,2020-09-03T17:03:22Z,"Malicious Package in signqle",signqle,0.0.0,,,CRITICAL,CWE-506,
+GHSA-m7cq-7f2q-f9fh,2026-09-17T15:32:14Z,"Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`",vm2,3.11.3,,3.11.6,CRITICAL,CWE-693,
 GHSA-m7jc-p4hf-xhwq,2026-07-22T12:32:17Z,"Duplicate Advisory: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution",n8n,0,,,HIGH,CWE-917,
 GHSA-m7qm-r2r5-f77q,2020-09-01T20:43:48Z,"Cross-Site Scripting in react-marked-markdown",react-marked-markdown,0.0.0,,,HIGH,CWE-79,
 GHSA-m837-xvxr-vqwg,2026-05-20T15:38:02Z,"Flowise: Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage",flowise,0,3.1.2,,MODERATE,CWE-942,
@@ -9278,6 +9518,7 @@ GHSA-m9c9-mc2h-9wjw,2025-01-14T22:04:02Z,"Lodestar snappy checksum issue",@lodes
 GHSA-m9hw-7xfv-wqg7,2020-11-12T19:36:14Z,"Prototype Pollution in json-logic-js",json-logic-js,0,2.0.0,,HIGH,CWE-471,
 GHSA-m9r7-q9fc-qwx5,2020-09-03T17:22:24Z,"Malicious Package in maybemaliciouspackage",maybemaliciouspackage,0.0.0,,,CRITICAL,CWE-506,
 GHSA-mc84-xr9p-938r,2019-09-23T18:31:05Z,"High severity vulnerability that affects generator-jhipster",generator-jhipster,0,6.3.1,,HIGH,CWE-494;CWE-829,
+GHSA-mcm9-63f2-9j32,2026-10-01T15:17:29Z,"devalue: Repeated primitive strings cause quadratic expansion in uneval",devalue,0,5.9.3,,HIGH,CWE-400;CWE-409,
 GHSA-mf69-r24q-ghhr,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Pairing pending-request caps were enforced per channel instead of per account",openclaw,2026.2.26,2026.3.31,,MODERATE,CWE-799,
 GHSA-mf74-qq7w-6j7v,2024-02-03T00:38:22Z,"Zmarkdown Server-Side Request Forgery (SSRF) in remark-download-images",remark-images-download,0,3.1.0,,MODERATE,,
 GHSA-mfc2-93pr-jf92,2020-10-01T17:10:15Z,"Malicious code in `loadyaml`",loadyaml,0,,1.0.2,CRITICAL,CWE-506,
@@ -9330,6 +9571,7 @@ GHSA-mxq6-vrrr-ppmg,2022-05-24T17:04:00Z,"Duplicate Advisory: tree-kill vulnerab
 GHSA-p2fh-f5fc-44hr,2026-07-02T16:18:02Z,"OpenClaw: memory-wiki ingest could read local files with operator.write scope",openclaw,0,2026.5.12,,MODERATE,CWE-732,
 GHSA-p2fr-6hmx-4528,2026-07-07T20:54:32Z,"@better-auth/oauth-provider may provide access tokens for unauthorized audiences via unbound resource indicators","@better-auth/oauth-provider",1.4.8,1.7.0-beta.4,,MODERATE,CWE-285;CWE-863,
 GHSA-p33q-w45h-2hcj,2020-09-02T18:30:03Z,"Malicious Package in 4equest",4equest,0,,,CRITICAL,CWE-506,
+GHSA-p3f5-w63m-mxph,2026-08-24T15:31:51Z,"Duplicate Advisory: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",webpack-dev-middleware,0,,,HIGH,CWE-22,
 GHSA-p3h2-2j4p-p83g,2026-04-22T20:50:19Z,"MCPHub has Path Traversal via Malicious MCPB Manifest Name",@samanhappy/mcphub,0,0.12.13,,HIGH,CWE-22,
 GHSA-p3jx-g34v-q56j,2020-09-03T22:54:02Z,"Malicious Package in j3-sha3",j3-sha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p3m6-jr2h-hhxj,2026-05-11T18:31:46Z,"Duplicate Advisory: OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config",openclaw,0,2026.4.20,,MODERATE,CWE-829,
@@ -9341,6 +9583,7 @@ GHSA-p4mf-4qvh-w8g5,2020-09-04T15:41:42Z,"Malicious Package in bitcionjslib",bit
 GHSA-p56r-jr4p-4wgh,2020-08-03T18:16:37Z,Withdrawn,whereis,0,0.4.1,,HIGH,,
 GHSA-p5p2-rhc3-wmf3,2020-09-03T17:03:31Z,"Malicious Package in siganle",siganle,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p62r-jf56-h429,2020-09-03T20:29:58Z,"Malicious Package in evil-package",evil-package,0.0.0,,,CRITICAL,CWE-506,
+GHSA-p634-w6r4-rjp2,2026-09-29T23:11:01Z,"adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content",adm-zip,0,0.6.1,,MODERATE,CWE-436;CWE-696,
 GHSA-p68j-q8j9-jwf5,2026-06-13T00:34:32Z,"Duplicate Advisory: OpenClaw: Slack and Zalo webhook secrets could remain active after secrets.reload",openclaw,0,2026.4.22,,MODERATE,CWE-613,
 GHSA-p6j4-wvmc-vx2h,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Tlon cite expansion happens before channel and DM authorization is complete",openclaw,0,2026.3.22,,MODERATE,CWE-696,
 GHSA-p72p-rjr2-r439,2019-05-29T20:24:02Z,"Server-Side Request Forgery in terriajs-server",terriajs-server,0,2.7.4,,HIGH,CWE-918,
@@ -9353,6 +9596,7 @@ GHSA-p7qp-3fh7-pv4p,2020-09-03T22:24:04Z,"Malicious Package in buffur-xor",buffu
 GHSA-p7w7-4929-vpj5,2026-07-31T16:05:57Z,"`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation","@dynatrace-oss/dynatrace-mcp-server",0,2.0.0,,HIGH,CWE-306,
 GHSA-p8fm-w787-x6x3,2020-09-02T15:50:28Z,"Malicious Package in portionfatty12",portionfatty12,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p94w-42g3-f7h4,2020-03-06T01:16:00Z,"Holder can (re)create authentic credentials after receiving a credential in vp-toolkit",vp-toolkit,0,0.2.2,,HIGH,,
+GHSA-p98j-92pf-mc4p,2026-09-30T15:37:57Z,"DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS",dompurify,3.4.13,3.4.16,,LOW,CWE-79,
 GHSA-p9g3-vpvp-hcj5,2020-09-03T21:41:55Z,"Malicious Package in bufber-xor",bufber-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-p9vv-3945-x93h,2020-09-02T15:47:10Z,"Cross-Site Scripting in semantic-ui-search",semantic-ui-search,0,,,HIGH,CWE-79,
 GHSA-pc2w-4mq8-32qw,2026-07-29T15:36:19Z,"@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gate","@dynatrace-oss/dynatrace-mcp-server",0,1.8.7,,LOW,CWE-862,
@@ -9380,12 +9624,15 @@ GHSA-pm9v-325f-5g74,2020-09-02T21:30:11Z,"Malicious Package in saync",saync,0,,,
 GHSA-pmf3-2q63-jmp6,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw: Symlink Traversal via IDENTITY.md appendFile in agents.create/update (Incomplete Fix for CVE-2026-32013)",openclaw,0,,2026.2.22,MODERATE,CWE-61,
 GHSA-pmgv-94f5-6w7w,2020-09-02T20:21:30Z,"Malicious Package in eact",eact,0,,,CRITICAL,CWE-506,
 GHSA-pmpg-2mxq-6xwr,2026-07-24T21:43:34Z," Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete",@budibase/server,0,,3.38.1,HIGH,CWE-89,
+GHSA-pp95-gc86-jq6q,2026-10-02T22:35:24Z,"Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)",trigger.dev,0,4.5.2,,HIGH,CWE-862,
 GHSA-ppwq-6v66-5m6j,2026-03-26T21:15:59Z,"OpenClaw Exposes Credentials Embedded in baseUrl Fields via config.get and channels.status",openclaw,0,2026.3.22,,MODERATE,CWE-200;CWE-212;CWE-522,
 GHSA-pqh8-p93p-2rx7,2026-07-31T15:56:12Z,"@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL","@dynatrace-oss/dynatrace-mcp-server",0,2.1.1,,MODERATE,CWE-943,
 GHSA-pqhp-25j4-6hq9,2024-11-22T20:40:49Z,"smol-toml has a Denial of Service via malicious TOML document using deeply nested inline tables",smol-toml,0,1.3.1,,MODERATE,CWE-674,
 GHSA-pqhr-mp3f-hrpp,2026-03-31T23:26:29Z,"Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters",nuxt-og-image,0,6.2.5,,MODERATE,CWE-918,
 GHSA-pqpp-2363-649v,2020-09-02T18:22:30Z,"Cross-Site Scripting in buttle",buttle,0,,,MODERATE,CWE-79,
+GHSA-pqxw-g93w-hj9x,2026-10-02T22:39:48Z,"Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise",trigger.dev,0,4.5.6,,HIGH,CWE-1393;CWE-653,
 GHSA-pr66-whqj-rq5p,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct Message",openclaw,0,2026.3.31,,LOW,CWE-351,
+GHSA-prgh-xp8r-p3m5,2026-09-30T14:41:01Z,"Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)",nodemailer,9.1.0,10.0.5,,HIGH,CWE-400;CWE-407,
 GHSA-prmc-5v5w-c465,2021-04-06T17:32:38Z,"Client TLS credentials sent raw to server in npm package nats",nats,2.0.0-201,2.0.0-209,,CRITICAL,CWE-522,
 GHSA-pv6r-vchh-cxg9,2020-09-03T20:42:09Z,"Denial of Service in apostrophe",apostrophe,0,2.97.1,,LOW,CWE-400,
 GHSA-pvcr-8mvp-w8qr,2026-07-24T21:42:51Z," Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)",@budibase/server,0,,3.38.1,HIGH,CWE-285;CWE-345;CWE-352,
@@ -9411,12 +9658,11 @@ GHSA-q4gf-8mx6-v5v3,2026-04-10T15:35:47Z,"Next.js has a Denial of Service with S
 GHSA-q4h9-46xg-m3x9,2021-09-15T20:22:13Z,"UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable","@openzeppelin/contracts-upgradeable",4.1.0,4.3.2,,CRITICAL,,
 GHSA-q4pp-j36h-3gqg,2023-08-24T12:53:06Z,"Minimal `basti` IAM Policy Allows Shell Access",basti-cdk,0,1.0.1,,LOW,,
 GHSA-q4xx-mc3q-23x8,2025-08-14T12:30:22Z,"Duplicate Advisory: Flowise vulnerable to RCE via Dynamic function constructor injection",flowise,0,,3.0.5,CRITICAL,CWE-94,
+GHSA-q567-cr4x-96w4,2026-10-02T22:35:31Z,"Trigger.dev: Blind SSRF via alert-channel webhook",trigger.dev,0,4.5.2,,MODERATE,CWE-918,
 GHSA-q5pp-5q2h-g8rv,2024-01-03T18:30:51Z,"Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE",tinymce,0,,,MODERATE,CWE-79,
-GHSA-q5pr-72pq-83v3,2026-03-23T21:44:55Z,"H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service",h3,2.0.0-beta.4,2.0.1-rc.18,,MODERATE,CWE-400,
 GHSA-q643-w9jp-q2qg,2020-09-04T17:34:59Z,"Hardcoded Initialization Vector in parsel",parsel,0.0.0,,,HIGH,,
 GHSA-q67q-549q-p849,2025-09-15T20:11:39Z,"Flowise has arbitrary file access due to missing chat flow id validation",flowise,2.2.8,3.0.6,,CRITICAL,CWE-22,
 GHSA-q6mx-qvhp-fqmg,2026-07-15T12:32:03Z,"Duplicate Advisory: External Secrets Permission Bypass via Expression Parser Mismatch",n8n,0,,,MODERATE,CWE-639,
-GHSA-q7jf-gf43-6x6p,2025-10-24T19:15:13Z,"Hono vulnerable to Vary Header Injection leading to potential CORS Bypass",hono,0,4.10.3,,MODERATE,CWE-444,
 GHSA-q83v-hq3j-4pq3,2024-08-15T06:32:22Z,"Duplicate Advisory: Improper access control in Directus",directus,0,,10.13.0,MODERATE,CWE-639,
 GHSA-q849-wxrc-vqrp,2024-12-02T20:11:39Z,"hull.js Code Injection Vulnerability",hull.js,0.2.2,1.0.10,,CRITICAL,CWE-94,
 GHSA-q86m-697p-h7fh,2026-03-19T03:30:57Z,"Duplicate Advisory: OpenClaw: system.run approvals did not bind PATH-token executable identity, enabling post-approval executable rebind",openclaw,0,,,MODERATE,CWE-367,
@@ -9448,6 +9694,7 @@ GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via ma
 GHSA-qj3p-xc97-xw74,2025-09-15T13:55:56Z,"MetaMask SDK indirectly exposed via malicious debug@4.4.2 dependency",@metamask/sdk-react,0.16.0,0.33.1,,MODERATE,CWE-506,
 GHSA-qjfh-xc44-rm9x,2020-09-03T16:49:43Z,"Path Traversal in file-static-server",file-static-server,0.0.0,,,HIGH,CWE-22,
 GHSA-qjpc-qf9m-xwmr,2026-07-02T16:43:53Z,"OpenClaw: Trusted-proxy Control UI WebSocket accepted client-declared scopes before pairing",openclaw,0,2026.5.18,,HIGH,CWE-862;CWE-863,
+GHSA-qjrq-cvv4-3g9w,2026-09-08T00:30:22Z,"Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools",knowns,0,,,HIGH,CWE-22,
 GHSA-qm4q-f956-fg64,2020-09-03T17:39:13Z,"Malicious Package in luna-mock",luna-mock,0.0.0,,,CRITICAL,CWE-506,
 GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,2.0.0,2.25.3,,HIGH,CWE-79,
 GHSA-qm7x-rc44-rrqw,2021-11-08T18:07:42Z,"Cross-site Scripting Vulnerability in GraphQL Playground (distributed by Apollo Server)",apollo-server,3.0.0,3.4.1,,HIGH,CWE-79,
@@ -9480,6 +9727,7 @@ GHSA-qwmf-95r9-gx9x,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's gateway
 GHSA-qwww-vcr4-c8h2,2026-07-24T16:44:43Z,"React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response",react-router,7.12.0,7.18.2,,HIGH,CWE-352,
 GHSA-qwww-vcr4-c8h2,2026-07-24T16:44:43Z,"React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response",react-router,8.0.0,8.3.0,,HIGH,CWE-352,
 GHSA-qx4v-6gc5-f2vv,2019-06-20T14:32:56Z,"Regular Expression Denial of Service",esm,0,3.1.0,,MODERATE,CWE-400,
+GHSA-qxpp-qjg8-x4jv,2026-10-02T19:31:17Z,"Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)",trigger.dev,0,4.5.2,,HIGH,CWE-639,
 GHSA-qxrj-x7rm-2h49,2020-09-03T17:05:59Z,"Malicious Package in dhkey",dhkey,0.0.0,,,CRITICAL,CWE-506,
 GHSA-r27j-894h-3w3p,2026-05-06T17:32:01Z,"mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`",icu-minify,0,4.9.2,,LOW,CWE-1321,
 GHSA-r27j-fxmq-rg2q,2026-06-13T00:34:32Z,"Duplicate Advisory: OpenClaw: QQBot streaming command could mutate config without explicit allowFrom",openclaw,0,2026.4.29,,HIGH,CWE-290,
@@ -9491,6 +9739,7 @@ GHSA-r2rg-683g-ff96,2020-09-03T19:40:12Z,"Malicious Package in axios-http",axios
 GHSA-r2vw-jgq9-jqx2,2020-09-03T15:54:11Z,"Improper Authorization in @sap-cloud-sdk/core",@sap-cloud-sdk/core,1.19.0,1.21.2,,HIGH,CWE-285,
 GHSA-r32x-jhw5-g48p,2020-09-03T17:08:20Z,"Cross-Site Scripting in eco",eco,0.0.0,,,HIGH,CWE-79,
 GHSA-r3hf-q8q7-fv2p,2023-08-09T12:51:51Z,"Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory",@nguniversal/common,16.1.0,16.1.2,,HIGH,CWE-79,
+GHSA-r3ph-w7gj-g6xm,2026-09-29T17:57:39Z,"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",js-yaml,5.0.0,5.4.1,,MODERATE,CWE-400;CWE-407,
 GHSA-r3v5-2grc-429h,2026-04-10T00:30:30Z,"Duplicate Advisory: OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve",openclaw,0,2026.3.22,,HIGH,CWE-648,
 GHSA-r3vq-92c6-3mqf,2023-02-16T15:30:28Z,"Duplicate advisory: Sequelize - Unsafe fall-through in getWhereConditions",@sequelize/core,0,7.0.0-alpha.20,,HIGH,CWE-843,
 GHSA-r3xc-47qg-h929,2020-09-03T17:06:09Z,"Cross-Site Scripting in @ionic/core",@ionic/core,0,4.0.3,,HIGH,CWE-79,
@@ -9527,6 +9776,7 @@ GHSA-r863-p739-275c,2020-09-11T21:09:24Z,"Malicious Package in reuest",reuest,0,
 GHSA-r8hx-3qx6-hxq9,2020-09-03T19:41:14Z,"Malicious Package in commandre",commandre,0.0.0,,,CRITICAL,CWE-506,
 GHSA-r9cj-xj33-4q42,2020-09-03T22:21:54Z,"Malicious Package in buffgr-xor",buffgr-xor,0.0.0,,,CRITICAL,CWE-506,
 GHSA-r9q4-w3fm-wrm2,2020-09-02T21:21:43Z,"Cross-Site Scripting in google-closure-library",google-closure-library,0,20190301.0.0,,MODERATE,CWE-79,
+GHSA-r9w8-h9r3-54w4,2026-10-01T15:15:56Z,"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation",devalue,0,5.9.3,,HIGH,CWE-789;CWE-843,
 GHSA-rc4v-99cr-pjcm,2023-10-17T14:21:16Z,"Prototype Pollution in ali-security/mongoose","@seal-security/mongoose-fixed",5.3.3,5.3.4,,CRITICAL,CWE-1321,
 GHSA-rc8f-r29c-chr6,2026-04-10T00:30:29Z,"Duplicate Advisory: OpenClaw: BlueBubbles Webhook Missing Rate Limiting Enables Brute-Force Password Guessing",openclaw,0,,2026.3.24,MODERATE,CWE-307,
 GHSA-rch7-f4h5-x9rj,2019-08-23T00:04:52Z,"Identity Spoofing in libp2p-secio",libp2p-secio,0,0.9.0,,CRITICAL,CWE-290,
@@ -9535,6 +9785,7 @@ GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in t
 GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,2.0.0-rc.0,2.31.5,,HIGH,CWE-78,
 GHSA-rcv6-pvrj-4xcg,2026-07-22T22:08:01Z,"n8n: Authenticated code execution in the n8n Git node",n8n,2.32.0,2.32.1,,HIGH,CWE-78,
 GHSA-rcv7-4w2m-gj9v,2020-09-03T23:24:26Z,"Malicious Package in sj-tw-test-security",sj-tw-test-security,0.0.0,,,CRITICAL,CWE-506,
+GHSA-rcw4-f5rp-g42v,2026-09-29T18:25:20Z,"adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0",adm-zip,0,0.6.1,,HIGH,CWE-409,
 GHSA-rcx4-77x4-hjx5,2026-03-21T03:31:15Z,"Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata",openclaw,0,,2026.2.22-2,MODERATE,CWE-807,
 GHSA-rf75-g96h-j3rm,2026-04-02T21:32:52Z,"Duplicate Advisory: OpenClaw's complex interpreter pipelines could skip exec script preflight validation",openclaw,0,2026.4.2,,MODERATE,CWE-184,
 GHSA-rffp-mc78-wjf7,2020-09-02T18:26:48Z,"Command Injection in cocos-utils",cocos-utils,0,,,HIGH,CWE-77,
@@ -9580,6 +9831,7 @@ GHSA-v52w-28xh-v562,2026-06-19T20:47:19Z,"Kozou: Unauthenticated MCP HTTP server
 GHSA-v52w-28xh-v562,2026-06-19T20:47:19Z,"Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)",@kozou/core,0,1.8.1,,HIGH,"CWE-1188;CWE-272;CWE-346;CWE-770",
 GHSA-v52w-28xh-v562,2026-06-19T20:47:19Z,"Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)",@kozou/mcp,0,1.8.1,,HIGH,"CWE-1188;CWE-272;CWE-346;CWE-770",
 GHSA-v52w-28xh-v562,2026-06-19T20:47:19Z,"Kozou: Unauthenticated MCP HTTP server and bundled dev-stack hardening (DNS-rebinding, request-body limits, read-only reads, default network exposure)",kozou,0,1.8.1,,HIGH,"CWE-1188;CWE-272;CWE-346;CWE-770",
+GHSA-v53p-9fqp-m79j,2026-09-29T23:43:36Z,"Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service",nodemailer,0,10.0.6,,HIGH,CWE-1333;CWE-407,
 GHSA-v66p-w7qx-wv98,2020-09-04T17:29:34Z,"Authentication Bypass in express-laravel-passport",express-laravel-passport,0.0.0,,,CRITICAL,CWE-287,
 GHSA-v6cj-r88p-92rm,2019-09-30T19:31:59Z,"Buffer Overflow in centra",centra,0,2.4.0,,HIGH,CWE-119,
 GHSA-v6gv-fg46-h89j,2020-09-03T16:48:36Z,"Sensitive Data Exposure in put",put,0,,,LOW,CWE-200,
@@ -9591,13 +9843,13 @@ GHSA-v836-6xw4-9cx3,2026-08-17T17:32:57Z,"vm2 has Memory Exhaustion DoS via buff
 GHSA-v86x-f47q-f7f4,2020-09-11T21:09:24Z,"Unauthorized File Access in atompm",atompm,0,0.8.2,,HIGH,CWE-200,
 GHSA-v8g7-9qv2-j865,2020-09-04T16:38:55Z,"Malicious Package in bitcoin-osp",bitcoin-osp,0.0.0,,,CRITICAL,CWE-506,
 GHSA-v8j2-5f9p-fmh4,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload",openclaw,0,2026.4.23,,MODERATE,CWE-672,
-GHSA-v8w9-8mx6-g223,2026-03-11T00:31:47Z,"Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })",hono,0,4.12.7,,MODERATE,CWE-1321,
 GHSA-v95x-h953-x7fg,2020-09-03T19:47:55Z,"Malicious Package in k0a_multer",k0a_multer,0.0.0,,,CRITICAL,CWE-506,
 GHSA-v99v-xgjx-7m7g,2020-09-02T18:40:47Z,"Malicious Package in asnyc",asnyc,0,,,CRITICAL,CWE-506,
 GHSA-v9wp-8r97-v6xg,2020-09-03T17:17:00Z,"Cross-Site Scripting in jquery.json-viewer",jquery.json-viewer,0,1.3.0,,HIGH,CWE-79,
 GHSA-vc6r-4x6g-mmqc,2019-06-11T16:16:23Z,"Path Traversal in m-server",m-server,0,1.4.2,,MODERATE,CWE-22,
 GHSA-vcg5-9xw6-r56c,2020-09-02T21:40:49Z,"Malicious Package in logsymbles",logsymbles,0,,,CRITICAL,CWE-506,
 GHSA-vcv2-r9jh-99m5,2026-06-19T15:12:58Z,"Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync",agentic-flow,0,2.0.14,,HIGH,CWE-78,
+GHSA-vcvr-r3jv-pc5j,2026-09-30T14:48:30Z,"Next.js: Remote Code Execution in next/og ImageResponse",next,16.2.0,16.3.6,,CRITICAL,CWE-1395,
 GHSA-vf5m-q45w-8mh9,2020-09-03T23:00:25Z,"Malicious Package in js-qha3",js-qha3,0.0.0,,,CRITICAL,CWE-506,
 GHSA-vf8q-pw7h-r2x2,2020-09-11T21:15:54Z,"Malicious Package in epress",epress,0,,,CRITICAL,CWE-506,
 GHSA-vg44-fw64-cpjx,2020-03-24T15:08:59Z,"Incorrect Account Used for Signing","@metamask/eth-ledger-bridge-keyring",0,0.2.2,,HIGH,CWE-287,
@@ -9683,7 +9935,9 @@ GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-lambda,0,2.14.2,,MODERATE,,
 GHSA-w42g-7vfc-xf37,2020-06-05T19:38:14Z,"Introspection in schema validation in Apollo Server",apollo-server-micro,0,2.14.2,,MODERATE,,
 GHSA-w46p-w7w2-fr9g,2026-07-22T12:32:17Z,"Duplicate Advisory:  AI Agents Project Viewer Privilege Escalation via run_node_tool",n8n,0,,,HIGH,CWE-863,
+GHSA-w47m-jpv2-qfw5,2026-09-10T18:31:45Z,"Duplicate Advisory: Knowns Sandbox Escape: Unauthenticated Header Injection Grants AI Agent Unrestricted Access to Host Filesystem",knowns,0,,,CRITICAL,CWE-73,
 GHSA-w48f-fwg7-ww6p,2026-04-04T04:24:27Z,"@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding",@stablelib/cbor,0,2.0.3,,HIGH,CWE-1321,
+GHSA-w4hm-rrxg-pxcf,2026-06-23T15:32:36Z,"Duplicate Advisory: Flowise Execute Flow function has an SSRF vulnerability",flowise,0,3.1.0,,MODERATE,CWE-918,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/core,0,,0.1.142,HIGH,,
 GHSA-w4hv-vmv9-hgcr,2024-02-16T19:29:31Z,"GitHub Security Lab (GHSL) Vulnerability Report, scrypted: `GHSL-2023-218`, `GHSL-2023-219`",@scrypted/server,0,,0.56.0,HIGH,,
 GHSA-w4v6-g3wm-w36c,2026-07-02T16:48:45Z,"OpenClaw: QQBot admin commands could skip DM-only and allowFrom policy",openclaw,0,2026.4.29,,CRITICAL,CWE-863,
@@ -9702,6 +9956,7 @@ GHSA-w6v6-49gh-mc9w,2026-04-16T21:22:49Z,"Flowise: Path Traversal in Vector Stor
 GHSA-w6v6-49gh-mc9w,2026-04-16T21:22:49Z,"Flowise: Path Traversal in Vector Store basePath",flowise-components,0,3.1.0,,MODERATE,CWE-22,
 GHSA-w6wx-jq6j-6mcj,2026-04-07T18:15:52Z,"OpenClaw: pnpm dlx approvals did not bind local script operands",openclaw,0,2026.4.2,,MODERATE,CWE-863,
 GHSA-w725-67p7-xv22,2020-09-03T17:05:04Z,"Command Injection in local-devices",local-devices,0,3.0.0,,HIGH,CWE-77,
+GHSA-w72q-x6w3-7rj3,2026-08-04T18:31:26Z,"Duplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions",@a2ui/web_core,0.9.0,,,MODERATE,CWE-79,
 GHSA-w7j5-j98m-w679,2026-03-03T22:25:13Z,"OpenClaw has multiple E2E/test Dockerfiles that run all processes as root",openclaw,0,2026.2.21,,HIGH,CWE-250,
 GHSA-w7m7-3xcf-mp48,2026-06-16T21:31:59Z,"Duplicate Advisory: Zalo allowFrom could bind to mutable display names",openclaw,0,,2026.5.2,HIGH,CWE-290,
 GHSA-w7q7-vjp8-7jv4,2019-06-06T15:30:16Z,"SQL Injection in typeorm",typeorm,0,0.1.15,,CRITICAL,CWE-89,
@@ -9723,6 +9978,7 @@ GHSA-w9q5-mvc6-5cw3,2020-09-03T21:45:13Z,"Malicious Package in bufder-xor",bufde
 GHSA-wc7q-qpm4-8pqv,2020-09-02T20:32:10Z,"Malicious Package in rrequest",rrequest,0,,,CRITICAL,CWE-506,
 GHSA-wch2-46wj-6x5j,2020-09-04T15:37:15Z,"Malicious Package in bip30",bip30,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wcm7-94wg-h74h,2026-04-24T00:31:51Z,"Duplicate Advisory: OpenClaw host-env blocklist missing `GIT_TEMPLATE_DIR` and `AWS_CONFIG_FILE` allows code execution via env override",openclaw,0,2026.3.28,,MODERATE,CWE-184,
+GHSA-wf3x-273g-mvxv,2026-10-01T15:17:13Z,"devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated",devalue,1.0.0,5.9.3,,LOW,CWE-400;CWE-789,
 GHSA-wf8q-wvv8-p8jf,2026-05-14T20:44:22Z,"@samanhappy/mcphub: SSE Endpoint Accepts Arbitrary Username from URL Path Without Authentication, Enabling User Impersonation",@samanhappy/mcphub,0,0.12.15,,CRITICAL,CWE-290,
 GHSA-wfhx-6pcm-7m55,2020-09-03T16:46:22Z,"Path Traversal in ponse",ponse,0,2.0.2,,HIGH,CWE-22,
 GHSA-wfjh-3hq2-r276,2020-09-03T19:56:48Z,"Malicious Package in node-spdy",node-spdy,0.0.0,,,CRITICAL,CWE-506,
@@ -9752,10 +10008,9 @@ GHSA-wmpv-c2jp-j2xg,2021-11-15T23:28:18Z,"ERC1155Supply vulnerability in OpenZep
 GHSA-wmpv-c2jp-j2xg,2021-11-15T23:28:18Z,"ERC1155Supply vulnerability in OpenZeppelin Contracts",@openzeppelin/contracts,4.2.0,4.3.3,,LOW,,
 GHSA-wp2p-q35g-3rjj,2020-09-01T21:13:01Z,"Malicious Package in soket.io",soket.io,0,,,CRITICAL,CWE-506,
 GHSA-wpfc-3w63-g4hm,2020-09-01T21:09:48Z,"Malicious Package in axois",axois,0,,,CRITICAL,CWE-506,
-GHSA-wpqr-6v78-jr5g,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0,0.39.1,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
-GHSA-wpqr-6v78-jr5g,2026-04-24T19:30:01Z,"Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses",@google/gemini-cli,0.40.0-preview.2,0.40.0-preview.3,,CRITICAL,"CWE-20;CWE-200;CWE-77;CWE-78",
 GHSA-wq64-hcrf-8m56,2026-07-22T12:32:17Z,"Duplicate Advisory: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs",n8n,0,,,HIGH,CWE-269,
 GHSA-wq95-wr7m-26h4,2025-10-06T03:31:38Z,"Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot",flowise,0,3.0.5,,HIGH,CWE-79,
+GHSA-wqg3-r97q-73xm,2026-09-17T15:32:15Z,"Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape",vm2,3.9.6,,3.11.6,CRITICAL,CWE-693,
 GHSA-wqgq-mfvj-6qxp,2020-09-03T19:49:03Z,"Malicious Package in koa-body-parse",koa-body-parse,0.0.0,,,CRITICAL,CWE-506,
 GHSA-wqgx-4q47-j2w5,2020-09-04T17:36:04Z,"Insecure Cryptography Algorithm in parsel",parsel,0.0.0,,,CRITICAL,CWE-327,
 GHSA-wqhw-frpx-5mmp,2020-09-02T16:01:33Z,"Command Injection in tomato",tomato,0,,,HIGH,CWE-77,
@@ -9800,6 +10055,7 @@ GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,0,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,3.0.0,3.3.2,,MODERATE,,
 GHSA-x4rf-4mqf-cm8w,2020-08-19T22:44:22Z,"Open Redirect in ecstatic",ecstatic,4.0.0,4.1.2,,MODERATE,,
 GHSA-x565-32qp-m3vf,2024-04-11T21:30:30Z,"phin may include sensitive headers in subsequent requests after redirect",phin,0,3.7.1,,MODERATE,CWE-200,
+GHSA-x5rw-q4pp-hg5g,2026-10-01T15:15:13Z,"devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise",devalue,5.8.0,5.9.3,,HIGH,CWE-248;CWE-755,
 GHSA-x6ch-c6rv-f7wh,2020-09-02T18:34:22Z,"Malicious Package in asymc",asymc,0,,,CRITICAL,CWE-506,
 GHSA-x6gq-467r-hwcc,2020-09-01T21:14:05Z,"Malicious Package in soket.js",soket.js,0,,,CRITICAL,CWE-506,
 GHSA-x6m6-5hrf-fh6r,2020-09-01T21:26:50Z,"Denial of Service in markdown-it-toc-and-anchor","markdown-it-toc-and-anchor",0,4.2.0,,HIGH,CWE-400,
@@ -9851,6 +10107,7 @@ GHSA-xppm-jmw6-fhmf,2026-06-20T18:31:29Z,"Duplicate Advisory: Cross-site scripti
 GHSA-xppm-jmw6-fhmf,2026-06-20T18:31:29Z,"Duplicate Advisory: Cross-site scripting via <NoScript> slot content in Nuxt's head components",nuxt,4.0.0,4.4.7,,LOW,CWE-79,
 GHSA-xpr6-2hgm-4wwp,2026-05-11T18:31:47Z,"Duplicate Advisory: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolution",openclaw,0,2026.4.23,,HIGH,CWE-427,
 GHSA-xq3g-m3j8-2vmm,2026-03-21T03:31:13Z,"Duplicate Advisory: OpenClaw's inbound media downloads could exceed configured byte limits before rejection across multiple channels",openclaw,0,,,HIGH,CWE-770,
+GHSA-xq74-c7jx-8w5j,2026-09-17T15:32:15Z,"Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store",vm2,3.11.3,,3.11.6,CRITICAL,CWE-732,
 GHSA-xq7h-vwjp-5vrh,2026-03-25T17:30:46Z,"@grackle-ai/powerline Runs Without Authentication by Default",@grackle-ai/powerline,0,0.70.1,,MODERATE,CWE-306,
 GHSA-xr3g-4gg5-w3wq,2020-09-03T17:06:14Z,"Malicious Package in degbu",degbu,0.0.0,,,CRITICAL,CWE-506,
 GHSA-xr4f-mjxj-w6w5,2026-07-02T16:55:09Z,"OpenClaw: Non-owner chat senders could issue device-pairing bootstrap codes",openclaw,0,2026.5.4,,HIGH,CWE-863,
@@ -9876,3 +10133,4 @@ GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notat
 GHSA-xwx6-jjhv-84p8,2026-07-22T22:12:33Z,"n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service",n8n,2.32.0,2.32.1,,HIGH,CWE-1321,
 GHSA-xx4c-jj58-r7x6,2021-11-19T20:14:23Z,"Inefficient Regular Expression Complexity in Validator.js",validator,11.1.0,13.7.0,,MODERATE,CWE-1333,
 GHSA-xxj4-96ph-g6j6,2026-03-31T12:31:36Z,"Duplicate Advisory: OpenClaw: Sandbox `writeFile` commit could race outside the validated path",openclaw,0,2026.3.11,,MODERATE,CWE-367,
+GHSA-xxv7-2vv3-h682,2026-10-02T19:31:33Z,"Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL",trigger.dev,0,4.5.2,,HIGH,CWE-918,