Advisories matched in open-source security tools
1077 distinct advisories match the declared dependencies of the catalog's tools this week. 472 affect more than one tool, and 119 have vulnerable code compiled into at least one tool's release binary. Advisory ids that alias each other (GHSA, Go, CVE) are merged.
In the CISA KEV catalog (3)
GHSA-mrrh-fwg8-r2c3(CVE-2025-30066): 1 tool(s), 0 shipping the vulnerable code — workflow references onlyGHSA-qqvq-6xgj-jw8g(CVE-2023-5217): 1 tool(s), 0 shipping the vulnerable codeGHSA-86qp-5c8j-p5mr(CVE-2026-48710): 1 tool(s), 0 shipping the vulnerable code
KEV: listed in the CISA Known Exploited Vulnerabilities catalog. EPSS: FIRST's estimated probability of exploitation in the next 30 days. Both describe the vulnerability in general, not its exploitability through this tool; a match in a workflow file refers to a GitHub Action, not to shipped code.
All advisories
| Advisory | Severity | Summary | Tools | Shipped in binary | KEV | EPSS |
|---|---|---|---|---|---|---|
GO-2026-6860CVE-2026-78661 | Unknown | When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data + | 35 | 20 | no | 0.2% |
GO-2026-6866CVE-2026-97045 | Unknown | In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found | 35 | 20 | no | 0.2% |
GO-2026-5932 | Unknown | The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. | 34 | 20 | no | — |
GO-2026-6612CVE-2026-78663 | Critical | The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for a | 21 | 16 | no | 0.6% |
GO-2026-6603CVE-2026-78659 | High | When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to | 21 | 16 | no | 0.6% |
GO-2026-6610CVE-2026-78660 | High | Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HT | 21 | 16 | no | 0.4% |
GO-2026-6611CVE-2026-78669 | High | A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending ma | 21 | 16 | no | 0.6% |
GO-2026-6617CVE-2026-97032 | High | HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies | 21 | 16 | no | 0.5% |
GO-2026-6629CVE-2026-56851 | High | The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. | 16 | 10 | no | 0.5% |
GO-2026-6354CVE-2026-78662 | High | Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's | 13 | 8 | no | 0.4% |
GO-2026-6355CVE-2026-56855 | High | Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. No | 13 | 8 | no | 0.5% |
GHSA-x744-4wpc-v9h2CVE-2026-34040, GO-2026-4887 | High | Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker | 12 | 7 | no | 9.3% |
GHSA-2v4p-qf9q-27wjCVE-2026-84445 | High | gRPC-Go xDS servers: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers | 10 | 7 | no | 0.6% |
GHSA-pxq6-2prw-chj9CVE-2026-33997 | Medium | Moby has an Off-by-one error in its plugin privilege validation | 12 | 7 | no | 0.4% |
GO-2026-6303CVE-2026-56854 | High | The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and | 11 | 6 | no | 0.4% |
GHSA-259r-337f-4rfwCVE-2026-63209 | High | Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress | 9 | 6 | no | 0.6% |
GO-2026-5970CVE-2026-56852 | High | A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. | 9 | 6 | no | 0.5% |
GHSA-vp52-pcj8-j9qcCVE-2026-84304 | High | gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation | 8 | 6 | no | 0.6% |
GO-2026-4918CVE-2026-33814 | High | When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_F | 6 | 6 | no | 0.8% |
GO-2026-5026CVE-2026-39821 | High | The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("x | 6 | 6 | no | 1.8% |
GHSA-89gr-r52h-f8rxCVE-2026-39831 | Critical | golang.org/x/crypto: FIDO/U2F security key physical presence check can be bypassed | 7 | 5 | no | 0.5% |
GHSA-rm3j-f69w-wqmqCVE-2026-39834 | Critical | golang.org/x/crypto vulnerable to infinite loop on large channel writes | 7 | 5 | no | 0.6% |
GHSA-rg2x-37c3-w2rhCVE-2026-42306 | High | Docker: Race condition in docker cp allows bind mount redirection to host path | 12 | 5 | no | 0.1% |
GHSA-x86f-5xw2-fm2rCVE-2026-41567 | High | Docker: `PUT /containers/{id}/archive` executes container binary on the host | 12 | 5 | no | 0.2% |
GHSA-q4h4-gmj2-qvw2CVE-2026-46597 | High | golang.org/x/crypto: Invoking byte arithmetic causes underflow and panic | 7 | 5 | no | 0.5% |
GHSA-w879-237q-wc7rCVE-2026-39829 | High | golang.org/x/crypto: Invoking pathological RSA/DSA parameters may cause DoS | 7 | 5 | no | 0.5% |
GHSA-vp62-88p7-qqf5CVE-2026-41568 | Medium | Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap | 12 | 5 | no | 0.1% |
GHSA-5cgq-3rg8-m6cvCVE-2026-42508 | Critical | golang.org/x/crypto vulnerable to auth bypass via unenforced @revoked status | 7 | 4 | no | 6.9% |
GHSA-f5wc-c3c7-36mcCVE-2026-39832 | Critical | golang.org/x/crypto doesn't drop invoking agent constraints when forwarding keys | 7 | 4 | no | 0.7% |
GHSA-jppx-rxg9-jmrxCVE-2026-39833 | Critical | golang.org/x/crypto doesn't enforce invoking key constraints | 7 | 4 | no | 0.5% |
GHSA-vgwf-h737-ff37CVE-2026-39830 | Critical | golang.org/x/crypto: Invoking client can cause server deadlock on unexpected responses | 7 | 4 | no | 0.7% |
GHSA-x527-x647-q7ggCVE-2026-46595 | Critical | golang.org/x/crypto: Invoking VerifiedPublicKeyCallback permissions skip enforcement | 7 | 4 | no | 0.6% |
GO-2026-6179CVE-2026-56865 | High | A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check an | 12 | 4 | no | 0.1% |
GO-2026-6180CVE-2026-56864 | High | A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coor | 12 | 4 | no | 0.3% |
GO-2026-5942CVE-2026-46600 | High | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. | 6 | 4 | no | 0.5% |
GHSA-45gg-vh54-h5m9CVE-2026-39828 | Medium | golang.org/x/crypto vulnerable to invoking bypass of certificate restrictions | 7 | 4 | no | 0.4% |
GHSA-78mq-xcr3-xm33CVE-2026-39835 | Medium | golang.org/x/crypto is vulnerable to invoking server panic during CheckHostKey/Authenticate flow | 7 | 4 | no | 0.5% |
GHSA-9m57-25v3-79x9CVE-2026-46598 | Medium | golang.org/x/crypto: Invoking pathological inputs can lead to client panic | 7 | 4 | no | 0.4% |
GHSA-qpw4-5x99-6vjpCVE-2026-39827 | Medium | golang.org/x/crypto: Invoking memory leak when rejecting channels can lead to DoS | 7 | 4 | no | 0.3% |
GHSA-5cv4-jp36-h3mwCVE-2026-25680 | Medium | Go Net HTML parser is vulnerable to denial of service | 6 | 4 | no | 0.3% |
GO-2026-5025CVE-2026-42506 | Medium | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attac | 6 | 4 | no | 0.2% |
GO-2026-5027CVE-2026-42502 | Medium | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attac | 6 | 4 | no | 0.2% |
GO-2026-5029CVE-2026-25681 | Medium | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attac | 6 | 4 | no | 0.2% |
GO-2026-5030CVE-2026-27136 | Medium | Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attac | 6 | 4 | no | 0.2% |
GHSA-p77j-4mvh-x3m3CVE-2026-33186 | Critical | gRPC-Go has an authorization bypass via missing leading slash in :path | 5 | 3 | no | 1.6% |
GHSA-hrxh-6v49-42gf | High | gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities | 5 | 3 | no | — |
GHSA-qc2q-p7wx-3px3CVE-2026-84303 | Medium | gRPC-Go: xDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion | 8 | 3 | no | 0.3% |
GO-2025-4116CVE-2025-47913 | High | SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. | 5 | 2 | no | 0.7% |
GHSA-78h2-9frx-2jm8CVE-2026-34986 | High | Go JOSE Panics in JWE decryption | 3 | 2 | no | 0.7% |
GHSA-p436-gjf2-799pCVE-2025-15558 | High | Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows | 3 | 2 | no | 0.5% |
GHSA-77fj-vx54-gvh7CVE-2026-40890 | High | Go Markdown has an Out-of-bounds Read in SmartypantsRenderer | 2 | 2 | no | 0.3% |
GHSA-fxhp-mv3v-67qpCVE-2026-50163 | High | `oras-go` tar extraction: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution | 2 | 2 | no | 0.4% |
GHSA-jxpm-75mh-9fp7CVE-2026-50151 | High | oras-go blob upload vulnerable to credential forwarding via unvalidated Location header | 2 | 2 | no | 0.4% |
GHSA-m37j-52j7-pjw7CVE-2026-85731 | High | oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) | 2 | 2 | no | 0.7% |
GHSA-f6x5-jh6r-wrfvCVE-2025-47914 | Medium | golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read | 5 | 2 | no | 0.5% |
GHSA-j5w8-q4qc-rx2xCVE-2025-58181 | Medium | golang.org/x/crypto/ssh allows an attacker to cause unbounded memory consumption | 5 | 2 | no | 0.6% |
GHSA-mjcv-p78q-w5fwCVE-2026-61801 | Medium | github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database files | 5 | 2 | no | 0.1% |
GO-2026-4440CVE-2025-47911 | Medium | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial o | 4 | 2 | no | 0.6% |
GO-2026-4441CVE-2025-58190 | Medium | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of se | 4 | 2 | no | 0.5% |
GHSA-7236-3392-c5c6CVE-2026-61711 | Medium | BuildKit: Custom frontend could bypass Seccomp/AppArmor | 2 | 2 | no | 0.4% |
GHSA-8xwf-rjm4-xvhvCVE-2026-50162 | Medium | oras-go has file store write outside workingDir via symlink traversal | 2 | 2 | no | 0.4% |
GHSA-gcjh-h69q-9w9g | Medium | cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag | 2 | 2 | no | — |
GHSA-h7vf-4x9w-h99vCVE-2026-85732 | Medium | oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing | 2 | 2 | no | 0.4% |
GHSA-vh4v-2xq2-g5cg | Medium | ORAS Go forwards registry credentials across registry redirects | 2 | 2 | no | — |
GHSA-vvgc-356p-c3xwCVE-2025-22872 | Medium | golang.org/x/net vulnerable to Cross-site Scripting | 2 | 2 | no | 0.5% |
GHSA-72x6-4j93-7w86CVE-2026-61712 | Low | BuildKit has a possible runtime DoS via unbounded group parsing | 2 | 2 | no | 0.4% |
GHSA-xf85-363p-868wCVE-2026-48978 | Low | oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens | 2 | 2 | no | 0.2% |
GO-2026-6225 | Unknown | In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Containe | 5 | 2 | no | — |
GHSA-33vj-92qq-66hcCVE-2026-53492, GO-2026-5064 | Critical | containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd | 5 | 1 | no | 0.4% |
GHSA-cvxm-645q-p574CVE-2026-50195, GO-2026-5338 | Critical | containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd | 5 | 1 | no | 0.3% |
GHSA-9jj7-4m8r-rfcmCVE-2026-33816 | Critical | Memory-safety vulnerability in github.com/jackc/pgx/v5. | 1 | 1 | no | 0.6% |
GHSA-xgrm-4fwx-7qm8CVE-2026-33815 | Critical | pgx contains memory-safety vulnerability | 1 | 1 | no | 0.6% |
GHSA-p7v4-vr35-mj6fCVE-2026-95837, GO-2026-6791 | High | containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd | 5 | 1 | no | 0.1% |
GHSA-fqw6-gf59-qr4wCVE-2026-46680 | High | containerd user ID handling bypass allows runAsNonRoot evasion | 3 | 1 | no | 0.2% |
GHSA-xhf5-7wjv-pqxpCVE-2026-53488 | High | containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull | 3 | 1 | no | 0.2% |
GHSA-47q9-m4ww-924mCVE-2026-48702 | High | Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic | 2 | 1 | no | 0.5% |
GHSA-6g7g-w4f8-9c9xCVE-2026-32285 | High | github.com/buger/jsonparser has a denial of service vulnerability | 2 | 1 | no | 0.8% |
GHSA-hc8v-wwc9-vgxmCVE-2026-71556 | High | go-git: Worktree operations may follow symlinks | 2 | 1 | no | 0.4% |
GHSA-mh2q-q3fh-2475CVE-2026-29181 | High | OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) | 2 | 1 | no | 0.8% |
GHSA-4c29-8rgm-jvjjCVE-2026-33747 | High | BuildKit's Malicious frontend can cause file escape outside of storage root | 1 | 1 | no | 0.5% |
GHSA-4qg8-fj49-pxjhCVE-2025-66564 | High | Sigstore Timestamp Authority allocates excessive memory during request parsing | 1 | 1 | no | 0.4% |
GHSA-4vrq-3vrq-g6ggCVE-2026-33748 | High | BuildKit Git URL subdir component can cause access to restricted files | 1 | 1 | no | 0.5% |
GHSA-6m8w-jc87-6cr7CVE-2025-46569 | High | OPA server Data API HTTP path injection of Rego | 1 | 1 | no | 0.5% |
GHSA-6v2p-p543-phr9CVE-2025-22868 | High | golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability | 1 | 1 | no | 0.9% |
GHSA-6vch-q96h-7gc3CVE-2026-73500, GO-2026-6107 | High | In go.etcd.io/etcd/client/pkg/v3 before 3.5.33, 3.6.14, and 3.7.1, TLS handshakes on listeners created by NewTLSListener do not enforce a ha | 1 | 1 | no | 0.4% |
GHSA-vfp3-v2gw-7wfqCVE-2026-55677 | High | Echo: Encoded slash (%2F) bypasses route-level protection and exposes static files | 1 | 1 | no | 0.5% |
GO-2026-6222CVE-2026-46603 | High | VP8L decoding in golang.org/x/image/vp8l can allocate an excessive amount of memory when processing a crafted VP8L image containing many unu | 1 | 1 | no | 0.4% |
GHSA-pg57-6jwg-q645CVE-2026-53493 | Medium | Containerd has image-pull DoS via crafted OCI index graph amplification | 5 | 1 | no | 0.4% |
GHSA-rgh6-rfwx-v388CVE-2026-53489, GO-2026-5622 | Medium | Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd | 5 | 1 | no | 0.2% |
GHSA-7jxh-36q5-gcqvCVE-2026-53495 | Medium | containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service | 3 | 1 | no | 0.2% |
GHSA-jpcc-p29g-p8mqCVE-2026-47262 | Medium | containerd image-triggered runtime DoS via unbounded group parsing | 3 | 1 | no | 0.3% |
GHSA-rp3h-jf77-q9p4CVE-2026-95838 | Medium | containerd: Unpack DoS via repeated opaque whiteouts | 3 | 1 | no | 0.2% |
GHSA-9c54-x2g4-v92jCVE-2026-49835 | Medium | Sigstore Timestamp Authority has OOM due to unbounded metric label cardinality | 2 | 1 | no | 0.7% |
GHSA-9vcr-p3rj-q5q6CVE-2026-49834 | Medium | sigstore-go has a multi-log threshold bypass via single compromised log | 2 | 1 | no | 0.2% |
GHSA-qgq7-7hm3-q39jCVE-2026-71557 | Medium | go-git: Malicious reference names may modify files outside the reference storage | 2 | 1 | no | 0.4% |
GHSA-rwvp-r38j-9rggCVE-2025-11579 | Medium | rardecode: DoS risk due to unrestricted RAR dictionary sizes | 2 | 1 | no | 0.4% |
GHSA-w6c6-c85g-mmv6CVE-2026-39395, GO-2026-5694 | Medium | Cosign's verify-blob-attestation reports false positive when payload parsing fails in github.com/sigstore/cosign | 2 | 1 | no | 0.2% |
GHSA-xm5m-wgh2-rrg3CVE-2026-39984, GO-2026-5763 | Medium | Sigstore Timestamp Authority has Improper Certificate Validation in verifier in github.com/sigstore/timestamp-authority | 2 | 1 | no | 0.1% |
GHSA-2464-8j7c-4cjmCVE-2025-11065 | Medium | go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data | 1 | 1 | no | 0.4% |
GHSA-273p-m2cw-6833CVE-2026-23831 | Medium | Rekor's COSE v0.0.1 entry type nil pointer dereference in Canonicalize via empty Message | 1 | 1 | no | 0.4% |
GHSA-4c4x-jm2x-pf9jCVE-2026-24117 | Medium | Rekor affected by Server-Side Request Forgery (SSRF) via provided public key URL | 1 | 1 | no | 0.4% |
GHSA-846p-jg2w-w324CVE-2026-23991 | Medium | go-tuf affected by client DoS via malformed server response | 1 | 1 | no | 0.6% |
GHSA-c97m-vxhj-p7j6CVE-2026-5160, GO-2026-5320 | Medium | Cross-site Scripting (XSS) in github.com/yuin/goldmark | 1 | 1 | no | 0.3% |
GHSA-fcv2-xgw5-pqxfCVE-2026-24137 | Medium | sigstore legacy TUF client allows for arbitrary file writes with target cache path traversal | 1 | 1 | no | 0.4% |
GHSA-fphv-w9fq-2525CVE-2026-23992 | Medium | go-tuf improperly validates the configured threshold for delegations | 1 | 1 | no | 0.2% |
GHSA-fv92-fjc5-jj9h | Medium | mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data | 1 | 1 | no | — |
GHSA-hr2v-4r36-88hrCVE-2026-35206 | Medium | Helm Chart extraction output directory collapse via `Chart.yaml` name dot-segment | 1 | 1 | no | 0.2% |
GHSA-jqc5-w2xx-5vq4CVE-2026-24686 | Medium | go-tuf Path Traversal in TAP 4 Multirepo Client Allows Arbitrary File Write via Malicious Repository Names | 1 | 1 | no | 0.2% |
GHSA-pjcq-xvwq-hhpjCVE-2026-32952 | Medium | go-ntlmssp NTLM challenges can panic on malformed payloads | 1 | 1 | no | 1.0% |
GHSA-qxp5-gwg8-xv66CVE-2025-22870 | Medium | HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net | 1 | 1 | no | 0.4% |
GHSA-vvgj-x9jq-8cj9CVE-2026-40898 | Medium | quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion | 1 | 1 | no | 0.4% |
GHSA-w32m-9786-jp63CVE-2024-45338, GO-2024-3333 | Medium | An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremel | 1 | 1 | no | 1.1% |
GHSA-w67g-5rqw-f597 | Medium | Gorilla WebSocket Uses Cryptographically Weak PRNG for WebSocket Mask Key | 1 | 1 | no | — |
GHSA-whqx-f9j3-ch6mCVE-2026-22703 | Medium | Cosign verification accepts any valid Rekor entry under certain conditions | 1 | 1 | no | 0.1% |
GHSA-8wmf-6v46-5gfgCVE-2026-81870 | Low | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs | 11 | 1 | no | 0.3% |
GHSA-wfqv-66vq-46rmCVE-2026-24122, GO-2026-4529 | Low | Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped in github.com/sigsto | 2 | 1 | no | 0.2% |
GHSA-wqqc-jjcq-vfxmCVE-2026-54787 | Low | sigstore-go fails to check signature timestamps against a signing key's validity period | 2 | 1 | no | 0.1% |
GHSA-j88v-2chj-qfwxCVE-2026-41889 | Low | pgx: SQL Injection via placeholder confusion with dollar quoted string literals | 1 | 1 | no | 0.4% |
GHSA-mqqf-5wvp-8fh8GO-2026-4316 | Unknown | Open redirect vulnerability in the RedirectSlashes middleware in github.com/go-chi/chi | 1 | 1 | no | — |
GHSA-mrrh-fwg8-r2c3CVE-2025-30066 | High | tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs. | 1 | 0 | KEV | 72.1% |
GHSA-qqvq-6xgj-jw8gCVE-2023-5217 | High | Electron affected by libvpx's heap buffer overflow in vp8 encoding | 1 | 0 | KEV | 49.0% |
GHSA-86qp-5c8j-p5mrCVE-2026-48710 | Medium | Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks | 1 | 0 | KEV | 70.3% |
GHSA-6q48-6c7w-9gw2 | Critical | certifi bundles emSign root CAs with compromised intermediate CA keys | 7 | 0 | no | — |
GHSA-23hp-3jrh-7fpwCVE-2026-59873 | Critical | node-tar: Decompression/parse DoS via unlimited input | 6 | 0 | no | 0.6% |
GHSA-jqcg-44mw-7w3hCVE-2026-90711 | Critical | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet | 5 | 0 | no | 0.3% |
GHSA-5xjx-3w67-w9x9 | Critical | pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI | 4 | 0 | no | — |
GHSA-8r5x-fm3f-whwjCVE-2026-106446 | Critical | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) | 4 | 0 | no | 0.8% |
GHSA-p8wg-vrv2-v86fCVE-2026-106445 | Critical | Handlebars: JavaScript Injection via Own Property Check Bypass | 4 | 0 | no | 0.6% |
GHSA-2w6w-674q-4c4qCVE-2026-33937 | Critical | Handlebars.js has JavaScript Injection via AST Type Confusion | 3 | 0 | no | 1.9% |
GHSA-fjxv-7rqg-78g4CVE-2025-7783 | Critical | form-data uses unsafe random function in form-data for choosing boundary | 3 | 0 | no | 1.8% |
GHSA-pqg4-j6r4-53mvCVE-2026-102422 | Critical | shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token | 3 | 0 | no | 0.4% |
GHSA-xv26-6w52-cph6CVE-2026-54466 | Critical | websocket-driver: Message corruption via abuse of protocol length headers | 3 | 0 | no | 0.4% |
GHSA-67hx-6x53-jw92CVE-2023-45133 | Critical | Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code | 2 | 0 | no | 0.5% |
GHSA-cg2g-xh64-v4q7 | Critical | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes | 2 | 0 | no | — |
GHSA-f2ph-cmg5-wxc8CVE-2026-114125 | Critical | Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites | 2 | 0 | no | 0.4% |
GHSA-jf85-cpcp-j695CVE-2019-10744 | Critical | Prototype Pollution in lodash | 2 | 0 | no | 5.0% |
GHSA-xvch-5gv4-984hCVE-2021-44906 | Critical | Prototype Pollution in minimist | 2 | 0 | no | 4.6% |
GHSA-2464-fhr4-w9xw | Critical | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used | 1 | 0 | no | — |
GHSA-284h-m62q-gf8wCVE-2026-78676 | Critical | GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfig | 1 | 0 | no | 0.6% |
GHSA-2943-5xfg-gq5fCVE-2026-77414 | Critical | JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions | 1 | 0 | no | 0.6% |
GHSA-2xp9-vwfh-vxw4 | Critical | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used | 1 | 0 | no | — |
GHSA-33mj-cw25-m34hCVE-2026-77405 | Critical | RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser | 1 | 0 | no | 0.3% |
GHSA-34r7-q49f-h37cCVE-2015-8857 | Critical | Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js | 1 | 0 | no | 3.6% |
GHSA-4cpg-3vgw-4877CVE-2022-22912 | Critical | Prototype pollution in Plist before 3.0.5 can cause denial of service | 1 | 0 | no | 2.6% |
GHSA-4g88-fppr-53ppCVE-2019-10747 | Critical | Prototype Pollution in set-value | 1 | 0 | no | 2.5% |
GHSA-4vmm-mhcq-4x9j | Critical | Sandbox Bypass Leading to Arbitrary Code Execution in constantinople | 1 | 0 | no | — |
GHSA-5gmw-xhrv-c9v3CVE-2026-104848 | Critical | Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution | 1 | 0 | no | 0.5% |
GHSA-5xrq-8626-4rwpCVE-2026-47429 | Critical | When Vitest UI server is listening, arbitrary file can be read and executed | 1 | 0 | no | 0.9% |
GHSA-66mm-25pp-rfffCVE-2026-77415 | Critical | JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions | 1 | 0 | no | 0.9% |
GHSA-673q-mjm6-r5xr | Critical | Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays | 1 | 0 | no | — |
GHSA-76p3-8jx3-jpfqCVE-2022-37601 | Critical | Prototype pollution in webpack loader-utils | 1 | 0 | no | 3.5% |
GHSA-82r6-8w77-94w6CVE-2026-63374 | Critical | AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing | 1 | 0 | no | 0.3% |
GHSA-85c8-ppgw-ccprCVE-2026-104849 | Critical | Tinypool: Prototype Pollution Gadget to RCE in run() options | 1 | 0 | no | 0.5% |
GHSA-8gq3-vp5j-2grpCVE-2026-77413 | Critical | JSONata: Arbitrary Code Execution via crafted JSONata expressions | 1 | 0 | no | 0.7% |
GHSA-c5pq-fr2g-9jpfCVE-2026-77411 | Critical | RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr | 1 | 0 | no | 0.5% |
GHSA-crh6-fp67-6883CVE-2022-39353 | Critical | xmldom allows multiple root nodes in a DOM | 1 | 0 | no | 1.6% |
GHSA-cxf3-9h37-7rr8CVE-2026-118264 | Critical | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls | 1 | 0 | no | 0.4% |
GHSA-ffc3-869f-jxw9CVE-2026-102268 | Critical | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard | 1 | 0 | no | 0.2% |
GHSA-g4rg-993r-mgx7CVE-2021-42740 | Critical | Improper Neutralization of Special Elements used in a Command in Shell-quote | 1 | 0 | no | 4.2% |
GHSA-hc6q-2mpp-qw7jCVE-2023-28154 | Critical | Cross-realm object access in Webpack 5 | 1 | 0 | no | 1.4% |
GHSA-j497-x9hr-x34xCVE-2026-77408 | Critical | RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow | 1 | 0 | no | 0.5% |
GHSA-m7jm-9gc2-mpf2CVE-2026-25896 | Critical | fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names | 1 | 0 | no | 0.5% |
GHSA-p293-qw3h-jr36CVE-2026-75604 | Critical | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers | 1 | 0 | no | 2.1% |
GHSA-r275-fr43-pm7qCVE-2026-28292 | Critical | simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE | 1 | 0 | no | 1.3% |
GHSA-v778-237x-gjrcCVE-2024-45337 | Critical | Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto | 1 | 0 | no | 3.2% |
GHSA-w7jw-789q-3m8pCVE-2026-9277 | Critical | shell-quote quote() does not escape newlines in object .op values | 1 | 0 | no | 0.8% |
GHSA-x6jw-m9v5-85vhCVE-2026-102828 | Critical | simple-git unsafe-operation guard does not block trailer command configuration | 1 | 0 | no | 0.4% |
GHSA-xq3m-2v4x-88ggCVE-2026-41242 | Critical | Arbitrary code execution in protobufjs | 1 | 0 | no | 0.8% |
GHSA-mgcc-cww5-fp2qCVE-2026-116587 | High | Go JOSE: DoS when parsing JWKs that contain RSA keys | 19 | 0 | no | 0.4% |
GHSA-6j4f-fj2g-mc7pCVE-2026-102276 | High | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion | 10 | 0 | no | 0.5% |
GHSA-qhr7-859c-m2p7CVE-2026-102278 | High | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion | 10 | 0 | no | 0.5% |
GHSA-8988-9cw3-xx77CVE-2026-97687 | High | urllib3: HTTPS proxy TLS configuration may be ignored or overridden | 8 | 0 | no | 0.2% |
GHSA-vxq7-64xx-v4gwCVE-2026-97689 | High | urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory | 8 | 0 | no | 0.3% |
GHSA-27r3-jxmh-p828CVE-2026-111181 | High | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body | 7 | 0 | no | 0.4% |
GHSA-2883-xcg3-v3hhCVE-2026-84375 | High | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources | 7 | 0 | no | 0.5% |
GHSA-3jxr-9vmj-r5cpCVE-2026-13149 | High | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups | 7 | 0 | no | 0.4% |
GHSA-mh99-v99m-4gvgCVE-2026-14257 | High | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash | 7 | 0 | no | 0.6% |
GHSA-rgw5-rvv9-x895CVE-2026-69152 | High | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation | 7 | 0 | no | 0.6% |
GHSA-52cp-r559-cp3mCVE-2026-59869 | High | js-yaml: YAML merge-key chains can force quadratic CPU consumption | 6 | 0 | no | 0.6% |
GHSA-5p4m-2wfm-xmqj | High | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported | 6 | 0 | no | — |
GHSA-68fv-2mgg-jv7qCVE-2026-93749 | High | source-map-js allows event-loop denial of service through indexed source-map section offsets | 6 | 0 | no | 0.5% |
GHSA-73wf-gq98-2v4gCVE-2026-73088 | High | Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats) | 6 | 0 | no | 0.7% |
GHSA-8x88-c5mf-7j5wCVE-2026-59874 | High | node-tar: Negative tar entry size causes infinite loop in archive replace | 6 | 0 | no | 0.4% |
GHSA-c83g-rgw3-j3cxCVE-2026-73089 | High | Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM | 6 | 0 | no | 0.7% |
GHSA-qw65-cvwx-89v3CVE-2026-84292 | High | fast-uri vulnerable to authority injection via an unvalidated port in serialize | 6 | 0 | no | 0.2% |
GHSA-r292-9mhp-454mCVE-2026-73566 | High | node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection | 6 | 0 | no | 0.5% |
GHSA-23c5-xmqv-rm74CVE-2026-27904 | High | minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions | 5 | 0 | no | 0.5% |
GHSA-28wg-ghj8-5hjvCVE-2026-67214 | High | nanoid: non-secure generators can loop indefinitely with negative size | 5 | 0 | no | 0.3% |
GHSA-2v37-7h3g-55p8CVE-2026-67213 | High | nanoid: custom generators can loop indefinitely when size is zero | 5 | 0 | no | 0.3% |
GHSA-3ppc-4f35-3m26CVE-2026-26996 | High | minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern | 5 | 0 | no | 0.6% |
GHSA-3xgq-45jj-v275CVE-2024-21538 | High | Regular Expression Denial of Service (ReDoS) in cross-spawn | 5 | 0 | no | 0.9% |
GHSA-4c8g-83qw-93j6CVE-2026-13676 | High | fast-uri vulnerable to host confusion via failed IDN canonicalization | 5 | 0 | no | 0.7% |
GHSA-7p8r-x3mc-p8w7CVE-2026-18446 | High | fast-uri vulnerable to host confusion via backslash authority introducer | 5 | 0 | no | 0.4% |
GHSA-7r86-cg39-jmmjCVE-2026-27903 | High | minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments | 5 | 0 | no | 0.6% |
GHSA-8r9p-f939-6h3cCVE-2026-111755 | High | follow-redirects sensitiveHeaders regex escaping can expose credential headers | 5 | 0 | no | 0.5% |
GHSA-96hv-2xvq-fx4pCVE-2026-48779 | High | ws: Memory exhaustion DoS from tiny fragments and data chunks | 5 | 0 | no | 1.4% |
GHSA-c2qf-rxjj-qqgwCVE-2022-25883 | High | semver vulnerable to Regular Expression Denial of Service | 5 | 0 | no | 2.8% |
GHSA-f65p-4m7j-42xcCVE-2026-75975 | High | fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization | 5 | 0 | no | 0.2% |
GHSA-jqff-g426-hqxpCVE-2026-76172 | High | fast-uri vulnerable to host confusion via percent-encoded scheme normalization | 5 | 0 | no | 0.2% |
GHSA-mrwp-f3q8-3g9pCVE-2026-116689 | High | follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects | 5 | 0 | no | 0.3% |
GHSA-q3jh-wrc6-jgq8CVE-2026-111756 | High | follow-redirects array-form headers bypass cross-origin credential stripping | 5 | 0 | no | 0.5% |
GHSA-r28c-9q8g-f849CVE-2026-73646 | High | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure | 5 | 0 | no | 0.5% |
GHSA-v2hh-gcrm-f6hxCVE-2026-16221 | High | fast-uri vulnerable to host confusion via literal backslash authority delimiter | 5 | 0 | no | 0.4% |
GHSA-xwg4-73v4-xw9wCVE-2026-73086 | High | nanoid: Integer Overflow or Wraparound | 5 | 0 | no | 0.3% |
GHSA-22p9-wv53-3rq4CVE-2026-48801 | High | LinkifyIt#match scan loop has quadratic algorithmic complexity | 4 | 0 | no | 0.4% |
GHSA-2m5v-pch6-74hxCVE-2026-109383 | High | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent | 4 | 0 | no | 0.2% |
GHSA-34x7-hfp2-rc4vCVE-2026-24842 | High | node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal | 4 | 0 | no | 0.6% |
GHSA-37ch-88jc-xwx2CVE-2026-4867 | High | path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters | 4 | 0 | no | 0.5% |
GHSA-537c-gmf6-5ccf | High | Vulnerable OpenSSL included in cryptography wheels | 4 | 0 | no | — |
GHSA-587h-7wmj-h5pmCVE-2026-112942 | High | launch-editor: `fs.existsSync()` existence check can be bypassed on Windows | 4 | 0 | no | 1.3% |
GHSA-5c6j-r48x-rmvq | High | Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString() | 4 | 0 | no | — |
GHSA-5x38-2vff-x55pCVE-2026-119190 | High | Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13 | 4 | 0 | no | 0.2% |
GHSA-6g55-p6wh-862qCVE-2026-45623 | High | PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments | 4 | 0 | no | 0.6% |
GHSA-7wch-p9px-956xCVE-2026-118779 | High | Forge: Regular expression denial of service in PEM decoding (pem.decode) | 4 | 0 | no | 0.6% |
GHSA-83g3-92jg-28cxCVE-2026-26960 | High | Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction | 4 | 0 | no | 0.3% |
GHSA-86w9-cpqp-85rvCVE-2026-85393 | High | node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements | 4 | 0 | no | 0.2% |
GHSA-8hrf-8g6f-7xwpCVE-2026-119188 | High | Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message | 4 | 0 | no | 0.4% |
GHSA-8qq5-rm4j-mr97CVE-2026-23745 | High | node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization | 4 | 0 | no | 0.4% |
GHSA-9ppj-qmqm-q256CVE-2026-31802 | High | node-tar Symlink Path Traversal via Drive-Relative Linkpath | 4 | 0 | no | 0.3% |
GHSA-g6cj-pr64-35w5CVE-2026-69247 | High | cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing | 4 | 0 | no | 0.3% |
GHSA-hmw2-7cc7-3qxxCVE-2026-12143 | High | form-data: CRLF injection in form-data via unescaped multipart field names and filenames | 4 | 0 | no | 0.7% |
GHSA-hqq3-7jhf-c5jxCVE-2026-119187 | High | Forge: Denial of service in TLS record processing via call stack exhaustion | 4 | 0 | no | 0.4% |
GHSA-jc66-7q78-782gCVE-2026-118782 | High | Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count | 4 | 0 | no | 0.1% |
GHSA-jwv3-5hgf-82wwCVE-2026-69249 | High | python-cryptography: Duplicate self-signed intermediates can cause exponential path-building | 4 | 0 | no | 0.3% |
GHSA-mrhx-c7xc-m3w5CVE-2023-54404 | High | Zod can exhaust memory while validating oversized constrained collections | 4 | 0 | no | — |
GHSA-qccp-gfcp-xxvcCVE-2026-44431 | High | urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | 4 | 0 | no | 0.3% |
GHSA-qffp-2rhf-9h96CVE-2026-29786 | High | tar has Hardlink Path Traversal via Drive-Relative Linkpath | 4 | 0 | no | 0.5% |
GHSA-qrxm-fqhp-jwvmCVE-2026-87018 | High | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation | 4 | 0 | no | 0.2% |
GHSA-r5fr-rjxr-66jcCVE-2026-4800 | High | lodash vulnerable to Code Injection via `_.template` imports key names | 4 | 0 | no | 2.8% |
GHSA-r6q2-hw4h-h46wCVE-2026-23950 | High | Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS | 4 | 0 | no | 0.3% |
GHSA-r7fv-28h4-cvq7CVE-2026-111759 | High | markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes | 4 | 0 | no | 0.6% |
GHSA-v245-v573-v5vmCVE-2026-59887 | High | linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text | 4 | 0 | no | 0.5% |
GHSA-vc2v-76pw-4v95CVE-2026-87776 | High | compression vulnerable to Denial of Service via memory leak on premature response close | 4 | 0 | no | 0.5% |
GHSA-25h7-pfq9-p65fCVE-2026-32141 | High | flatted vulnerable to unbounded recursion DoS in parse() revive phase | 3 | 0 | no | 0.8% |
GHSA-395f-4hp3-45gvCVE-2026-13311 | High | shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407) | 3 | 0 | no | 0.4% |
GHSA-3mfm-83xf-c92rCVE-2026-33938 | High | Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block | 3 | 0 | no | 0.7% |
GHSA-3pq3-5fj3-cg6vCVE-2026-101898 | High | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls | 3 | 0 | no | 0.5% |
GHSA-4528-x5fx-h6hgCVE-2026-118772 | High | joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service | 3 | 0 | no | 0.5% |
GHSA-4w7w-5xrc-9h26CVE-2026-109829 | High | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects | 3 | 0 | no | 0.1% |
GHSA-542g-h47m-68v8CVE-2026-101901 | High | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization | 3 | 0 | no | 0.5% |
GHSA-9cx6-37pm-9jffCVE-2026-33939 | High | Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation | 3 | 0 | no | 0.6% |
GHSA-9wv6-86v2-598jCVE-2024-45296 | High | path-to-regexp outputs backtracking regular expressions | 3 | 0 | no | 0.9% |
GHSA-c29m-xwm3-cm6rCVE-2026-101903 | High | Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS) | 3 | 0 | no | 0.4% |
GHSA-c2c7-rcm5-vvqjCVE-2026-33671 | High | Picomatch has a ReDoS vulnerability via extglob quantifiers | 3 | 0 | no | 0.4% |
GHSA-fph4-wmhf-6fwfCVE-2026-75899 | High | fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding | 3 | 0 | no | 0.2% |
GHSA-hfvc-g4fc-pqhxCVE-2026-39883 | High | opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking | 3 | 0 | no | 0.3% |
GHSA-m8m8-qj5v-23w3CVE-2026-101905 | High | Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection | 3 | 0 | no | 0.4% |
GHSA-mghh-pgcx-3jjjCVE-2026-101906 | High | Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location | 3 | 0 | no | 0.5% |
GHSA-mwp4-54f8-5fhrCVE-2026-69192 | High | ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass | 3 | 0 | no | 0.5% |
GHSA-p6mc-m468-83gwCVE-2020-8203 | High | Prototype Pollution in lodash | 3 | 0 | no | 5.2% |
GHSA-r4gj-5m52-g5whCVE-2026-101907 | High | Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF | 3 | 0 | no | 0.5% |
GHSA-rf6f-7fwh-wjghCVE-2026-33228 | High | Prototype Pollution via parse() in NodeJS flatted | 3 | 0 | no | 0.8% |
GHSA-v4x8-3wr5-3wq8CVE-2026-112940 | High | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwri | 3 | 0 | no | 0.2% |
GHSA-vj76-c3g6-qr5vCVE-2025-59343 | High | tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball | 3 | 0 | no | 0.6% |
GHSA-x8mw-p69m-v3mxCVE-2026-19481 | High | @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header | 3 | 0 | no | 0.5% |
GHSA-x97p-jq2g-jp4fCVE-2026-101909 | High | Axios: Prototype Pollution Gadget in axios toFormData Options | 3 | 0 | no | 0.5% |
GHSA-xhpv-hc6g-r9c6CVE-2026-33940 | High | Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial | 3 | 0 | no | 0.7% |
GHSA-xjj6-f33q-929cCVE-2026-109869 | High | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings | 3 | 0 | no | 0.3% |
GHSA-xjpj-3mr7-gcpfCVE-2026-33941 | High | Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options | 3 | 0 | no | 0.3% |
GHSA-22jm-h49p-29qwCVE-2026-111767 | High | MCP TypeScript SDK: Experimental tasks were not tied to the session that created them | 2 | 0 | no | 0.3% |
GHSA-2p49-hgcm-8545CVE-2026-73650 | High | SVGO removeScripts plugin leaves some executable scripts intact | 2 | 0 | no | 0.4% |
GHSA-2qm8-x737-gmw5CVE-2026-119196 | High | pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding | 2 | 0 | no | 0.4% |
GHSA-2xpw-w6gg-jr37CVE-2025-66471 | High | urllib3 streaming API improperly handles highly compressed data | 2 | 0 | no | 0.7% |
GHSA-35jh-r3h4-6jhmCVE-2021-23337 | High | Command Injection in lodash | 2 | 0 | no | 21.3% |
GHSA-38jv-5279-wg99CVE-2026-21441 | High | Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) | 2 | 0 | no | 2.9% |
GHSA-394h-qwmc-48pfCVE-2026-113718 | High | virtualenv: Xonsh activation literals depend on the script decoding codec | 2 | 0 | no | 0.2% |
GHSA-3g43-6gmg-66jwCVE-2026-44495 | High | axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge | 2 | 0 | no | 0.9% |
GHSA-3h5v-q93c-6h6qCVE-2024-37890 | High | ws affected by a DoS when handling a request with many HTTP headers | 2 | 0 | no | 1.4% |
GHSA-3rfm-jhwj-7488CVE-2022-37603 | High | loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) via url variable | 2 | 0 | no | 2.7% |
GHSA-44pw-h2cw-w3vqCVE-2022-29167 | High | Uncontrolled Resource Consumption in Hawk | 2 | 0 | no | 1.1% |
GHSA-45c3-73f7-pv4mCVE-2026-114605 | High | dnspython dns.name.from_wire_parser() excessive CPU use | 2 | 0 | no | 0.5% |
GHSA-46jr-4wx8-v453CVE-2026-111768 | High | MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation | 2 | 0 | no | — |
GHSA-4qx8-w7c3-pj3pCVE-2026-114141 | High | toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse() | 2 | 0 | no | 0.5% |
GHSA-4wf5-vphf-c2xcCVE-2022-25858 | High | Terser insecure use of regular expressions leads to ReDoS | 2 | 0 | no | 3.3% |
GHSA-4xc9-xhrj-v574CVE-2018-16487 | High | Prototype Pollution in lodash | 2 | 0 | no | 1.5% |
GHSA-5j98-mcp5-4vw2CVE-2025-64756 | High | glob CLI: Command injection via -c/--cmd executes matches with shell:true | 2 | 0 | no | 3.1% |
GHSA-5vjq-rrrf-7h2qCVE-2026-113726 | High | virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST | 2 | 0 | no | 0.3% |
GHSA-6chq-wfr3-2hj9CVE-2026-42035 | High | Axios: Header Injection via Prototype Pollution | 2 | 0 | no | 0.4% |
GHSA-6h2x-m376-mqjqCVE-2026-92599 | High | joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()` | 2 | 0 | no | 0.6% |
GHSA-6qxp-vccf-f47hCVE-2026-104850 | High | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server | 2 | 0 | no | 0.2% |
GHSA-6w3r-xr62-4xcpCVE-2026-113723 | High | virtualenv: Bash prompt values can change meaning under older compatibility modes | 2 | 0 | no | 0.2% |
GHSA-7pqw-9j4j-h8q3CVE-2026-19693 | High | extract-zip allows arbitrary file writes through symlink archive entries | 2 | 0 | no | 0.5% |
GHSA-7w5x-hrqm-74c2CVE-2026-85730 | High | smol-toml: Denial of Service via malformed TOML documents | 2 | 0 | no | 0.5% |
GHSA-869p-cjfg-cm3xCVE-2025-65945 | High | auth0/node-jws Improperly Verifies HMAC Signature | 2 | 0 | no | 0.2% |
GHSA-8cj5-5rvv-wf4vCVE-2025-48387 | High | tar-fs can extract outside the specified dir with a specific tarball | 2 | 0 | no | 0.6% |
GHSA-9c47-m6qq-7p4hCVE-2022-46175 | High | Prototype Pollution in JSON5 via Parse Method | 2 | 0 | no | 9.7% |
GHSA-9h8m-3fm2-qjrqCVE-2026-24051 | High | OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking | 2 | 0 | no | 0.2% |
GHSA-9j65-hcg3-gc64CVE-2026-114143 | High | toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse() | 2 | 0 | no | 0.5% |
GHSA-9m75-vc3g-4x39CVE-2026-119195 | High | pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding | 2 | 0 | no | 0.5% |
GHSA-9qmh-m7c6-f92pCVE-2026-114144 | High | toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse() | 2 | 0 | no | 0.4% |
GHSA-c429-5p7v-vgjpCVE-2020-36604 | High | hoek subject to prototype pollution via the clone function. | 2 | 0 | no | 1.2% |
GHSA-c947-3pg5-gm8qCVE-2026-113732 | High | virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote | 2 | 0 | no | 0.2% |
GHSA-c978-59m8-c77vCVE-2026-113722 | High | virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax | 2 | 0 | no | 0.3% |
GHSA-cv23-7vc5-jfh7CVE-2026-102941 | High | gomarkdown/markdown IsSafeURL panics on short URLs | 2 | 0 | no | 0.3% |
GHSA-f897-62hf-6gxq | High | MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length | 2 | 0 | no | — |
GHSA-f8q6-p94x-37v3CVE-2022-3517 | High | minimatch ReDoS vulnerability | 2 | 0 | no | 2.3% |
GHSA-fm9c-5rcf-2q5pCVE-2026-119194 | High | pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding | 2 | 0 | no | 0.4% |
GHSA-g84c-rxfj-3j2cCVE-2026-76844 | High | webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath | 2 | 0 | no | 0.6% |
GHSA-gfr2-rv44-r23cCVE-2026-111758 | High | markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) | 2 | 0 | no | 0.5% |
GHSA-gm37-52c6-37mwCVE-2026-67422 | High | pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors | 2 | 0 | no | 0.6% |
GHSA-gm62-xv2j-4w53CVE-2025-66418 | High | urllib3 allows an unbounded number of links in the decompression chain | 2 | 0 | no | 0.7% |
GHSA-grv7-fg5c-xmjgCVE-2024-4068 | High | Uncontrolled resource consumption in braces | 2 | 0 | no | 1.5% |
GHSA-hfxv-24rg-xrqfCVE-2026-44496 | High | Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection | 2 | 0 | no | 5.4% |
GHSA-hhq3-ff78-jv3gCVE-2022-37599 | High | loader-utils is vulnerable to Regular Expression Denial of Service (ReDoS) | 2 | 0 | no | 2.8% |
GHSA-hrpp-h998-j3ppCVE-2022-24999 | High | qs vulnerable to Prototype Pollution | 2 | 0 | no | 15.7% |
GHSA-j5f8-grm9-p9fcCVE-2026-44486 | High | Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection | 2 | 0 | no | 0.6% |
GHSA-jmr9-qjv8-65gvCVE-2026-56876 | High | extract-zip unvalidated symlink path traversal | 2 | 0 | no | 0.5% |
GHSA-mf9v-mfxr-j63jCVE-2026-44432 | High | urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | 2 | 0 | no | 0.7% |
GHSA-mm57-4v3p-rchxCVE-2026-119197 | High | pyasn1 has quadratic-complexity denial of service in binary REAL decoding | 2 | 0 | no | 0.4% |
GHSA-mrv2-3pqr-j5jr | High | DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-9 | 2 | 0 | no | — |
GHSA-p92q-9vqr-4j8vCVE-2026-44487 | High | Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter | 2 | 0 | no | 0.7% |
GHSA-pf86-5x62-jrwfCVE-2026-42033 | High | Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking | 2 | 0 | no | 0.9% |
GHSA-ph9p-34f9-6g65CVE-2026-44705 | High | tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape | 2 | 0 | no | 0.4% |
GHSA-pjwm-pj3p-43mvCVE-2026-44492 | High | axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718) | 2 | 0 | no | 12.3% |
GHSA-pmwg-cvhr-8vh7CVE-2026-42043 | High | Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 | 2 | 0 | no | 0.7% |
GHSA-pq67-2wwv-3xjxCVE-2024-12905 | High | tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File | 2 | 0 | no | 2.3% |
GHSA-px85-f4q5-jh77CVE-2026-114126 | High | Storybook dev server vulnerable to code injection from the local network | 2 | 0 | no | 0.5% |
GHSA-q3j6-qgpj-74h6CVE-2026-6321 | High | fast-uri vulnerable to path traversal via percent-encoded dot segments | 2 | 0 | no | 0.6% |
GHSA-qpx9-hpmf-5gmwCVE-2026-27601 | High | Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack | 2 | 0 | no | 1.1% |
GHSA-qr28-fpjm-wq7fCVE-2026-118664 | High | decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs | 2 | 0 | no | 0.3% |
GHSA-qwcr-r2fm-qrc7CVE-2024-45590 | High | body-parser vulnerable to denial of service when url encoding is enabled | 2 | 0 | no | 0.8% |
GHSA-rfgv-xxqx-mfg5CVE-2026-19534 | High | undici vulnerable to Denial of Service via unrequested WebSocket subprotocol | 2 | 0 | no | 0.4% |
GHSA-rhx6-c78j-4q9wCVE-2024-52798 | High | path-to-regexp contains a ReDoS | 2 | 0 | no | 0.8% |
GHSA-v39h-62p7-jpjcCVE-2026-6322 | High | fast-uri vulnerable to host confusion via percent-encoded authority delimiters | 2 | 0 | no | 0.5% |
GHSA-vxj4-q4g9-crj7CVE-2026-113725 | High | virtualenv bash activate runs commands from an environment name with a backslash before $ | 2 | 0 | no | 0.3% |
GHSA-w27v-7q3p-w38rCVE-2026-84370 | High | SVGO: removeScripts allows executable links through namespace and control-character bypasses | 2 | 0 | no | 0.5% |
GHSA-w293-vg96-wgc3CVE-2026-84961 | High | undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool | 2 | 0 | no | 0.2% |
GHSA-w4pp-8pjf-rmxwCVE-2026-9496 | High | pacote is vulnerable to Denial of Service (DoS) via the addGitSha function | 2 | 0 | no | 0.3% |
GHSA-w573-4hg7-7wgqCVE-2022-38900 | High | decode-uri-component vulnerable to Denial of Service (DoS) | 2 | 0 | no | 23.6% |
GHSA-wcpc-wj8m-hjx6CVE-2026-48712 | High | protobufjs: Denial of service through unbounded Any expansion during JSON conversion | 2 | 0 | no | 0.5% |
GHSA-xjh9-v7x6-24jwCVE-2026-19484 | High | @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary | 2 | 0 | no | 0.6% |
GHSA-239g-whfq-7xj9CVE-2026-87817 | High | GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution | 1 | 0 | no | 0.4% |
GHSA-23mf-xhv8-69c2 | High | GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679) | 1 | 0 | no | — |
GHSA-23vg-4cjm-66q5CVE-2026-100351 | High | kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion | 1 | 0 | no | 0.5% |
GHSA-267c-6grr-h53fCVE-2026-44575 | High | Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes | 1 | 0 | no | 1.6% |
GHSA-26hh-7cqf-hhc6CVE-2026-45109 | High | Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up | 1 | 0 | no | 0.6% |
GHSA-27gv-rfvv-22mvCVE-2026-77407 | High | RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields | 1 | 0 | no | 0.1% |
GHSA-27p8-2357-5qqvCVE-2026-83608 | High | xmldom: DocType `name` Injection Bypasses requireWellFormed | 1 | 0 | no | 0.6% |
GHSA-2f96-g7mh-g2hxCVE-2026-67325 | High | GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist | 1 | 0 | no | 2.2% |
GHSA-2g87-pp6c-29x5 | High | aiohttp: Multiple instances of excessive or unbounded memory/CPU use | 1 | 0 | no | — |
GHSA-2gc4-cqfq-p2gvCVE-2026-102599 | High | Socket.IO: Engine.IO Protocol Revision Mismatch DoS | 1 | 0 | no | 0.6% |
GHSA-2j4c-ffch-9f23CVE-2026-107214 | High | Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks | 1 | 0 | no | 0.2% |
GHSA-2m8v-j782-fhvrCVE-2026-69185 | High | Socket.IO: Zero-attachment Memory Exhaustion | 1 | 0 | no | 0.6% |
GHSA-2p57-rm9w-gvfpCVE-2024-29415 | High | ip SSRF improper categorization in isPublic | 1 | 0 | no | 8.3% |
GHSA-2v35-w6hq-6mfwCVE-2026-41673 | High | xmldom: Uncontrolled recursion in XML serialization leads to DoS | 1 | 0 | no | 0.6% |
GHSA-2wc2-fm75-p42xCVE-2026-49476 | High | Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists | 1 | 0 | no | 0.6% |
GHSA-35jp-ww65-95whCVE-2026-44494 | High | axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy` | 1 | 0 | no | 1.1% |
GHSA-3633-r77q-h3v3CVE-2026-116588 | High | Datadog dd-trace-py: ReDoS in URL query string obfuscation | 1 | 0 | no | 0.5% |
GHSA-36qx-fr4f-26g5CVE-2026-44573 | High | Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n | 1 | 0 | no | 0.8% |
GHSA-375p-5qhx-8wq4CVE-2026-118650 | High | Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path | 1 | 0 | no | 0.4% |
GHSA-389r-gv7p-r3rpCVE-2026-45022 | High | go-git's improper parsing of specially crafted objects may lead to inconsistent interpretation compared to upstream Git | 1 | 0 | no | 0.2% |
GHSA-3f7w-8rr8-f37f | High | GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary | 1 | 0 | no | — |
GHSA-3jfq-g458-7qm9CVE-2021-32804 | High | Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization | 1 | 0 | no | 15.1% |
GHSA-3rp5-jjmw-4wv2CVE-2026-69097 | High | GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE) | 1 | 0 | no | 0.3% |
GHSA-43fc-jf86-j433CVE-2026-25639 | High | Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig | 1 | 0 | no | 2.8% |
GHSA-45rx-2jwx-cxfrCVE-2026-59892 | High | OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header | 1 | 0 | no | 0.6% |
GHSA-465g-fh3v-9jw4CVE-2026-77404 | High | RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection | 1 | 0 | no | 0.1% |
GHSA-492v-c6pp-mqqvCVE-2026-44574 | High | Next.js has a Middleware / Proxy bypass through dynamic route parameter injection | 1 | 0 | no | 0.6% |
GHSA-4gmw-gg2m-w46pCVE-2026-76219 | High | GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite | 1 | 0 | no | 0.5% |
GHSA-4jqc-8m5r-9rprCVE-2021-23440 | High | Prototype Pollution in set-value | 1 | 0 | no | 2.2% |
GHSA-4q6p-r6v2-jvc5CVE-2023-43646 | High | Chaijs/get-func-name vulnerable to ReDoS | 1 | 0 | no | 1.4% |
GHSA-4v58-74mf-rjx3CVE-2026-77412 | High | RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client | 1 | 0 | no | 0.5% |
GHSA-4w2j-m93h-cj5j | High | Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly | 1 | 0 | no | — |
GHSA-4w3w-2rp5-g8jmCVE-2026-83605 | High | xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed | 1 | 0 | no | 0.6% |
GHSA-52v5-jr5w-gjxrCVE-2026-48815 | High | sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced | 1 | 0 | no | 0.2% |
GHSA-532v-xpq5-8h95CVE-2026-34774 | High | Electron: Use-after-free in offscreen child window paint callback | 1 | 0 | no | 0.5% |
GHSA-5375-pq7m-f5r2CVE-2026-48068 | High | @grpc/grpc-js: A malformed request can cause a server crash | 1 | 0 | no | 0.9% |
GHSA-5588-rp99-5fjhCVE-2026-113729 | High | Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalization | 1 | 0 | no | 0.5% |
GHSA-58mr-gqgx-xq4gCVE-2026-84394 | High | fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority | 1 | 0 | no | 0.4% |
GHSA-5955-9wpr-37jhCVE-2021-37713 | High | Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization | 1 | 0 | no | 1.3% |
GHSA-5rvq-cxj2-64vfCVE-2026-53539 | High | python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service | 1 | 0 | no | 0.5% |
GHSA-5wr8-gcqf-gqf3CVE-2026-111064 | High | aiohttp server lacks an initial request/header timeout | 1 | 0 | no | 0.4% |
GHSA-667r-xxjv-c9mmCVE-2026-84504 | High | fastify vulnerable to request body replacement via an async validation result collision | 1 | 0 | no | 0.4% |
GHSA-66ff-xgx4-vchmCVE-2026-44293 | High | protobuf.js: Code injection through bytes field defaults in generated toObject code | 1 | 0 | no | 0.4% |
GHSA-677m-j7p3-52f9CVE-2026-33151 | High | socket.io allows an unbounded number of binary attachments | 1 | 0 | no | 0.5% |
GHSA-685m-2w69-288qCVE-2026-44289 | High | protobuf.js: Denial of service through unbounded protobuf recursion | 1 | 0 | no | 0.6% |
GHSA-6c5v-hqjr-5xxpCVE-2026-79921 | High | amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload | 1 | 0 | no | 0.5% |
GHSA-6c8f-qphg-qjgpCVE-2019-20149 | High | Validation Bypass in kind-of | 1 | 0 | no | 2.3% |
GHSA-6gpp-xcg3-4w24CVE-2026-64642 | High | Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale | 1 | 0 | no | 0.6% |
GHSA-6p8h-3wgx-97gf | High | GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks | 1 | 0 | no | — |
GHSA-6xwr-q98w-rvg7CVE-2022-21803 | High | Prototype Pollution in nconf | 1 | 0 | no | 1.8% |
GHSA-74vm-87hj-r66fCVE-2026-100349 | High | kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content | 1 | 0 | no | 0.5% |
GHSA-7545-fcxq-7j24CVE-2026-44243 | High | GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository | 1 | 0 | no | 0.4% |
GHSA-75px-5xx7-5xc7CVE-2026-44291 | High | protobuf.js: Code generation gadget after prototype pollution | 1 | 0 | no | 0.5% |
GHSA-777c-7fjr-54vfCVE-2026-44488 | High | Allocation of Resources Without Limits or Throttling in Axios | 1 | 0 | no | 0.7% |
GHSA-7833-fr7j-v32qCVE-2026-78675 | High | GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables me | 1 | 0 | no | 0.2% |
GHSA-7gcm-g887-7qv7CVE-2026-0994 | High | protobuf affected by a JSON recursion depth bypass | 1 | 0 | no | 0.7% |
GHSA-7p7h-4mm5-852vCVE-2021-33623 | High | Uncontrolled Resource Consumption in trim-newlines | 1 | 0 | no | 2.9% |
GHSA-7q85-xj36-vmfcCVE-2026-77301 | High | adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS) | 1 | 0 | no | 0.6% |
GHSA-7r28-3m3f-r2prCVE-2021-28092 | High | Regular Expression Denial of Service (ReDoS) | 1 | 0 | no | 2.0% |
GHSA-8238-w5pm-2374 | High | adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS) | 1 | 0 | no | — |
GHSA-82w8-qh3p-5jfqCVE-2026-54283 | High | Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS | 1 | 0 | no | 0.5% |
GHSA-82x6-q7mm-w9cfCVE-2026-77465 | High | toml-node: Uncontrolled Recursion | 1 | 0 | no | 0.6% |
GHSA-8337-3p73-46f4CVE-2026-34771 | High | Electron: Use-after-free in WebContents fullscreen, pointer-lock, and keyboard-lock permission callbacks | 1 | 0 | no | 0.3% |
GHSA-8344-3jmq-59r6CVE-2026-83613 | High | xmldom: Quadratic-time attribute deduplication | 1 | 0 | no | 0.6% |
GHSA-836r-79rf-4m37CVE-2026-49477 | High | Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser | 1 | 0 | no | 0.6% |
GHSA-83vg-56qc-22m7CVE-2026-114145 | High | GitPython validates a submodule's ".git" path only after cloning into it (RCE) | 1 | 0 | no | 0.4% |
GHSA-83w8-p2f5-377rCVE-2026-15074 | High | @fastify/static vulnerable to route guard bypass via path traversal | 1 | 0 | no | 0.7% |
GHSA-858h-whjf-mvg5CVE-2026-102827 | High | simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026- | 1 | 0 | no | 0.6% |
GHSA-86vw-mfpg-wwv9CVE-2026-52746 | High | jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion | 1 | 0 | no | 0.7% |
GHSA-88fw-hqm2-52qcCVE-2026-54290 | High | hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcard | 1 | 0 | no | 0.3% |
GHSA-89xv-2m56-2m9xCVE-2026-64649 | High | Next.js: Server-Side Request Forgery in Server Actions on custom servers | 1 | 0 | no | 0.5% |
GHSA-8cf7-32gw-wr33CVE-2022-23539 | High | jsonwebtoken unrestricted key type could lead to legacy keys usage | 1 | 0 | no | 0.5% |
GHSA-8g77-54rh-46hxCVE-2025-25975 | High | Prototype Pollution Vulnerability in parse-git-config | 1 | 0 | no | 0.5% |
GHSA-8gc5-j5rx-235rCVE-2026-33036 | High | fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) | 1 | 0 | no | 0.6% |
GHSA-8gh8-hqwg-xf34CVE-2021-4279 | High | Starcounter-Jack JSON-Patch Prototype Pollution vulnerability | 1 | 0 | no | 1.2% |
GHSA-8h8q-6873-q5fj | High | Next.js Vulnerable to Denial of Service with Server Components | 1 | 0 | no | — |
GHSA-8hfj-j24r-96c4CVE-2022-24785 | High | Path Traversal: 'dir/../../filename' in moment.locale | 1 | 0 | no | 13.8% |
GHSA-8j8c-7jfh-h6hx | High | Code Injection in js-yaml | 1 | 0 | no | — |
GHSA-8mcc-hrx5-hvxcCVE-2026-78677 | High | GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the | 1 | 0 | no | 0.7% |
GHSA-8qff-qr5q-5pr8CVE-2025-47934 | High | OpenPGP.js's message signature verification can be spoofed | 1 | 0 | no | 0.6% |
GHSA-8rjx-v5ww-45ppCVE-2026-113776 | High | virtualenv activation scripts run code from a path that contains a placeholder name | 1 | 0 | no | 0.3% |
GHSA-8rvj-mm4h-c258CVE-2026-62290 | High | cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials | 1 | 0 | no | 0.1% |
GHSA-92mm-2pjq-r785CVE-2026-4660 | High | HashiCorp's go-getter library may allow arbitrary file reads | 1 | 0 | no | 0.6% |
GHSA-93q8-gq69-wqmwCVE-2021-3807 | High | Inefficient Regular Expression Complexity in chalk/ansi-regex | 1 | 0 | no | 3.6% |
GHSA-94p4-4cq8-9g67 | High | GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573) | 1 | 0 | no | — |
GHSA-94p9-xgh2-xp45CVE-2026-102930 | High | virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use | 1 | 0 | no | 0.2% |
GHSA-956x-8gvw-wg5vCVE-2026-67323 | High | GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_c | 1 | 0 | no | 1.3% |
GHSA-965w-775f-mr7gCVE-2026-83615 | High | xmldom: Quadratic-memory consumption | 1 | 0 | no | 0.6% |
GHSA-9969-6676-49h5CVE-2026-118262 | High | Echo: WebSocket proxy can retain connections and handlers after client disconnect | 1 | 0 | no | 0.3% |
GHSA-99f4-grh7-6pcqCVE-2026-48069 | High | @grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash | 1 | 0 | no | 0.9% |
GHSA-9f4c-93c8-jc8gCVE-2026-70608 | High | Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path | 1 | 0 | no | 0.4% |
GHSA-9j54-fg26-wv3rCVE-2026-102266 | High | PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation | 1 | 0 | no | 0.2% |
GHSA-9q9j-q6p8-xq58CVE-2026-84428 | High | fastify vulnerable to header validation bypass via incomplete schema case normalization | 1 | 0 | no | 0.5% |
GHSA-9qh4-3jw8-366wCVE-2026-102676 | High | Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions | 1 | 0 | no | 0.5% |
GHSA-9r2w-394v-53qcCVE-2021-37701 | High | Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links | 1 | 0 | no | 3.3% |
GHSA-9rj7-rf2p-w77rCVE-2026-76218 | High | GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks | 1 | 0 | no | 0.7% |
GHSA-9v7f-9g4p-ffgjCVE-2026-102267 | High | PyJWT: PyJWKClient follows redirects when fetching JWKS | 1 | 0 | no | 0.2% |
GHSA-9wfr-w7mm-pc7fCVE-2026-34769 | High | Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference | 1 | 0 | no | 0.3% |
GHSA-9xw5-w5jj-pvcgCVE-2026-111066 | High | AIOHTTP: File descriptor exhaustion in multipart requests | 1 | 0 | no | 0.4% |
GHSA-c4j6-fc7j-m34rCVE-2026-44578 | High | Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades | 1 | 0 | no | 35.5% |
GHSA-c4w7-xm78-47vhCVE-2020-7774 | High | Prototype Pollution in y18n | 1 | 0 | no | 69.6% |
GHSA-c7q8-3ch8-vqpvCVE-2026-83616 | High | xmldom: Processing Instruction Target Injection Bypasses requireWellFormed | 1 | 0 | no | 0.6% |
GHSA-c85p-xxjj-2r75CVE-2026-107217 | High | Excelize ColumnNameToNumber: int64 overflow yields an out-of-domain coordinate with nil error, causing negative slice index panic on r="0" r | 1 | 0 | no | 0.4% |
GHSA-c9f4-xj24-8jqxCVE-2015-8858 | High | Regular Expression Denial of Service in uglify-js | 1 | 0 | no | 2.4% |
GHSA-cg8m-r9f2-5wm2CVE-2026-114134 | High | Black: GitHub Action installs unvalidated required-version from pyproject.toml | 1 | 0 | no | — |
GHSA-cgrx-mc8f-2prmCVE-2025-52881 | High | runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects | 1 | 0 | no | 0.8% |
GHSA-cjq9-62q9-8jv4CVE-2026-94483 | High | Next.js has Server-Side Request Forgery in Image Optimization | 1 | 0 | no | 0.3% |
GHSA-cq5v-8q36-5273CVE-2026-69244 | High | AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) | 1 | 0 | no | 0.5% |
GHSA-cx6f-vjhg-g3ccCVE-2026-115586 | High | virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regress | 1 | 0 | no | 0.3% |
GHSA-f48p-c9v4-h7xvCVE-2026-118260 | High | Echo: BodyDump captures request and response bodies without size limits in v4 | 1 | 0 | no | 0.4% |
GHSA-f5mr-q85p-6hh6CVE-2026-49478 | High | Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token | 1 | 0 | no | 0.3% |
GHSA-f6ww-3ggp-fr8hCVE-2026-41674 | High | xmldom has XML injection through unvalidated DocumentType serialization | 1 | 0 | no | 0.6% |
GHSA-f83f-xpx7-ffpwCVE-2025-66506 | High | Fulcio allocates excessive memory during token parsing | 1 | 0 | no | 0.2% |
GHSA-f88m-g3jw-g9cj | High | sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 | 1 | 0 | no | — |
GHSA-f9j4-qggq-h239 | High | GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution | 1 | 0 | no | — |
GHSA-fjr4-x663-mwxc | High | GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled) | 1 | 0 | no | — |
GHSA-fq3v-74gv-27gmCVE-2026-107223 | High | Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hang | 1 | 0 | no | 0.4% |
GHSA-fv7c-fp4j-7gwpCVE-2026-44728 | High | @babel/plugin-transform-modules-systemjs generates arbitrary code when compiling malicious input | 1 | 0 | no | 0.1% |
GHSA-fwr7-v2mv-hh25CVE-2021-43138 | High | Prototype Pollution in async | 1 | 0 | no | 3.3% |
GHSA-g2v6-rqmx-r4w6 | High | @vue/server-renderer: XSS via missing CR in attribute-name blacklist | 1 | 0 | no | — |
GHSA-g4wm-2vf7-vfgrCVE-2026-102826 | High | simple-git allows command execution through unblocked Git configuration includes | 1 | 0 | no | 0.5% |
GHSA-g5vv-9gxw-82hxCVE-2026-87819 | High | GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing | 1 | 0 | no | 0.5% |
GHSA-g6ww-v8xp-vmwgCVE-2020-7751 | High | Prototype pollution in pathval | 1 | 0 | no | 1.5% |
GHSA-g8cf-rcjf-c8cfCVE-2026-100354 | High | kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash | 1 | 0 | no | 0.4% |
GHSA-gcfj-64vw-6mp9CVE-2026-67320 | High | Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning | 1 | 0 | no | 0.5% |
GHSA-gcx4-mw62-g8wmCVE-2024-47068 | High | DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS | 1 | 0 | no | 0.7% |
GHSA-gr2m-v5gq-v685CVE-2026-102674 | High | Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions | 1 | 0 | no | 0.2% |
GHSA-h7rp-cf8h-j98xCVE-2026-70601 | High | Electron: Context isolation bypass via Function.prototype.bind hijack | 1 | 0 | no | 0.3% |
GHSA-h7wr-284f-5qvcCVE-2026-118261 | High | Echo: Decompress permits unbounded gzip expansion in v4 | 1 | 0 | no | 0.4% |
GHSA-h9jc-284h-533gCVE-2020-4077 | High | Context isolation bypass via contextBridge in Electron | 1 | 0 | no | 1.0% |
GHSA-hcg3-q754-cr77CVE-2025-22869 | High | golang.org/x/crypto Vulnerable to Denial of Service (DoS) via Slow or Incomplete Key Exchange | 1 | 0 | no | 0.9% |
GHSA-hffm-xvc3-vprcCVE-2026-6951 | High | simple-git is vulnerable to Remote Code Execution | 1 | 0 | no | 0.9% |
GHSA-hfg8-hc9c-6c3hCVE-2026-17106 | High | moby/go-archive: Crafted tar archive can write outside the extraction directory | 1 | 0 | no | 0.4% |
GHSA-hmq2-w58f-27jcCVE-2026-76222 | High | GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython | 1 | 0 | no | 0.4% |
GHSA-hq2x-r82h-9wj4CVE-2026-102673 | High | Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab | 1 | 0 | no | 0.1% |
GHSA-hwr6-493r-vm6hCVE-2026-84469 | High | fastify vulnerable to request validation bypass via skipped boolean false schemas | 1 | 0 | no | 0.5% |
GHSA-hx9q-6w63-j58vCVE-2025-67221 | High | orjson does not limit recursion for deeply nested JSON documents | 1 | 0 | no | 0.6% |
GHSA-hxm2-r34f-qmc5CVE-2016-10540 | High | Regular Expression Denial of Service in minimatch | 1 | 0 | no | 1.5% |
GHSA-j5f4-cc29-5x44CVE-2026-102282 | High | adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation | 1 | 0 | no | 0.2% |
GHSA-j759-j44w-7fr8CVE-2026-41672 | High | xmldom has XML node injection through unvalidated comment serialization | 1 | 0 | no | 0.5% |
GHSA-j84w-jfhq-vhvjCVE-2026-102675 | High | Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled | 1 | 0 | no | 0.2% |
GHSA-jcxm-m3jx-f287CVE-2026-28291 | High | simple-git Affected by Command Execution via Option-Parsing Bypass | 1 | 0 | no | 0.8% |
GHSA-jjp3-mq3x-295mCVE-2026-34770 | High | Electron: Use-after-free in PowerMonitor on Windows and macOS | 1 | 0 | no | 0.2% |
GHSA-jm78-9fvv-mhgr | High | GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE) | 1 | 0 | no | — |
GHSA-jmr7-xgp7-cmfjCVE-2026-26278 | High | fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) | 1 | 0 | no | 0.9% |
GHSA-jp4x-w63m-7wgmCVE-2018-3728 | High | Prototype Pollution in hoek | 1 | 0 | no | 4.2% |
GHSA-jpxq-7h8p-2q76CVE-2026-119283 | High | joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption | 1 | 0 | no | 0.2% |
GHSA-jqcq-xjh3-6g23CVE-2026-32286 | High | Denial of service in github.com/jackc/pgproto3/v2 | 1 | 0 | no | 0.7% |
GHSA-jr5f-v2jv-69x6CVE-2025-27152 | High | axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL | 1 | 0 | no | 0.8% |
GHSA-jr5w-w6x2-84p9CVE-2026-115570 | High | Electron: Mitigation for compromised eMudhra intermediate certificates | 1 | 0 | no | 0.4% |
GHSA-jrfj-fhj2-jjvmCVE-2026-107219 | High | Excelize: Unbounded spinCount in agile decryption burns CPU during OpenFile | 1 | 0 | no | 0.4% |
GHSA-jvwf-75h9-cwggCVE-2026-44290 | High | protobuf.js: Process-wide denial of service through unsafe option paths | 1 | 0 | no | 0.4% |
GHSA-jw42-f3rr-4cc3CVE-2026-107212 | High | Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days | 1 | 0 | no | 0.4% |
GHSA-m64x-33q8-m5h7 | High | GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines | 1 | 0 | no | — |
GHSA-m93v-9qjc-3g79CVE-2020-4076 | High | Context isolation bypass via leaked cross-context objects in Electron | 1 | 0 | no | 0.4% |
GHSA-m99w-x7hq-7vfjCVE-2026-64641 | High | Next.js: Denial of Service in App Router using Server Actions | 1 | 0 | no | 0.9% |
GHSA-m9gg-hp2v-232jCVE-2026-101916 | High | @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized | 1 | 0 | no | 0.2% |
GHSA-mg66-mrh9-m8jxCVE-2026-44579 | High | Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components | 1 | 0 | no | 0.7% |
GHSA-mv93-w799-cj2w | High | GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath | 1 | 0 | no | — |
GHSA-mw54-j2v2-42hrCVE-2026-50271 | High | dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS | 1 | 0 | no | 0.8% |
GHSA-mw96-cpmx-2vgcCVE-2026-27606 | High | Rollup 4 has Arbitrary File Write via Path Traversal | 1 | 0 | no | 1.7% |
GHSA-mx22-3794-2vpvCVE-2026-107211 | High | Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic | 1 | 0 | no | 0.2% |
GHSA-p3m5-59mp-jv5rCVE-2026-94482 | High | Next.js: Denial of Service in App Router using Server Actions | 1 | 0 | no | 0.4% |
GHSA-p3m5-h5v9-vqj6CVE-2026-116589 | High | Datadog dd-trace-py: IAST instrumentation can lead to application DOS | 1 | 0 | no | 0.3% |
GHSA-p4g4-x82p-q773CVE-2026-102271 | High | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard | 1 | 0 | no | 0.2% |
GHSA-p58f-9548-mpm2CVE-2026-102925 | High | virtualenv bash and fish activation scripts execute commands embedded in paths | 1 | 0 | no | 0.2% |
GHSA-p68q-wchp-6fh7CVE-2026-76169 | High | fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers | 1 | 0 | no | 0.5% |
GHSA-p9j2-gv94-2wf4CVE-2026-64645 | High | Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname | 1 | 0 | no | 0.4% |
GHSA-pp6c-gr5w-3c5gCVE-2026-42561 | High | python-multipart has Denial of Service via unbounded multipart part headers | 1 | 0 | no | 0.7% |
GHSA-pxh4-856f-4h89 | High | PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery | 1 | 0 | no | — |
GHSA-q4gf-8mx6-v5v3 | High | Next.js has a Denial of Service with Server Components | 1 | 0 | no | — |
GHSA-q8qp-cvcw-x6jjCVE-2026-42264 | High | Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking | 1 | 0 | no | 0.8% |
GHSA-qq89-hq3f-393pCVE-2021-37712 | High | Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links | 1 | 0 | no | 1.9% |
GHSA-qw64-3x98-g7q2CVE-2026-44973 | High | go-billy has path traversal vulnerabilities | 1 | 0 | no | 0.3% |
GHSA-r628-mhmh-qjhwCVE-2021-32803 | High | Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning | 1 | 0 | no | 7.8% |
GHSA-r683-j2x4-v87gCVE-2022-0235 | High | node-fetch forwards secure headers to untrusted sites | 1 | 0 | no | 1.7% |
GHSA-r6ph-v2qm-q3c2CVE-2026-26007 | High | cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves | 1 | 0 | no | 0.4% |
GHSA-r6x4-923q-g947CVE-2026-102272 | High | PyJWT BOM Bypass | 1 | 0 | no | 0.2% |
GHSA-r7x5-4969-99p7CVE-2026-107213 | High | Excelize: Nil-pointer dereference in GetSlicers when a worksheet has extLst present but no drawing element | 1 | 0 | no | 0.2% |
GHSA-r8j5-h5cx-65ggCVE-2021-29059 | High | ReDOS in IS-SVG | 1 | 0 | no | 2.6% |
GHSA-r9c8-gcjp-xfwhCVE-2026-77410 | High | RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation | 1 | 0 | no | 0.5% |
GHSA-r9mr-m37c-5fr3 | High | GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution | 1 | 0 | no | — |
GHSA-rc47-6667-2j5jCVE-2022-25881 | High | http-cache-semantics vulnerable to Regular Expression Denial of Service | 1 | 0 | no | 1.6% |
GHSA-rcw4-f5rp-g42v | High | adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0 | 1 | 0 | no | — |
GHSA-rgj7-g3m4-5g8c | High | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 | 1 | 0 | no | — |
GHSA-rj39-cv6w-8wv7CVE-2026-100352 | High | kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path | 1 | 0 | no | 0.6% |
GHSA-rm6m-hrcw-jw33CVE-2026-77406 | High | RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration | 1 | 0 | no | 0.5% |
GHSA-rp65-9cf3-cjxrCVE-2021-3803 | High | Inefficient Regular Expression Complexity in nth-check | 1 | 0 | no | 2.2% |
GHSA-rpm5-65cw-6hj4CVE-2026-42215 | High | GitPython has Command Injection via Git options bypass | 1 | 0 | no | 0.7% |
GHSA-rqc4-2hc7-8c8vCVE-2024-53899 | High | virtualenv allows command injection through activation scripts for a virtual environment | 1 | 0 | no | 1.6% |
GHSA-rrc9-gqf8-8rwgCVE-2020-28472 | High | Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader | 1 | 0 | no | 2.2% |
GHSA-rwj8-pgh3-r573CVE-2026-67322 | High | GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL | 1 | 0 | no | 0.3% |
GHSA-v3j7-r9gq-3gjwCVE-2026-70604 | High | Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads | 1 | 0 | no | 0.4% |
GHSA-v5mp-jgw5-2x6jCVE-2026-63376 | High | toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization | 1 | 0 | no | 0.7% |
GHSA-v87r-6q3f-2j67CVE-2026-44244 | High | GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath | 1 | 0 | no | 0.2% |
GHSA-v9p9-hfj2-hcw8CVE-2026-2229 | High | Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation | 1 | 0 | no | 0.9% |
GHSA-vrcc-3ch7-hppwCVE-2026-100353 | High | kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter | 1 | 0 | no | 0.3% |
GHSA-vrm6-8vpv-qv8qCVE-2026-1526 | High | Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression | 1 | 0 | no | 1.2% |
GHSA-vxpw-j846-p89qCVE-2026-12151 | High | undici WebSocket client vulnerable to denial of service via fragment count bypass | 1 | 0 | no | 0.8% |
GHSA-w2cx-738m-mc7wCVE-2026-102273 | High | PyJWT accepts public JWK containers as HMAC secrets | 1 | 0 | no | 0.2% |
GHSA-w2rr-34g9-rvrjCVE-2026-83607 | High | xmldom: Element name injection via createElement() bypasses requireWellFormed | 1 | 0 | no | 0.6% |
GHSA-w3rx-r6r6-pgprCVE-2025-71330 | High | image-size: ICNS parser allows denial of service through an infinite loop | 1 | 0 | no | 0.4% |
GHSA-w3vv-58gj-gw77CVE-2026-104854 | High | Nx daemon and plugin worker sockets are accessible to other local users | 1 | 0 | no | 0.1% |
GHSA-w5p7-h5w8-2hfqCVE-2020-7753 | High | Regular Expression Denial of Service in trim | 1 | 0 | no | 3.8% |
GHSA-w8jc-g24h-crhw | High | GitPython command wrappers omit unsafe protocol and option checks | 1 | 0 | no | — |
GHSA-wc69-rhjr-hc9gCVE-2022-31129 | High | Moment.js vulnerable to Inefficient Regular Expression Complexity | 1 | 0 | no | 5.6% |
GHSA-wh4c-j3r5-mjhpCVE-2026-34601 | High | xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion | 1 | 0 | no | 0.5% |
GHSA-whgm-jr23-g3j9CVE-2021-23424 | High | Uncontrolled Resource Consumption in ansi-html | 1 | 0 | no | 1.8% |
GHSA-wj6h-64fc-37mpCVE-2024-23342 | High | Minerva timing attack on P-256 in python-ecdsa | 1 | 0 | no | 1.0% |
GHSA-wp2g-vpjj-g53rCVE-2026-107216 | High | Excelize ANCHORARRAY: mutually-referencing array formulas recurse unboundedly via re-entrant CalcCellValue, causing a fatal stack overflow | 1 | 0 | no | 0.4% |
GHSA-wp53-j4wj-2cfgCVE-2026-24486 | High | Python-Multipart has Arbitrary File Write via Non-Default Configuration | 1 | 0 | no | 2.2% |
GHSA-wpg7-2c88-r8xvCVE-2022-0355 | High | Exposure of Sensitive Information in simple-get | 1 | 0 | no | 2.0% |
GHSA-wq5f-xc86-pv6w | High | sharp : Vulnerability in librsvg dependency CVE-2026-96889 | 1 | 0 | no | — |
GHSA-wqp7-x3pw-xc5rCVE-2026-48818 | High | Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows | 1 | 0 | no | 0.4% |
GHSA-wrvr-8mpx-r7ppCVE-2017-16138 | High | mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input | 1 | 0 | no | 2.1% |
GHSA-wvpp-8hx9-p66jCVE-2026-76220 | High | GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution | 1 | 0 | no | 0.6% |
GHSA-x2q3-8cjh-766fCVE-2026-107215 | High | Excelize: extractPart allocates attacker-controlled, unbounded and negative-sized buffers from CFB directory entries: remote panic / OOM DoS | 1 | 0 | no | 0.2% |
GHSA-x2qx-6953-8485CVE-2026-42284 | High | GitPython: Unsafe option check validates multi_options before shlex.split transformation | 1 | 0 | no | 0.6% |
GHSA-x55w-vjjp-222rCVE-2021-3820 | High | inflect vulnerable to Inefficient Regular Expression Complexity | 1 | 0 | no | 1.2% |
GHSA-x6fg-f45m-jf5qCVE-2015-8855 | High | Regular Expression Denial of Service in semver | 1 | 0 | no | 6.9% |
GHSA-x6wf-f3px-wcqxCVE-2026-41675 | High | xmldom has XML node injection through unvalidated processing instruction serialization | 1 | 0 | no | 0.5% |
GHSA-x78j-v8h9-3j2qCVE-2026-102937 | High | virtualenv: Command injection via --prompt in activate.bat (batch activator) | 1 | 0 | no | 0.2% |
GHSA-x94g-w73q-hpcwCVE-2026-116693 | High | dd-trace: ReDOS in URL query string obfuscation | 1 | 0 | no | 0.4% |
GHSA-xcpc-8h2w-3j85CVE-2026-39244 | High | adm-zip: Crafted ZIP file triggers 4GB memory allocation | 1 | 0 | no | 0.8% |
GHSA-xcx6-jx8p-x3h5CVE-2026-109461 | High | MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint | 1 | 0 | no | 0.4% |
GHSA-xfhp-gmh8-r8v2CVE-2021-23354 | High | printf vulnerable to Regular Expression Denial of Service (ReDoS) | 1 | 0 | no | 2.2% |
GHSA-xwwf-m8fg-p9q2CVE-2026-77403 | High | RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation | 1 | 0 | no | 0.5% |
GO-2026-4559CVE-2026-27141 | High | Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic | 1 | 0 | no | 0.6% |
GHSA-4w3g-jfj2-cw2qCVE-2026-116585 | Medium | Go JOSE: Panic during CBC-HMAC processing | 15 | 0 | no | 0.3% |
GHSA-vvm8-gf78-28g4CVE-2026-116586 | Medium | Go JOSE: Panics in JSON parsing | 15 | 0 | no | 0.3% |
GHSA-g3hv-75wg-m249CVE-2026-118764 | Medium | minimatch has potential denial of service via globparts amplification | 14 | 0 | no | 0.3% |
GHSA-3g3m-2fjr-6pw4CVE-2026-118773 | Medium | Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal | 11 | 0 | no | 0.4% |
GHSA-685w-q87j-wqw3CVE-2026-85747 | Medium | Distribution: Client `manifests.Get()` does not verify returned content against requested digest | 10 | 0 | no | 0.2% |
GHSA-q2hr-2g5m-vwhrCVE-2026-102277 | Medium | brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service | 10 | 0 | no | 0.4% |
GHSA-6pq8-jhm2-2vcwCVE-2026-110816 | Medium | qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS) | 9 | 0 | no | 0.4% |
GHSA-w5hq-g745-h8pqCVE-2026-41907 | Medium | uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided | 8 | 0 | no | 0.4% |
GHSA-w74x-v6f9-j3xgCVE-2026-110306 | Medium | fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding | 8 | 0 | no | 0.2% |
GHSA-4mjr-xmp4-gh2gCVE-2026-82417 | Medium | qs: Denial of Service via Attacker Controlled isBuffer | 7 | 0 | no | 0.4% |
GHSA-hrr3-gc8f-f4qjCVE-2026-86472 | Medium | fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets | 7 | 0 | no | 0.3% |
GHSA-rj75-hqrm-r3gfCVE-2026-104844 | Medium | PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion | 7 | 0 | no | 0.4% |
GHSA-gh4c-6fx4-qh6gCVE-2026-97688 | Medium | urllib3: Chunked Deflate streaming can enter an infinite loop | 6 | 0 | no | 0.3% |
GHSA-gvwx-54wh-qm9jCVE-2026-59875 | Medium | node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records | 6 | 0 | no | 0.4% |
GHSA-h67p-54hq-rp68CVE-2026-53550 | Medium | JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases | 6 | 0 | no | 0.4% |
GHSA-vmf3-w455-68vhCVE-2026-53655 | Medium | node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smu | 6 | 0 | no | 0.2% |
GHSA-w8wr-v893-vjvpCVE-2026-59871 | Medium | node-tar: Process crash via PAX numeric path type confusion | 6 | 0 | no | 0.6% |
GHSA-2g4f-4pwh-qvx6CVE-2025-69873 | Medium | ajv has ReDoS when using `$data` option | 5 | 0 | no | 0.5% |
GHSA-69hj-f68j-2879CVE-2026-112909 | Medium | filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path | 5 | 0 | no | 0.2% |
GHSA-8mx5-7m5m-r77gCVE-2026-112910 | Medium | filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL | 5 | 0 | no | — |
GHSA-f886-m6hf-6m8vCVE-2026-33750 | Medium | brace-expansion: Zero-step sequence causes process hang and memory exhaustion | 5 | 0 | no | 0.4% |
GHSA-fxqj-rqcc-2cmpCVE-2026-69153 | Medium | PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset | 5 | 0 | no | 0.5% |
GHSA-rxp7-6hxx-x8q5CVE-2026-111997 | Medium | ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the proce | 5 | 0 | no | 0.3% |
GHSA-253c-mchw-3w2r | Medium | markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds | 4 | 0 | no | — |
GHSA-525v-9gp9-w22hCVE-2026-118778 | Medium | Forge: TLS client crash when the server sends no certificate | 4 | 0 | no | 0.2% |
GHSA-58qx-3vcg-4xpxCVE-2026-45736 | Medium | ws: Uninitialized memory disclosure | 4 | 0 | no | 0.7% |
GHSA-5cwg-6vw7-rj6pCVE-2026-119186 | Medium | Forge: AES-GCM authentication bypass via unvalidated tagLength option | 4 | 0 | no | 0.2% |
GHSA-65pc-fj4g-8rjxCVE-2026-45409 | Medium | Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix | 4 | 0 | no | 0.4% |
GHSA-698v-4r3x-3vcvCVE-2026-112943 | Medium | launch-editor: escapeCmdArgs() omits % escaping on Windows | 4 | 0 | no | 0.4% |
GHSA-6rw7-vpxm-498pCVE-2025-15284 | Medium | qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion | 4 | 0 | no | 0.4% |
GHSA-6v5v-wf23-fmfqCVE-2026-48988 | Medium | markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations | 4 | 0 | no | 0.4% |
GHSA-6w46-j5rx-g56gCVE-2025-71176 | Medium | pytest has vulnerable tmpdir handling | 4 | 0 | no | 0.2% |
GHSA-6wvx-3r32-xmcgCVE-2026-118777 | Medium | Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie | 4 | 0 | no | 0.3% |
GHSA-952p-6rrq-rcjvCVE-2024-4067 | Medium | Regular Expression Denial of Service (ReDoS) in micromatch | 4 | 0 | no | 1.4% |
GHSA-9fm3-97px-rjf6CVE-2026-109932 | Medium | undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering | 4 | 0 | no | 0.3% |
GHSA-f23m-r3pf-42rhCVE-2026-2950 | Medium | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` | 4 | 0 | no | 0.3% |
GHSA-h35f-9h28-mq5cCVE-2026-59890 | Medium | setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ | 4 | 0 | no | 0.4% |
GHSA-h3mg-xc3c-68pwCVE-2026-101911 | Medium | ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or cra | 4 | 0 | no | 0.4% |
GHSA-j6qf-3m9c-vwj3CVE-2026-114437 | Medium | chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For | 4 | 0 | no | 0.1% |
GHSA-j6r3-76f7-8jcvCVE-2026-101912 | Medium | ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowl | 4 | 0 | no | 0.4% |
GHSA-m2h6-j472-rp4cCVE-2026-69248 | Medium | python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees | 4 | 0 | no | 0.2% |
GHSA-mh29-5h37-fv8mCVE-2025-64718 | Medium | js-yaml has prototype pollution in merge (<<) | 4 | 0 | no | 0.4% |
GHSA-q8mj-m7cp-5q26CVE-2026-8723 | Medium | qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnl | 4 | 0 | no | 0.4% |
GHSA-qj8w-gfj5-8c6vCVE-2026-34043 | Medium | Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects | 4 | 0 | no | 0.5% |
GHSA-qx2v-qp2m-jg93CVE-2026-41305 | Medium | PostCSS has XSS via Unescaped </style> in its CSS Stringify Output | 4 | 0 | no | 0.2% |
GHSA-r825-w8mm-5pxwCVE-2026-112944 | Medium | launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors | 4 | 0 | no | 0.7% |
GHSA-rpw4-54j3-4h4qCVE-2026-101913 | Medium | ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts | 4 | 0 | no | 0.4% |
GHSA-w5vr-8v7q-w6rvCVE-2026-45819 | Medium | baseline-browser-mapping process termination on invalid input causes denial of service | 4 | 0 | no | 0.5% |
GHSA-wjr9-j795-jxcrCVE-2026-110180 | Medium | fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization | 4 | 0 | no | 0.3% |
GHSA-xw65-4hp5-5hc7CVE-2026-106444 | Medium | Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled Templates | 4 | 0 | no | 0.3% |
GHSA-2qvq-rjwj-gvw9CVE-2026-33916 | Medium | Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection | 3 | 0 | no | 0.3% |
GHSA-3v7f-55p6-f55pCVE-2026-33672 | Medium | Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching | 3 | 0 | no | 0.4% |
GHSA-44g4-m2mj-wpvxCVE-2026-101899 | Medium | Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges | 3 | 0 | no | 0.5% |
GHSA-4hqw-qxg8-jxx2CVE-2026-101900 | Medium | Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders | 3 | 0 | no | 0.5% |
GHSA-4qv8-2p9j-2685CVE-2026-109924 | Medium | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser | 3 | 0 | no | 0.3% |
GHSA-55wc-3pg8-jfw6CVE-2026-87029 | Medium | undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor | 3 | 0 | no | 0.3% |
GHSA-7fh5-64p2-3v2jCVE-2023-44270 | Medium | PostCSS line return parsing error | 3 | 0 | no | 1.0% |
GHSA-7rx3-28cr-v5wh | Medium | Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry | 3 | 0 | no | — |
GHSA-968p-4wvh-cqc8CVE-2025-27789 | Medium | Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups | 3 | 0 | no | 0.6% |
GHSA-9fr6-4gfg-395gCVE-2026-101902 | Medium | Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method | 3 | 0 | no | 0.4% |
GHSA-cwqr-hh33-gh44CVE-2026-112915 | Medium | filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout | 3 | 0 | no | 0.2% |
GHSA-f72v-6w45-q472CVE-2026-109841 | Medium | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens | 3 | 0 | no | 0.3% |
GHSA-fq56-3cx3-fjxpCVE-2026-112935 | Medium | filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders | 3 | 0 | no | 0.1% |
GHSA-gc5v-m9x4-r6x2CVE-2026-25645 | Medium | Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function | 3 | 0 | no | 0.2% |
GHSA-gxm5-99cw-xjw9CVE-2026-74866 | Medium | @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name | 3 | 0 | no | 0.3% |
GHSA-j8f7-rjxc-mr56CVE-2026-112936 | Medium | filelock: ReadWriteLock follows a symlink at the lock path into SQLite | 3 | 0 | no | 0.2% |
GHSA-j8rh-479h-cp32CVE-2026-101904 | Medium | Axios: Header Injection via Inherited headers After Minimal Interceptor | 3 | 0 | no | 0.5% |
GHSA-mp7j-qc5w-4988CVE-2026-54490 | Medium | websocket-driver: Resource limit bypass via message compression | 3 | 0 | no | 0.4% |
GHSA-qxg6-89mg-rqv8CVE-2026-112949 | Medium | Vitest: Code injection via unauthenticated manual mock registration | 3 | 0 | no | 0.3% |
GHSA-rfpc-qcw5-3pc4CVE-2026-112939 | Medium | filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker | 3 | 0 | no | 0.1% |
GHSA-rq7h-c2jc-7f22CVE-2026-112946 | Medium | Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine | 3 | 0 | no | 0.9% |
GHSA-v2v4-37r5-5v8gCVE-2026-42338 | Medium | ip-address has XSS in Address6 HTML-emitting methods | 3 | 0 | no | 0.5% |
GHSA-vh66-26gq-q6x8CVE-2026-101908 | Medium | Axios: Prototype pollution gadget in fetch adapter can alter outbound requests | 3 | 0 | no | 0.5% |
GHSA-w8rr-5gcm-pp58CVE-2026-39882 | Medium | opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies | 3 | 0 | no | 0.2% |
GHSA-wr44-6hxh-3jwqCVE-2026-90771 | Medium | joi messages compilation allows prototype replacement through __proto__ error codes | 3 | 0 | no | 0.4% |
GHSA-x5fp-wj9c-mxmxCVE-2026-82562 | Medium | qs array-limit bypass via bracket-key comma parsing | 3 | 0 | no | 0.5% |
GHSA-xcq7-p3pf-p88hCVE-2026-114603 | Medium | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api | 3 | 0 | no | 0.5% |
GHSA-xxjr-mmjv-4gpgCVE-2025-13465 | Medium | Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions | 3 | 0 | no | 1.8% |
GHSA-29mw-wpgm-hmr9CVE-2020-28500 | Medium | Regular Expression Denial of Service (ReDoS) in lodash | 2 | 0 | no | 7.3% |
GHSA-2jfj-6hjv-fm6jCVE-2026-84933 | Medium | undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches | 2 | 0 | no | 0.3% |
GHSA-2mjx-qc3c-rqvc | Medium | Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries | 2 | 0 | no | — |
GHSA-2wm5-q62r-hmrvCVE-2026-85062 | Medium | Colord: Slow rejection of oversized malformed color strings | 2 | 0 | no | 0.5% |
GHSA-38c4-r59v-3vqwCVE-2026-2327 | Medium | markdown-it is has a Regular Expression Denial of Service (ReDoS) | 2 | 0 | no | 0.7% |
GHSA-3wwx-pv8p-q78vCVE-2026-85024 | Medium | undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression | 2 | 0 | no | 0.4% |
GHSA-3xpg-4rpp-hhhmCVE-2026-84890 | Medium | undici vulnerable to Denial of Service via unbounded decompression of compressed responses | 2 | 0 | no | 0.4% |
GHSA-42vr-xj54-vc7vCVE-2026-101918 | Medium | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False) | 2 | 0 | no | 0.4% |
GHSA-43mp-35q3-x3fqCVE-2026-113724 | Medium | virtualenv: Deletion recovery can change a symlink target's mode | 2 | 0 | no | 0.2% |
GHSA-48c2-rrv3-qjmpCVE-2026-33532 | Medium | yaml is vulnerable to Stack Overflow via deeply nested YAML collections | 2 | 0 | no | 0.5% |
GHSA-4p3w-j4w9-5jqwCVE-2026-17495 | Medium | moment vulnerable to Path Traversal via crafted non-string locale name | 2 | 0 | no | 0.5% |
GHSA-4v9v-hfq4-rm2vCVE-2025-30359 | Medium | webpack-dev-server users' source code may be stolen when they access a malicious web site | 2 | 0 | no | 0.6% |
GHSA-4vpr-x523-8j87CVE-2026-84369 | Medium | SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements | 2 | 0 | no | 0.4% |
GHSA-4xgf-cpjx-pc3j | Medium | pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_ | 2 | 0 | no | — |
GHSA-54p9-h82j-f925CVE-2026-104874 | Medium | Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction | 2 | 0 | no | 0.4% |
GHSA-558c-9hv2-4prjCVE-2026-113721 | Medium | virtualenv: Generated files can follow existing destination links | 2 | 0 | no | 0.1% |
GHSA-5c9x-8gcm-mpgxCVE-2026-42034 | Medium | Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 | 2 | 0 | no | 0.3% |
GHSA-5h93-6whr-6q8jCVE-2026-116685 | Medium | Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies | 2 | 0 | no | 0.4% |
GHSA-5r4p-p66f-jhc7CVE-2026-111757 | Medium | Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths | 2 | 0 | no | 0.3% |
GHSA-62hf-57xw-28j9CVE-2026-42039 | Medium | Axios: unbounded recursion in toFormData causes DoS via deeply nested request data | 2 | 0 | no | 0.8% |
GHSA-6627-m3xw-93mpCVE-2026-112908 | Medium | filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a l | 2 | 0 | no | — |
GHSA-6prh-2h8m-c8cwCVE-2026-111769 | Medium | MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request | 2 | 0 | no | — |
GHSA-72xf-g2v4-qvf3CVE-2023-26136 | Medium | tough-cookie Prototype Pollution vulnerability | 2 | 0 | no | 2.6% |
GHSA-79cf-xcqc-c78wCVE-2026-6402 | Medium | webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins | 2 | 0 | no | 0.3% |
GHSA-7q8q-rj6j-mhjqCVE-2026-67319 | Medium | Axios: Nested axios option objects can consume polluted prototype values | 2 | 0 | no | 0.3% |
GHSA-82fw-gwwq-j7x9CVE-2026-84373 | Medium | Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock | 2 | 0 | no | 0.5% |
GHSA-84m7-p3x7-pcfvCVE-2026-59951 | Medium | MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion | 2 | 0 | no | 0.5% |
GHSA-8988-4f7v-96qfCVE-2026-54285 | Medium | OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation | 2 | 0 | no | 0.4% |
GHSA-898c-q2cr-xwhgCVE-2026-44490 | Medium | axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions | 2 | 0 | no | 0.3% |
GHSA-9c4x-gm8v-wgc4CVE-2026-112911 | Medium | filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion | 2 | 0 | no | 0.1% |
GHSA-9jgg-88mc-972hCVE-2025-30360 | Medium | webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser | 2 | 0 | no | 0.4% |
GHSA-9xwg-3r6f-jcx2CVE-2026-61632 | Medium | PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path | 2 | 0 | no | 0.4% |
GHSA-c8m5-c952-6cm4 | Medium | Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs | 2 | 0 | no | — |
GHSA-cp6g-7hqx-qxhpCVE-2026-2303 | Medium | mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling | 2 | 0 | no | 0.3% |
GHSA-crvj-82cr-hjcxCVE-2026-84363 | Medium | Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials | 2 | 0 | no | 0.4% |
GHSA-cw65-gx24-rc82CVE-2026-113716 | Medium | virtualenv: Builtin creation follows linked environment directories | 2 | 0 | no | 0.1% |
GHSA-f38q-mgvj-vph7CVE-2026-54269 | Medium | protobufjs : Schema-derived names can shadow runtime-significant properties | 2 | 0 | no | 0.4% |
GHSA-f5vj-f2hx-8m93CVE-2026-14620 | Medium | webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints | 2 | 0 | no | 0.5% |
GHSA-f5x3-32g6-xq36CVE-2024-28863 | Medium | Denial of service while parsing a tar file due to lack of folders count validation | 2 | 0 | no | 0.9% |
GHSA-fc2g-4w5p-6whmCVE-2026-113720 | Medium | virtualenv: Seeded files retain permissions from an older cache | 2 | 0 | no | 0.1% |
GHSA-g6gw-c38x-mqfcCVE-2026-84364 | Medium | Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion | 2 | 0 | no | 0.5% |
GHSA-g6x2-hccm-hh4mCVE-2026-102598 | Medium | Werkzeug safe_join() allows Windows special device names | 2 | 0 | no | 0.4% |
GHSA-gjv8-xp57-g29cCVE-2026-86000 | Medium | Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns | 2 | 0 | no | 0.6% |
GHSA-gqvv-2mrq-wpjvCVE-2026-84365 | Medium | Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory | 2 | 0 | no | 0.4% |
GHSA-h5c3-5r3r-rr8qCVE-2025-25288 | Medium | @octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking | 2 | 0 | no | 0.6% |
GHSA-hhxq-47xx-j5xxCVE-2026-113719 | Medium | virtualenv: Seed replacement does not contain metadata deletion paths | 2 | 0 | no | 0.2% |
GHSA-hxh3-vqpv-xpqvCVE-2026-93981 | Medium | hono/jsx renders plain strings unescaped in boundary components, leading to XSS | 2 | 0 | no | 0.2% |
GHSA-j3f2-48v5-ccwwCVE-2026-59877 | Medium | protobufjs: Denial of Service via infinite loop in .proto option parsing | 2 | 0 | no | 0.4% |
GHSA-j8xg-fqg3-53r7CVE-2023-26115 | Medium | word-wrap vulnerable to Regular Expression Denial of Service | 2 | 0 | no | 1.7% |
GHSA-j934-xhv5-fg8fCVE-2026-85999 | Medium | Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors) | 2 | 0 | no | 0.6% |
GHSA-jc7w-c686-c4v9CVE-2025-58058 | Medium | github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives | 2 | 0 | no | 0.4% |
GHSA-jfmj-5v4g-7637CVE-2024-5569 | Medium | zipp Denial of Service vulnerability | 2 | 0 | no | 0.2% |
GHSA-jggg-4jg4-v7c6CVE-2026-45740 | Medium | protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion | 2 | 0 | no | 0.3% |
GHSA-m28w-2pqf-7qgjCVE-2026-14631 | Medium | webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header | 2 | 0 | no | 0.5% |
GHSA-m462-7rxw-wvpgCVE-2026-112938 | Medium | filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user | 2 | 0 | no | — |
GHSA-m7pr-hjqh-92cmCVE-2026-42038 | Medium | Axios: no_proxy bypass via IP alias allows SSRF | 2 | 0 | no | 0.3% |
GHSA-mf9w-mj56-hr94CVE-2026-28684 | Medium | python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback | 2 | 0 | no | 0.3% |
GHSA-mmx7-hfxf-jppxCVE-2026-67316 | Medium | Axios: Prototype pollution gadgets can alter axios request construction | 2 | 0 | no | 0.4% |
GHSA-mwcw-c2x4-8c55CVE-2024-55565 | Medium | Predictable results in nanoid generation when given non-integer values | 2 | 0 | no | 0.7% |
GHSA-mx8g-39q3-5c79CVE-2026-9595 | Medium | webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies | 2 | 0 | no | 0.2% |
GHSA-p8p7-x288-28g6CVE-2023-28155 | Medium | Server-Side Request Forgery in Request | 2 | 0 | no | 0.7% |
GHSA-pfrx-2q88-qq97CVE-2022-33987 | Medium | Got allows a redirect to a UNIX socket | 2 | 0 | no | 2.4% |
GHSA-pmjh-fq2x-6v4xCVE-2026-18149 | Medium | undici vulnerable to Denial of Service via orphaned RetryHandler response body | 2 | 0 | no | 0.5% |
GHSA-pmwq-pjrm-6p5r | Medium | in-toto-golang and in-toto-python have inconsistent negation behavior | 2 | 0 | no | — |
GHSA-pq67-6m6q-mj2vCVE-2025-50181 | Medium | urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation | 2 | 0 | no | 0.5% |
GHSA-r4xh-jqrq-34v2 | Medium | smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line | 2 | 0 | no | — |
GHSA-rmvr-2pp2-xj38CVE-2025-25290 | Medium | @octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking | 2 | 0 | no | 0.8% |
GHSA-rmxm-3fg6-px4fCVE-2026-118663 | Medium | @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths | 2 | 0 | no | 0.4% |
GHSA-rv95-896h-c2vcCVE-2024-29041 | Medium | Express.js Open Redirect in malformed URLs | 2 | 0 | no | 0.8% |
GHSA-rvq5-wwqv-78pqCVE-2026-111771 | Medium | MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service | 2 | 0 | no | — |
GHSA-rwrf-2pqf-9j8jCVE-2026-116686 | Medium | Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas | 2 | 0 | no | 0.3% |
GHSA-rx4f-c7p8-82vqCVE-2026-85014 | Medium | undici vulnerable to Denial of Service via WebSocketStream unclean close | 2 | 0 | no | 0.4% |
GHSA-v6wh-96g9-6wx3CVE-2026-53632 | Medium | launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows | 2 | 0 | no | 0.4% |
GHSA-v88g-cgmw-v5xwCVE-2020-15366 | Medium | Prototype Pollution in Ajv | 2 | 0 | no | 2.3% |
GHSA-vcc3-ghjq-m6frCVE-2026-45822 | Medium | decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input | 2 | 0 | no | 0.5% |
GHSA-vf2m-468p-8v99CVE-2026-42036 | Medium | Axios: HTTP adapter streamed responses bypass maxContentLength | 2 | 0 | no | 0.3% |
GHSA-vfpm-58rq-9qcgCVE-2026-112947 | Medium | Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` | 2 | 0 | no | 0.5% |
GHSA-w4fh-qvv9-3v23CVE-2026-116684 | Medium | Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server | 2 | 0 | no | 0.4% |
GHSA-w9j2-pvgh-6h63CVE-2026-42041 | Medium | Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy | 2 | 0 | no | 0.7% |
GHSA-x33g-cr3x-6449CVE-2026-102275 | Medium | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion | 2 | 0 | no | 0.2% |
GHSA-xp26-3454-mjgpCVE-2026-112950 | Medium | Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix | 2 | 0 | no | 0.5% |
GHSA-xx4v-prfh-6cgcCVE-2025-25289 | Medium | @octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking | 2 | 0 | no | 0.6% |
GHSA-xx6v-rp6x-q39cCVE-2026-42042 | Medium | Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion | 2 | 0 | no | 0.2% |
GHSA-22qq-2fwx-7p67CVE-2026-114608 | Medium | Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME | 1 | 0 | no | 0.1% |
GHSA-23wf-92cp-8pcjCVE-2026-118658 | Medium | Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto | 1 | 0 | no | 0.2% |
GHSA-246p-cpwv-v3jqCVE-2026-118653 | Medium | Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration | 1 | 0 | no | 0.4% |
GHSA-257v-vj4p-3w2hCVE-2021-29060 | Medium | Regular Expression Denial of Service (ReDOS) | 1 | 0 | no | 3.1% |
GHSA-25hc-qcg6-38wjCVE-2024-38355 | Medium | socket.io has an unhandled 'error' event | 1 | 0 | no | 0.8% |
GHSA-2ffq-g2xg-c22pCVE-2026-118657 | Medium | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers | 1 | 0 | no | 0.1% |
GHSA-2gcr-mfcq-wcc3CVE-2026-47676 | Medium | Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths | 1 | 0 | no | 0.3% |
GHSA-2gx3-rcp4-g85qCVE-2026-101917 | Medium | PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) | 1 | 0 | no | 0.4% |
GHSA-2mjp-6q6p-2qxmCVE-2026-1525 | Medium | Undici has an HTTP Request/Response Smuggling issue | 1 | 0 | no | 0.5% |
GHSA-2p8c-gr87-2676CVE-2026-113796 | Medium | Electron: SameSite cookie restrictions are not applied to windows opened from links | 1 | 0 | no | 0.2% |
GHSA-2pr6-76vf-7546 | Medium | Denial of Service in js-yaml | 1 | 0 | no | — |
GHSA-2pr8-phx7-x9h3CVE-2026-44294 | Medium | protobuf.js: Denial of service from crafted field names in generated code | 1 | 0 | no | 0.4% |
GHSA-2vh6-hw4j-32ww | Medium | gix-packetline: reachable panic on empty side-band packet (pre-auth network DoS) | 1 | 0 | no | — |
GHSA-2vr4-cq9g-pvrcCVE-2026-101910 | Medium | ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass | 1 | 0 | no | 0.4% |
GHSA-332q-7ff2-57h2CVE-2019-10795 | Medium | Prototype Pollution in undefsafe | 1 | 0 | no | 1.1% |
GHSA-34jh-p97f-mpxfCVE-2024-37891 | Medium | urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects | 1 | 0 | no | 1.1% |
GHSA-36j9-mx87-2cff | Medium | Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependencies | 1 | 0 | no | — |
GHSA-378v-28hj-76wfCVE-2026-2739 | Medium | bn.js affected by an infinite loop | 1 | 0 | no | 0.5% |
GHSA-39q2-94rc-95cpCVE-2026-65903 | Medium | DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation | 1 | 0 | no | 0.3% |
GHSA-3c8v-cfp5-9885CVE-2026-34776 | Medium | Electron: Out-of-bounds read in second-instance IPC on macOS and Linux | 1 | 0 | no | 0.2% |
GHSA-3f44-xw83-3pmg | Medium | Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml file | 1 | 0 | no | — |
GHSA-3hrh-pfw6-9m5xCVE-2026-47675 | Medium | Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection | 1 | 0 | no | 0.2% |
GHSA-3m5p-2c4r-xxw2CVE-2026-16732 | Medium | fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count | 1 | 0 | no | 0.2% |
GHSA-3p68-rc4w-qgx5CVE-2025-62718 | Medium | Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF | 1 | 0 | no | 1.2% |
GHSA-3pmx-cf9f-34xrCVE-2026-118654 | Medium | Echo static file middleware route protection bypass via encoded dot-dot traversal | 1 | 0 | no | 0.3% |
GHSA-3w6x-2g7m-8v23CVE-2026-42044 | Medium | Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver` | 1 | 0 | no | 0.6% |
GHSA-3wxw-xv34-2frgCVE-2026-78679 | Medium | GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c | 1 | 0 | no | 0.3% |
GHSA-3x93-p86w-5jvhCVE-2026-16629 | Medium | danger allows local OS command injection through crafted file paths | 1 | 0 | no | 1.1% |
GHSA-3xc5-wrhm-f963CVE-2026-41506 | Medium | go-git: Credential leak via cross-host redirect in smart HTTP transport | 1 | 0 | no | 0.3% |
GHSA-42h9-826w-cgv3CVE-2026-67313 | Medium | Axios: Excessive recursion in formDataToJSON can cause denial of service | 1 | 0 | no | 0.5% |
GHSA-445q-vr5w-6q77CVE-2026-42037 | Medium | Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream | 1 | 0 | no | 0.3% |
GHSA-4633-3j49-mh5qCVE-2026-64647 | Medium | Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences | 1 | 0 | no | 0.3% |
GHSA-477h-4r7f-fvrxCVE-2026-102414 | Medium | pbkdf2 rehashes long passwords on every iteration, enabling denial of service | 1 | 0 | no | 0.3% |
GHSA-47p6-69vm-vw6vCVE-2026-9495 | Medium | @koa/router has an Access Control Bypass | 1 | 0 | no | 0.4% |
GHSA-494j-54xm-rwp3CVE-2026-111063 | Medium | AIOHTTP: Secure attribute not enforced for shared cookie | 1 | 0 | no | 0.2% |
GHSA-4992-7rv2-5pvqCVE-2026-1527 | Medium | Undici has CRLF Injection in undici via `upgrade` option | 1 | 0 | no | 0.3% |
GHSA-4c39-4ccg-62r3CVE-2026-64646 | Medium | Next.js: Unbounded Server Action payload in Edge runtime | 1 | 0 | no | 0.5% |
GHSA-4f78-qhmw-8j8mCVE-2026-70609 | Medium | Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter | 1 | 0 | no | 0.5% |
GHSA-4f8h-vr72-p32cCVE-2026-113713 | Medium | virtualenv: Temporary app-data can leave dangling seed package links | 1 | 0 | no | 0.2% |
GHSA-4fvr-rgm6-gqmcCVE-2026-54273 | Medium | aiohttp: HTTP/1 Pipelined Requests Queue Without Limit | 1 | 0 | no | 0.5% |
GHSA-4jqv-mc3x-m676CVE-2026-94543 | Medium | Next.js has cache poisoning of SSG and ISR pages in self-hosted applications | 1 | 0 | no | 0.5% |
GHSA-4mh8-r7rc-xpvcCVE-2026-92081 | Medium | fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responses | 1 | 0 | no | 0.4% |
GHSA-4p4r-m79c-wq3vCVE-2026-34767 | Medium | Electron: HTTP Response Header Injection in custom protocol handlers and webRequest | 1 | 0 | no | 0.2% |
GHSA-4vj7-5mj6-jm8mCVE-2026-5078 | Medium | morgan vulnerable to Log Forging via unneutralized control characters in :remote-user | 1 | 0 | no | 0.3% |
GHSA-4vvj-4cpr-p986CVE-2024-43788 | Medium | Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS | 1 | 0 | no | 1.0% |
GHSA-4xcv-9jjx-gfj3 | Medium | Denial of Service in mem | 1 | 0 | no | — |
GHSA-539m-9xh6-q6rr | Medium | GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archi | 1 | 0 | no | — |
GHSA-54fx-42gc-7vw4CVE-2026-71848 | Medium | Hono: Algorithmic Complexity DoS in Language Middleware | 1 | 0 | no | 0.5% |
GHSA-55q2-fjhq-7xh7 | Medium | DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS | 1 | 0 | no | — |
GHSA-566m-qj78-rww5CVE-2021-23382 | Medium | Regular Expression Denial of Service in postcss | 1 | 0 | no | 2.6% |
GHSA-597g-3phw-6986CVE-2026-22702 | Medium | virtualenv Has TOCTOU Vulnerabilities in Directory Creation | 1 | 0 | no | 0.1% |
GHSA-59cr-6r3x-644w | Medium | GitPython submodule update path traversal can write outside the repository | 1 | 0 | no | — |
GHSA-59jp-pj84-45mrCVE-2026-22772 | Medium | Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass | 1 | 0 | no | 0.2% |
GHSA-5c9j-mhmv-5xgxCVE-2026-70603 | Medium | Electron: shell.openPath path validation bypass via embedded null byte | 1 | 0 | no | 0.1% |
GHSA-5fg8-2547-mr8qCVE-2021-32796 | Medium | Misinterpretation of malicious XML input | 1 | 0 | no | 1.4% |
GHSA-5fw9-fq32-wv5pCVE-2020-7789 | Medium | OS Command Injection in node-notifier | 1 | 0 | no | 1.6% |
GHSA-5h23-36rv-pm65CVE-2026-107225 | Medium | Excelize: GetStyle panics on a negative fillId, borderId or fontId in styles.xml | 1 | 0 | no | 0.3% |
GHSA-5p39-cfhj-2xmpCVE-2026-64847 | Medium | AnyIO process-pool workers can block indefinitely on undrained stderr | 1 | 0 | no | 0.2% |
GHSA-5rqw-r77c-jp79CVE-2026-34779 | Medium | Electron: AppleScript injection in app.moveToApplicationsFolder on macOS | 1 | 0 | no | 0.2% |
GHSA-5xxx-qhh7-9287CVE-2026-78678 | Medium | GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame() | 1 | 0 | no | 0.4% |
GHSA-63hw-fmq6-xxg2CVE-2026-54277 | Medium | aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines | 1 | 0 | no | 0.6% |
GHSA-64mm-vxmg-q3vjCVE-2026-55602 | Medium | http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass | 1 | 0 | no | 0.4% |
GHSA-663r-x48j-fg8pCVE-2026-12208 | Medium | jsonata: Function Binding Prototype Pollution via hasOwnProperty Override | 1 | 0 | no | 0.3% |
GHSA-68g3-v927-f742CVE-2026-64648 | Medium | Next.js: Cache confusion of response bodies for requests with bodies | 1 | 0 | no | 0.3% |
GHSA-698x-9w2p-7vvpCVE-2026-10517 | Medium | Claircore: Unauthenticated attackers can submit manifests with URIs pointing to internal services or cloud metadata endpoints | 1 | 0 | no | — |
GHSA-6cjc-53gc-5rqmCVE-2026-111065 | Medium | AIOHTTP: Connector pool exhaustion via Max-Age overflow | 1 | 0 | no | 0.4% |
GHSA-6fx8-h7jm-663jCVE-2024-36751 | Medium | parse-uri Regular expression Denial of Service (ReDoS) | 1 | 0 | no | 0.5% |
GHSA-6gmq-8vp8-gcm6CVE-2026-83610 | Medium | xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization | 1 | 0 | no | 0.6% |
GHSA-6h8r-xr42-gp59CVE-2026-83611 | Medium | xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content | 1 | 0 | no | 0.6% |
GHSA-6hr6-w5qg-qmwgCVE-2026-71554 | Medium | h2: Duplicate Host header could facilitate request smuggling | 1 | 0 | no | 0.4% |
GHSA-6hxr-mr5r-9836CVE-2026-68499 | Medium | re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS | 1 | 0 | no | 0.2% |
GHSA-6r2x-8pq8-9489CVE-2024-46993 | Medium | Electron vulnerable to Heap Buffer Overflow in NativeImage | 1 | 0 | no | 0.2% |
GHSA-6vfc-qv3f-vr6cCVE-2022-21670 | Medium | Uncontrolled Resource Consumption in markdown-it | 1 | 0 | no | 2.3% |
GHSA-76mc-f452-cxcmCVE-2026-65902 | Medium | DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATT | 1 | 0 | no | 0.4% |
GHSA-76p7-773f-r4q5CVE-2024-11831 | Medium | Cross-site Scripting (XSS) in serialize-javascript | 1 | 0 | no | 1.1% |
GHSA-776f-qx25-q3ccCVE-2023-0842 | Medium | xml2js is vulnerable to prototype pollution | 1 | 0 | no | 1.4% |
GHSA-77xc-hjv8-ww97CVE-2022-29257 | Medium | AutoUpdater module fails to validate certain nested components of the bundle | 1 | 0 | no | 0.9% |
GHSA-7m48-wc93-9g85CVE-2023-44402 | Medium | ASAR Integrity bypass via filetype confusion in electron | 1 | 0 | no | 0.2% |
GHSA-7q3q-5px6-4c5pCVE-2026-31959 | Medium | Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains a Server-Side Request Forg | 1 | 0 | no | 0.1% |
GHSA-7wwv-vh3v-89cq | Medium | ReDOS vulnerabities: multiple grammars | 1 | 0 | no | — |
GHSA-7x97-j373-85x5CVE-2023-39956 | Medium | Electron vulnerable to out-of-package code execution when launched with arbitrary cwd | 1 | 0 | no | 0.5% |
GHSA-7xgj-8392-5q4r | Medium | FastMCP: Post-transform component authorization is skipped on direct calls | 1 | 0 | no | — |
GHSA-85x2-q946-cp5h | Medium | Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name | 1 | 0 | no | — |
GHSA-89v8-rhwq-hf77CVE-2026-55244 | Medium | asteval has a Sandbox Escape via BaseException Subclasses | 1 | 0 | no | 0.2% |
GHSA-8c8m-p3m8-cjg8 | Medium | Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient | 1 | 0 | no | — |
GHSA-8cw4-87c7-c6xxCVE-2026-85063 | Medium | node-csv: Prototype replacement still reachable via columns path | 1 | 0 | no | 0.6% |
GHSA-8hcv-x26h-mcgpCVE-2026-71430 | Medium | node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable ToLocalChecked on empty MaybeLocal) when the result e | 1 | 0 | no | 0.2% |
GHSA-8j4g-w8fx-2239CVE-2026-69207 | Medium | Hono: ReDoS in CORS middleware via Access-Control-Request-Headers | 1 | 0 | no | 0.6% |
GHSA-8jjq-8j9w-m2v6CVE-2026-107218 | Medium | Excelize: RIGHT() on supplementary-plane text slices with a negative index and panics | 1 | 0 | no | 0.3% |
GHSA-8mcq-6wmr-jrjvCVE-2026-107221 | Medium | Excelize: a row whose earlier cell has a higher column reference than its last cell panics index out of range on almost every worksheet read | 1 | 0 | no | 0.3% |
GHSA-8pvw-jcv7-9cmjCVE-2026-7120 | Medium | @fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths | 1 | 0 | no | 0.4% |
GHSA-8v8h-hg4w-mvq2CVE-2026-59980 | Medium | hpack: Unbounded variable integer decoding can cause run-away computation on malformed input | 1 | 0 | no | 0.3% |
GHSA-8wjv-2p76-3863CVE-2026-102265 | Medium | PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header | 1 | 0 | no | 0.3% |
GHSA-8xcm-r25x-g524CVE-2026-16728 | Medium | undici vulnerable to downstream response desynchronization via retry interceptor | 1 | 0 | no | 0.3% |
GHSA-955p-x3mx-jcvpCVE-2026-64643 | Medium | Next.js: Unauthenticated disclosure of internal Server Function endpoints | 1 | 0 | no | 0.5% |
GHSA-997q-gvvc-jwmxCVE-2026-114121 | Medium | Electron: openExternal permission requests can be attributed to the wrong origin | 1 | 0 | no | 0.2% |
GHSA-99jh-6h7p-pp36CVE-2026-118651 | Medium | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default | 1 | 0 | no | 0.2% |
GHSA-9f6g-j8ch-79g4CVE-2026-87859 | Medium | morgan vulnerable to Log Injection via unescaped double quote in quoted log fields | 1 | 0 | no | 0.4% |
GHSA-9h9j-4vrj-gf7gCVE-2026-102938 | Medium | virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection | 1 | 0 | no | 0.1% |
GHSA-9hjg-9r4m-mvj7CVE-2024-47081 | Medium | Requests vulnerable to .netrc credentials leak via malicious URLs | 1 | 0 | no | 1.0% |
GHSA-9pf5-hg6p-4pwpCVE-2026-70599 | Medium | Electron: Permission Check Handler Receives Main Frame Origin Instead of Requesting Iframe Origin | 1 | 0 | no | 0.2% |
GHSA-9pg5-8c7x-5hfxCVE-2026-119284 | Medium | joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection | 1 | 0 | no | 0.2% |
GHSA-9w56-46f6-3qhx | Medium | asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter | 1 | 0 | no | — |
GHSA-9w97-2464-8783CVE-2026-34772 | Medium | Electron: Use-after-free in download save dialog callback | 1 | 0 | no | 0.2% |
GHSA-9wx4-h78v-vm56CVE-2024-35195 | Medium | Requests `Session` object does not verify requests after making first request with verify=False | 1 | 0 | no | 0.3% |
GHSA-c6fg-446q-cg94 | Medium | adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path | 1 | 0 | no | — |
GHSA-cmwh-pvxp-8882CVE-2026-65898 | Medium | DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution p | 1 | 0 | no | 0.2% |
GHSA-cqmj-92xf-r6r9CVE-2023-32695 | Medium | Insufficient validation when decoding a Socket.IO packet | 1 | 0 | no | 1.1% |
GHSA-crhj-59gh-8x96CVE-2026-45571 | Medium | go-git: Crafted repositories may modify main and submodule .git directories | 1 | 0 | no | 0.3% |
GHSA-crv5-9vww-q3g8CVE-2026-41239 | Medium | DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode | 1 | 0 | no | 0.2% |
GHSA-cxjh-pqwp-8mfpCVE-2024-28849 | Medium | follow-redirects' Proxy-Authorization header kept across hosts | 1 | 0 | no | 1.0% |
GHSA-f23p-vx2j-j53rCVE-2026-71850 | Medium | Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure | 1 | 0 | no | 0.3% |
GHSA-f2r8-jv7c-xqmpCVE-2026-70611 | Medium | Electron: DevTools embedder handler executes arbitrary files via shell open | 1 | 0 | no | 0.2% |
GHSA-f3pv-wv63-48x8CVE-2026-34765 | Medium | Electron: Named window.open targets not scoped to the opener's browsing context | 1 | 0 | no | 0.3% |
GHSA-f4gw-2p7v-4548CVE-2026-67315 | Medium | Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios | 1 | 0 | no | 0.5% |
GHSA-f577-qrjj-4474CVE-2026-47673 | Medium | Hono: JWT middleware accepts any Authorization scheme, not only Bearer | 1 | 0 | no | 0.2% |
GHSA-f87g-xv8r-7p7xCVE-2026-94485 | Medium | Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass | 1 | 0 | no | 0.2% |
GHSA-f9mq-jph6-9mhmCVE-2020-4075 | Medium | Arbitrary file read via window-open IPC in Electron | 1 | 0 | no | 1.2% |
GHSA-f9xw-jh8m-3mwqCVE-2026-111748 | Medium | AIOHTTP: Absolute-form request targets can spoof Request.scheme | 1 | 0 | no | 0.4% |
GHSA-ff2p-hmqr-hxm4CVE-2026-70610 | Medium | Electron: contextBridge object copy honors prototype setters | 1 | 0 | no | 0.6% |
GHSA-ff84-5f28-78qjCVE-2026-67550 | Medium | re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash | 1 | 0 | no | 0.2% |
GHSA-ffhc-5mcf-pf4qCVE-2026-44581 | Medium | Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces | 1 | 0 | no | 0.2% |
GHSA-fh4f-47mf-f2gjCVE-2026-100347 | Medium | kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path | 1 | 0 | no | 0.5% |
GHSA-fj95-fr6c-h845CVE-2026-112934 | Medium | filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its rec | 1 | 0 | no | 0.2% |
GHSA-fr4j-65pv-gjjj | Medium | Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration | 1 | 0 | no | — |
GHSA-frvp-7c67-39w9 | Medium | Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) | 1 | 0 | no | — |
GHSA-fvcv-3m26-pcqxCVE-2026-40175 | Medium | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain | 1 | 0 | no | 1.9% |
GHSA-fvqr-27wr-82fmCVE-2018-3721 | Medium | Prototype Pollution in lodash | 1 | 0 | no | 2.3% |
GHSA-fw47-9c62-h3vwCVE-2026-113800 | Medium | Electron: HID and USB permission checks can be attributed to the wrong origin | 1 | 0 | no | 0.2% |
GHSA-fw94-4wwp-w8pwCVE-2026-107224 | Medium | Excelize: A Zip64 uncompressed-size of 2^63 panics OpenFile/OpenReader | 1 | 0 | no | 0.3% |
GHSA-fx2h-pf6j-xcffCVE-2026-53571 | Medium | vite: `server.fs.deny` bypass on Windows alternate paths | 1 | 0 | no | 0.6% |
GHSA-fx3j-rwgx-fr94 | Medium | GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name | 1 | 0 | no | — |
GHSA-fx83-v9x8-x52wCVE-2026-44292 | Medium | protobuf.js: Prototype injection in generated message constructors | 1 | 0 | no | 0.3% |
GHSA-g27h-8qhm-6pffCVE-2026-107220 | Medium | Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref | 1 | 0 | no | 0.3% |
GHSA-g32c-4pvp-769gCVE-2026-31960 | Medium | Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 has unbounded reads of HTTP respons | 1 | 0 | no | 0.1% |
GHSA-g3ch-rx76-35fxCVE-2024-6783 | Medium | vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS) | 1 | 0 | no | 0.5% |
GHSA-g3cq-j2xw-wf74CVE-2026-54278 | Medium | aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup | 1 | 0 | no | 0.5% |
GHSA-g9mf-h72j-4rw9CVE-2026-22036 | Medium | Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion | 1 | 0 | no | 0.5% |
GHSA-gh4j-gqv2-49f6CVE-2026-41650 | Medium | fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters | 1 | 0 | no | 0.2% |
GHSA-gq48-pqfc-9p58 | Medium | GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree | 1 | 0 | no | — |
GHSA-gvp8-978c-rx2qCVE-2026-103001 | Medium | PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse | 1 | 0 | no | 0.3% |
GHSA-gx5p-jg67-6x7hCVE-2026-44580 | Medium | Next.js has cross-site scripting in beforeInteractive scripts with untrusted input | 1 | 0 | no | 0.2% |
GHSA-gxhx-2686-5h9g | Medium | slack-go `SecretsVerifier` accepts empty signing secret without precondition | 1 | 0 | no | — |
GHSA-h64f-5h5j-jqjhCVE-2026-44577 | Medium | Next.js has a Denial of Service in the Image Optimization API | 1 | 0 | no | 0.7% |
GHSA-h6q6-9hqw-rwfvCVE-2021-21366 | Medium | Misinterpretation of malicious XML input | 1 | 0 | no | 1.3% |
GHSA-h7mw-gpvr-xq4mCVE-2026-41240 | Medium | DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix) | 1 | 0 | no | 0.3% |
GHSA-h9g5-28mm-hx3gCVE-2026-118652 | Medium | Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob | 1 | 0 | no | 0.2% |
GHSA-hcpx-6fm6-wx23CVE-2026-67321 | Medium | Axios form serializer maxDepth bypass via {} metatoken | 1 | 0 | no | 0.5% |
GHSA-hg6j-4rv6-33pgCVE-2026-47265 | Medium | AIOHTTP is vulnerable to cross-origin redirect with per-request cookies | 1 | 0 | no | 0.1% |
GHSA-hh9p-6wh2-4mfcCVE-2026-76217 | Medium | GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout() | 1 | 0 | no | 0.4% |
GHSA-hj48-42vr-x3v9CVE-2021-23343 | Medium | Regular Expression Denial of Service in path-parse | 1 | 0 | no | 2.2% |
GHSA-hjrf-2m68-5959CVE-2022-23541 | Medium | jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC | 1 | 0 | no | 0.8% |
GHSA-hpcv-96wg-7vj8CVE-2026-49458 | Medium | DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks | 1 | 0 | no | 0.4% |
GHSA-hpj7-wq8m-9hgpCVE-2026-54276 | Medium | aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges | 1 | 0 | no | 0.3% |
GHSA-hrvq-x7jp-36xvCVE-2026-104853 | Medium | Nx: Path traversal in nx migrate package-migrations extraction | 1 | 0 | no | 0.2% |
GHSA-hvf8-h2qh-37m9CVE-2020-26272 | Medium | IPC messages delivered to the wrong frame in Electron | 1 | 0 | no | 1.7% |
GHSA-hvrm-45r6-mjfjCVE-2026-59896 | Medium | hono/jsx does not isolate context per request, leading to cross-request data disclosure | 1 | 0 | no | 0.3% |
GHSA-hxm8-2xgr-2p9mCVE-2026-102269 | Medium | PyJWT: Non-canonical signature segments enable raw-token revocation bypass | 1 | 0 | no | 0.2% |
GHSA-j4r3-hg7j-8chgCVE-2026-71498 | Medium | node-re2: Out-of-bounds heap read in `replace`/`split` via a `Buffer` ending in a truncated multi-byte UTF-8 character → adjacent heap memor | 1 | 0 | no | 0.2% |
GHSA-j6c9-x7qj-28xfCVE-2026-54287 | Medium | hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and Lattice | 1 | 0 | no | 0.3% |
GHSA-jchw-25xp-jwwcCVE-2023-26159 | Medium | Follow Redirects improperly handles URLs in the url.parse() function | 1 | 0 | no | 0.8% |
GHSA-jfc7-64v2-mr8cCVE-2026-48758 | Medium | @sigstore/core has DSSE payloadType type-binding failure | 1 | 0 | no | 0.2% |
GHSA-jg22-mg44-37j8CVE-2026-34993 | Medium | AIOHTTP is Vulnerable to Deserialization of Untrusted Data | 1 | 0 | no | 0.2% |
GHSA-jggr-w7fw-pc2j | Medium | fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values | 1 | 0 | no | — |
GHSA-jhf3-xxhw-2wppCVE-2026-34165 | Medium | go-git: Maliciously crafted idx file can cause asymmetric memory consumption | 1 | 0 | no | 0.2% |
GHSA-jm7p-cc5g-qwxxCVE-2026-70597 | Medium | Electron: Parent process code-sign check is spoofable | 1 | 0 | no | 0.1% |
GHSA-jp2q-39xq-3w4gCVE-2026-33349 | Medium | Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser | 1 | 0 | no | 0.5% |
GHSA-jqh4-m9w3-8hp9CVE-2026-67317 | Medium | Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength` | 1 | 0 | no | 0.6% |
GHSA-jvvf-x445-j334CVE-2026-86818 | Medium | fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization | 1 | 0 | no | 0.3% |
GHSA-jwrc-g2q2-pq5pCVE-2026-102270 | Medium | PyJWT: ReDoS vulnerability when calling the `is_pem_format` function. | 1 | 0 | no | 0.2% |
GHSA-jxfw-x594-9x9mCVE-2026-15603 | Medium | morgan vulnerable to Log Forging via unescaped Unicode line separators | 1 | 0 | no | 0.4% |
GHSA-m3xc-h892-ggx6CVE-2026-44740 | Medium | go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion | 1 | 0 | no | 0.4% |
GHSA-m55f-7gqj-fr98CVE-2026-70602 | Medium | Electron: Extension tab APIs operate across session boundaries | 1 | 0 | no | 0.3% |
GHSA-m8rv-5g2x-5cg5CVE-2026-15157 | Medium | undici vulnerable to CRLF Injection via blob-like body 'type' property | 1 | 0 | no | 0.3% |
GHSA-m943-m63m-w62w | Medium | Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient | 1 | 0 | no | — |
GHSA-mcj8-r9mp-w47pCVE-2026-94484 | Medium | Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service | 1 | 0 | no | 0.2% |
GHSA-mfx4-hv73-q22vCVE-2026-69243 | Medium | AIOHTTP: HTTP request smuggling via WebSocket upgrade | 1 | 0 | no | 0.4% |
GHSA-mh7x-f8wq-4jhxCVE-2026-100348 | Medium | kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS) | 1 | 0 | no | 0.4% |
GHSA-mj87-hwqh-73pjCVE-2026-40347 | Medium | python-multipart affected by Denial of Service via large multipart preamble or epilogue data | 1 | 0 | no | 0.4% |
GHSA-mpjm-v997-c4h4CVE-2021-39184 | Medium | Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API | 1 | 0 | no | 1.1% |
GHSA-mq44-7p77-q5h7CVE-2026-59881 | Medium | AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate | 1 | 0 | no | 0.5% |
GHSA-mwf2-3pr3-8698CVE-2026-67318 | Medium | Axios: HTTP/2 streamed uploads bypass `maxBodyLength` | 1 | 0 | no | 0.6% |
GHSA-mwmh-mq4g-g6grCVE-2026-34773 | Medium | Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows | 1 | 0 | no | 0.2% |
GHSA-p2jh-44qj-pf2vCVE-2022-36077 | Medium | Exfiltration of hashed SMB credentials on Windows via file:// redirect | 1 | 0 | no | 0.6% |
GHSA-p2rr-rvmm-c5fpCVE-2026-70612 | Medium | Electron: Sandboxed iframes can launch external protocol handlers | 1 | 0 | no | 0.4% |
GHSA-p423-j2cm-9vmqCVE-2026-39892 | Medium | Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs | 1 | 0 | no | 0.7% |
GHSA-p458-7748-mcp3CVE-2026-112948 | Medium | Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file | 1 | 0 | no | 0.4% |
GHSA-p538-c434-8v24 | Medium | GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count | 1 | 0 | no | — |
GHSA-p634-w6r4-rjp2 | Medium | adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content | 1 | 0 | no | — |
GHSA-p77w-8qqv-26rmCVE-2026-44457 | Medium | Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakage | 1 | 0 | no | 0.2% |
GHSA-p7v2-p9m8-qqg7CVE-2023-29198 | Medium | Electron context isolation bypass via nested unserializable return value | 1 | 0 | no | 0.6% |
GHSA-p88m-4jfj-68fvCVE-2026-9679 | Medium | undici vulnerable to HTTP header injection via Set-Cookie percent-decoding | 1 | 0 | no | 0.3% |
GHSA-p9f8-wvj8-2fg8CVE-2026-81869 | Medium | OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation | 1 | 0 | no | 0.2% |
GHSA-p9pc-299p-vxgpCVE-2020-7608 | Medium | yargs-parser Vulnerable to Prototype Pollution | 1 | 0 | no | 0.5% |
GHSA-pfq2-hh62-7m96 | Medium | Renovate vulnerable to arbitrary command injection via Gradle Wrapper and malicious `distributionUrl` | 1 | 0 | no | — |
GHSA-pmv8-rq9r-6j72CVE-2026-67312 | Medium | Axios: Deep formToJSON Key Recursion Can Cause Denial of Service | 1 | 0 | no | 0.5% |
GHSA-pp7h-53gx-mx7rCVE-2020-8244 | Medium | Remote Memory Exposure in bl | 1 | 0 | no | 2.1% |
GHSA-pqxq-w44r-73xwCVE-2026-111750 | Medium | AIOHTTP: Pure-Python parser request smuggling | 1 | 0 | no | 0.4% |
GHSA-px8p-9vwx-vf98CVE-2026-45820 | Medium | fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archives | 1 | 0 | no | 0.3% |
GHSA-q6x5-8v7m-xcrfCVE-2026-44288 | Medium | protobufjs has overlong UTF-8 decoding | 1 | 0 | no | 0.3% |
GHSA-q7cg-457f-vx79CVE-2026-48038 | Medium | joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas | 1 | 0 | no | 0.5% |
GHSA-q89c-q3h5-w34gCVE-2026-41691 | Medium | i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns | 1 | 0 | no | 0.3% |
GHSA-q8wf-6r8g-63chCVE-2026-64644 | Medium | Next.js: Denial of Service in the Image Optimization API using SVGs | 1 | 0 | no | 0.7% |
GHSA-qmgc-5h2g-mvrwCVE-2026-22701 | Medium | filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock | 1 | 0 | no | 0.1% |
GHSA-qp7p-654g-cw7pCVE-2026-44458 | Medium | Hono has CSS Declaration Injection via Style Object Values in JSX SSR | 1 | 0 | no | 0.2% |
GHSA-qqj6-54q6-cxv6CVE-2026-86597 | Medium | Snowflake drivers writes sensitive information to logs | 1 | 0 | no | 0.1% |
GHSA-qrpm-p2h7-hrv2CVE-2021-23566 | Medium | Exposure of Sensitive Information to an Unauthorized Actor in nanoid | 1 | 0 | no | 0.4% |
GHSA-qwph-4952-7xr6CVE-2022-23540 | Medium | jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() | 1 | 0 | no | 0.6% |
GHSA-r47g-fvhr-h676CVE-2026-49459 | Medium | DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM | 1 | 0 | no | 0.4% |
GHSA-r48c-v28r-pf6vCVE-2026-44430 | Medium | MCP Registry has an unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-addr | 1 | 0 | no | 0.3% |
GHSA-r4q5-vmmm-2653 | Medium | follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets | 1 | 0 | no | — |
GHSA-r5p7-gp4j-qhrxCVE-2026-34777 | Medium | Electron: Incorrect origin passed to permission request handler for iframe requests | 1 | 0 | no | 0.1% |
GHSA-r7w9-592q-9vg4CVE-2026-118266 | Medium | Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method | 1 | 0 | no | 0.2% |
GHSA-rjcw-vg7j-m9rcCVE-2026-33481 | Medium | Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions | 1 | 0 | no | 0.4% |
GHSA-rp9w-3fw7-7cwqCVE-2026-49978 | Medium | DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content | 1 | 0 | no | 0.4% |
GHSA-rqv2-m695-f8j4CVE-2026-44429 | Medium | MCP Registry vulnerable to stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl` | 1 | 0 | no | 0.2% |
GHSA-rv63-4mwf-qqc2CVE-2026-54288 | Medium | hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length` | 1 | 0 | no | 0.1% |
GHSA-rxcj-4pj5-74grCVE-2026-107222 | Medium | Excelize: GetConditionalFormats indexes conditional-formatting rule sub-elements with no length or nil check | 1 | 0 | no | 0.3% |
GHSA-v3r7-h72x-cjcmCVE-2026-16729 | Medium | undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields | 1 | 0 | no | 0.3% |
GHSA-v64r-4m7r-3mvqCVE-2026-70605 | Medium | Electron: HTTP redirect followed into local file loader | 1 | 0 | no | 0.3% |
GHSA-v753-g4cw-jm48CVE-2026-118656 | Medium | Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI | 1 | 0 | no | 0.2% |
GHSA-v8vw-gw5j-w7m6CVE-2026-44427 | Medium | MCP Registry has open redirect via protocol-relative path in trailing-slash middleware | 1 | 0 | no | 0.5% |
GHSA-v93f-fgjr-hjrjCVE-2026-70607 | Medium | Electron: window.open features string controls some window options considered privileged | 1 | 0 | no | 0.6% |
GHSA-v9jr-rg53-9pgpCVE-2026-41238 | Medium | DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback | 1 | 0 | no | 0.3% |
GHSA-vh95-rmgr-6w4mCVE-2020-7598 | Medium | Prototype Pollution in minimist | 1 | 0 | no | 1.9% |
GHSA-vmqv-hx8q-j7mgCVE-2025-55305 | Medium | Electron has ASAR Integrity Bypass via resource modification | 1 | 0 | no | 0.3% |
GHSA-vv43-5jgx-7qv8CVE-2026-102672 | Medium | Electron: Local race condition in Squirrel.Mac update installation on macOS | 1 | 0 | no | 0.1% |
GHSA-vwc7-r8mq-g2x9CVE-2026-76845 | Medium | adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite | 1 | 0 | no | 0.2% |
GHSA-w2qp-rph6-63g4CVE-2026-18504 | Medium | fastify vulnerable to schema validation bypass via root primitive coercion mismatch | 1 | 0 | no | 0.3% |
GHSA-w5pp-99ch-qj29 | Medium | go-git: Malformed Git object data may cause panics or resource exhaustion | 1 | 0 | no | — |
GHSA-w62v-xxxg-mg59CVE-2026-59895 | Medium | Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility | 1 | 0 | no | 0.3% |
GHSA-w6j9-cwv2-h6wqCVE-2026-102274 | Medium | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set | 1 | 0 | no | 0.5% |
GHSA-w6r9-248c-frg8CVE-2026-107386 | Medium | amqp091-go: Pre-negotiation frame limit is not enforced to 4KB | 1 | 0 | no | 0.5% |
GHSA-w853-jp5j-5j7fCVE-2025-68146 | Medium | filelock has a TOCTOU race condition which allows symlink attacks during lock file creation | 1 | 0 | no | 0.2% |
GHSA-w8qv-6jwh-64r5CVE-2021-23364 | Medium | Regular Expression Denial of Service in browserslist | 1 | 0 | no | 2.4% |
GHSA-wf5p-g6vw-rhxxCVE-2023-45857 | Medium | Axios Cross-Site Request Forgery Vulnerability | 1 | 0 | no | 0.7% |
GHSA-wfc6-r584-vfw7CVE-2026-44576 | Medium | Next.js vulnerable to cache poisoning in React Server Component responses | 1 | 0 | no | 0.3% |
GHSA-wgpf-jwqj-8h8pCVE-2026-54289 | Medium | hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest | 1 | 0 | no | 0.2% |
GHSA-whh4-5q6c-9v3x | Medium | GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle | 1 | 0 | no | — |
GHSA-wwfh-h76j-fc44CVE-2026-54286 | Medium | hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) | 1 | 0 | no | 0.4% |
GHSA-x562-297c-g43gCVE-2026-113798 | Medium | Electron: Pointer lock permission requests can be attributed to the wrong frame | 1 | 0 | no | 0.2% |
GHSA-x5rq-j2xg-h7qmCVE-2019-1010266 | Medium | Regular Expression Denial of Service (ReDoS) in lodash | 1 | 0 | no | 3.0% |
GHSA-x746-7m8f-x49cCVE-2026-48817 | Medium | Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` | 1 | 0 | no | 0.2% |
GHSA-x7hr-w5r2-h6wgCVE-2024-53382 | Medium | PrismJS DOM Clobbering vulnerability | 1 | 0 | no | 0.3% |
GHSA-xcgm-r5h9-7989CVE-2026-54274 | Medium | aiohttp: Incomplete websocket frame payloads bypass memory limits | 1 | 0 | no | 0.5% |
GHSA-xgm2-5f3f-mvvcCVE-2026-59897 | Medium | Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication | 1 | 0 | no | 0.2% |
GHSA-xj5x-m3f3-5x3hCVE-2026-34778 | Medium | Electron: Service worker can spoof executeJavaScript IPC replies | 1 | 0 | no | 0.1% |
GHSA-xj69-m9qq-8m94CVE-2026-31961 | Medium | Quill provides simple mac binary signing and notarization from any platform. Quill before version v0.7.1 contains an unbounded memory alloca | 1 | 0 | no | 0.1% |
GHSA-xj6q-8x83-jv6gCVE-2026-67314 | Medium | Axios: Prototype pollution auth subfields can inject Basic auth | 1 | 0 | no | 0.4% |
GHSA-xmrv-pmrh-hhx2 | Medium | Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream Decoder | 1 | 0 | no | — |
GHSA-xrhx-7g5j-rcj5CVE-2026-47674 | Medium | Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 | 1 | 0 | no | 0.2% |
GHSA-xvg9-69gf-fjrfCVE-2026-73295 | Medium | Material for MkDocs: DOM XSS in search suggestions via query parameter | 1 | 0 | no | 0.3% |
GHSA-xwq5-6cqp-vx96CVE-2026-118655 | Medium | Echo has a Static Middleware Double-Unescape Path Traversal | 1 | 0 | no | 0.3% |
GHSA-xwr5-m59h-vwqrCVE-2026-34775 | Medium | Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes | 1 | 0 | no | 0.3% |
GO-2026-5024CVE-2026-39824 | Low | NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeStri | 12 | 0 | no | 0.1% |
GHSA-333x-w4r6-6crpCVE-2026-110725 | Low | fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references | 8 | 0 | no | 0.3% |
GHSA-xhq7-xmqj-769hCVE-2026-110095 | Low | fast-uri vulnerable to improper path equivalence in relative reference normalization | 8 | 0 | no | 0.3% |
GHSA-4x5r-pxfx-6jf8CVE-2026-49356 | Low | @babel/core: Arbitrary File Read via sourceMappingURL Comment | 5 | 0 | no | 0.2% |
GHSA-73rr-hh4g-fpgxCVE-2026-24001 | Low | jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch | 5 | 0 | no | 0.6% |
GHSA-gcqx-w48m-w2h4CVE-2026-93753 | Low | deepmerge mergeObject() allows prototype poisoning of returned objects | 5 | 0 | no | 0.5% |
GHSA-v422-hmwv-36x6CVE-2026-12590 | Low | body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement | 5 | 0 | no | 0.4% |
GHSA-xmj3-9gf7-h52w | Low | setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description | 5 | 0 | no | — |
GHSA-4487-j8r4-4g2fCVE-2026-118780 | Low | Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store | 4 | 0 | no | 0.2% |
GHSA-4642-5mcj-2rqwCVE-2026-118775 | Low | Forge: ASN.1 OID first arc truncation in asn1.oidToDer | 4 | 0 | no | 0.3% |
GHSA-h6cr-wjv9-3cppCVE-2026-118781 | Low | Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) | 4 | 0 | no | 0.1% |
GHSA-m5mm-p8h7-m29vCVE-2026-115897 | Low | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body | 4 | 0 | no | 0.3% |
GHSA-v6h2-p8h4-qcjwCVE-2025-5889 | Low | brace-expansion Regular Expression Denial of Service vulnerability | 4 | 0 | no | 0.6% |
GHSA-vfgh-jcmw-g37qCVE-2026-111766 | Low | markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled | 4 | 0 | no | 0.4% |
GHSA-442j-39wm-28r2 | Low | Handlebars.js has a Property Access Validation Bypass in container.lookup | 3 | 0 | no | — |
GHSA-5239-wwwm-4pmqCVE-2026-4539 | Low | Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching | 3 | 0 | no | 0.2% |
GHSA-567q-5qvw-pf92CVE-2026-112907 | Low | filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break | 3 | 0 | no | — |
GHSA-9jrq-w75r-8gcwCVE-2026-112945 | Low | Vite: Cross origin script execution through Vite custom middleware | 3 | 0 | no | 0.7% |
GHSA-9vhv-jxww-xfm5CVE-2026-112913 | Low | filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database | 3 | 0 | no | — |
GHSA-r53p-7pc4-xj5rCVE-2026-18540 | Low | undici vulnerable to downstream response splitting via retry interceptor | 3 | 0 | no | 0.3% |
GHSA-w7fw-mjwx-w883CVE-2026-2391 | Low | qs's arrayLimit bypass in comma parsing allows denial of service | 3 | 0 | no | 0.5% |
GHSA-2gqq-gqf2-x968CVE-2026-84947 | Low | undici vulnerable to response truncation via oversized chunked responses in the dump interceptor | 2 | 0 | no | 0.2% |
GHSA-494p-63j8-28p3CVE-2026-113714 | Low | virtualenv: Downloaded wheel selection and caching precede verification | 2 | 0 | no | 0.2% |
GHSA-52f5-9888-hmc6CVE-2025-54798 | Low | tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter | 2 | 0 | no | 0.4% |
GHSA-6688-9rhm-gjv2 | Low | DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes | 2 | 0 | no | — |
GHSA-6w3j-5fw6-r9vrCVE-2026-84368 | Low | joi: Prototype pollution via a `__proto__` language key in custom messages | 2 | 0 | no | 0.4% |
GHSA-76c9-3jph-rj3qCVE-2025-7339 | Low | on-headers is vulnerable to http response header manipulation | 2 | 0 | no | 0.2% |
GHSA-8436-99hf-9mmvCVE-2026-85008 | Low | undici vulnerable to caching and replay of unsafe HTTP method responses | 2 | 0 | no | 0.1% |
GHSA-866g-f22w-33x8CVE-2026-8769 | Low | @ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue | 2 | 0 | no | 0.6% |
GHSA-9j6q-wvj5-jgjgCVE-2026-112912 | Low | filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker | 2 | 0 | no | 0.2% |
GHSA-c6gr-qvv4-5v3f | Low | DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml | 2 | 0 | no | — |
GHSA-cm22-4g7w-348pCVE-2024-43800 | Low | serve-static vulnerable to template injection that can lead to XSS | 2 | 0 | no | 0.6% |
GHSA-cx28-75q4-x26qCVE-2026-113717 | Low | virtualenv: Pip seeding with download omits wheel digest verification | 2 | 0 | no | 0.3% |
GHSA-gg4h-3hg2-grpcCVE-2026-84367 | Low | joi: object().rename() with a template target can set the validated object's prototype | 2 | 0 | no | 0.4% |
GHSA-h2v8-394m-p7vv | Low | Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication. | 2 | 0 | no | — |
GHSA-m6fv-jmcg-4jfgCVE-2024-43799 | Low | send vulnerable to template injection that can lead to XSS | 2 | 0 | no | 0.5% |
GHSA-pxg6-pf52-xh8xCVE-2024-47764 | Low | cookie accepts cookie name, path, and domain with out of bounds characters | 2 | 0 | no | 0.7% |
GHSA-qmx5-4p3x-wvqfCVE-2026-113715 | Low | virtualenv: Venv configuration readback can reinterpret path boundaries | 2 | 0 | no | 0.2% |
GHSA-qw6h-vgh9-j6wxCVE-2024-43796 | Low | express vulnerable to XSS via response.redirect() | 2 | 0 | no | 0.5% |
GHSA-v9pg-7xvm-68hfCVE-2026-53540 | Low | python-multipart: Negative Content-Length in parse_form buffers the entire body in memory | 2 | 0 | no | 0.3% |
GHSA-w44r-93j7-qv28 | Low | rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share | 2 | 0 | no | — |
GHSA-xhjh-pmcv-23jwCVE-2026-42040 | Low | Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams | 2 | 0 | no | 0.2% |
GHSA-238p-pmpm-9mq7CVE-2026-103923 | Low | KaTeX: Existing prototype pollution can bypass trust restrictions | 1 | 0 | no | 0.3% |
GHSA-248v-346w-9cwcCVE-2024-39689 | Low | Certifi removes GLOBALTRUST root certificate | 1 | 0 | no | 1.0% |
GHSA-2fqr-mr3j-6wp8CVE-2026-54279 | Low | aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence | 1 | 0 | no | 0.5% |
GHSA-2v5f-5r6w-p67rCVE-2026-45781 | Low | MCP Registry: OCI validator skips ownership check on upstream rate limits | 1 | 0 | no | 0.2% |
GHSA-35p6-xmwp-9g52CVE-2026-6733 | Low | undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse | 1 | 0 | no | 0.2% |
GHSA-38r7-794h-5758CVE-2025-68157 | Low | webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence | 1 | 0 | no | 0.2% |
GHSA-39w2-rjm5-chcvCVE-2026-94486 | Low | Next.js has information disclosure in development server's Model Context Protocol endpoint | 1 | 0 | no | 0.1% |
GHSA-3cmx-xjww-583xCVE-2026-118258 | Low | i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string | 1 | 0 | no | 0.3% |
GHSA-3g8h-86w9-wvmqCVE-2026-44572 | Low | Next.js's Middleware / Proxy redirects can be cache-poisoned | 1 | 0 | no | 0.3% |
GHSA-3p22-ghq8-v749CVE-2022-21718 | Low | Renderers can obtain access to random bluetooth device without permission in Electron | 1 | 0 | no | 0.9% |
GHSA-3qxv-5xgr-q7w9CVE-2026-114122 | Low | Electron: Frame subscription trusts GPU-supplied frame geometry | 1 | 0 | no | 0.2% |
GHSA-4m7w-qmgq-4wj5CVE-2026-54275 | Low | aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections | 1 | 0 | no | 0.5% |
GHSA-4vq8-7jfc-9cvpCVE-2025-54410 | Low | Moby firewalld reload removes bridge network isolation | 1 | 0 | no | 0.2% |
GHSA-4x5v-gmq8-25chCVE-2021-43307 | Low | Regular expression denial of service in semver-regex | 1 | 0 | no | 1.6% |
GHSA-6475-r3vj-m8vf | Low | AWS SDK for JavaScript v3 adopted defense in depth enhancement for region parameter value | 1 | 0 | no | — |
GHSA-6hxq-p678-4hr2 | Low | SimpleWebAuthn: Registration verification does not sufficiently ensure that attestation certificates chain to a trust anchor | 1 | 0 | no | — |
GHSA-6jv3-5f52-599mCVE-2026-53538 | Low | python-multipart: Semicolon treated as querystring field separator enables parameter smuggling | 1 | 0 | no | 0.3% |
GHSA-6vrv-94jv-crrgCVE-2020-15096 | Low | Context isolation bypass via Promise in Electron | 1 | 0 | no | 0.8% |
GHSA-78xj-cgh5-2h22CVE-2023-42282 | Low | NPM IP package incorrectly identifies some private IP addresses as public | 1 | 0 | no | 1.6% |
GHSA-79qm-7rj5-m7r9CVE-2026-71849 | Low | Hono: Proxy Helper does not remove response headers listed in the `Connection` header | 1 | 0 | no | 0.4% |
GHSA-848j-6mx2-7j84CVE-2025-14505 | Low | Elliptic Uses a Cryptographic Primitive with a Risky Implementation | 1 | 0 | no | 0.2% |
GHSA-8fgc-7cc6-rx7xCVE-2025-68458 | Low | webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior | 1 | 0 | no | 0.2% |
GHSA-95c3-6vvw-4mrqCVE-2026-44428 | Low | MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience | 1 | 0 | no | 0.2% |
GHSA-9899-m83m-qhpjCVE-2026-34766 | Low | Electron: USB device selection not validated against filtered device list | 1 | 0 | no | 0.2% |
GHSA-98mx-cjp9-gchmCVE-2026-113797 | Low | Electron: Extension tabs.query returns tab URLs and titles without the tabs permission | 1 | 0 | no | 0.6% |
GHSA-9jhj-wvmw-cfx5CVE-2026-115730 | Low | i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (byp | 1 | 0 | no | 0.3% |
GHSA-9x8q-7h8h-wcw9CVE-2026-54280 | Low | aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect | 1 | 0 | no | 0.5% |
GHSA-c2j3-45gr-mqc4CVE-2026-66010 | Low | DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements. | 1 | 0 | no | 0.2% |
GHSA-f37v-82c4-4x64CVE-2026-34781 | Low | Electron: Crash in clipboard.readImage() on malformed clipboard image data | 1 | 0 | no | 0.1% |
GHSA-f596-whhp-79r4CVE-2026-101915 | Low | @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages | 1 | 0 | no | 0.3% |
GHSA-fj3w-jwp8-x2g3CVE-2026-27942 | Low | fast-xml-parser has stack overflow in XMLBuilder with preserveOrder | 1 | 0 | no | 0.5% |
GHSA-g7r4-m6w7-qqqr | Low | esbuild allows arbitrary file read when running the development server on Windows | 1 | 0 | no | — |
GHSA-g8m3-5g58-fq7mCVE-2026-11525 | Low | undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching | 1 | 0 | no | 0.2% |
GHSA-gm2x-2g9h-ccm8CVE-2026-33762 | Low | go-git missing validation decoding Index v4 files leads to panic | 1 | 0 | no | 0.2% |
GHSA-gvmj-g25r-r7wrCVE-2026-65900 | Low | DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes | 1 | 0 | no | 0.3% |
GHSA-gx76-c99x-2c96CVE-2026-111749 | Low | AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies | 1 | 0 | no | 0.4% |
GHSA-gxpj-cx7g-858cCVE-2017-16137 | Low | Regular Expression Denial of Service in debug | 1 | 0 | no | 2.8% |
GHSA-h3v5-h239-pg29CVE-2026-114124 | Low | Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry | 1 | 0 | no | 0.2% |
GHSA-hm8q-7f3q-5f36CVE-2026-44459 | Low | Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify() | 1 | 0 | no | 0.2% |
GHSA-j965-2qgj-vjmq | Low | JavaScript SDK v2 users should add validation to the region parameter value in or migrate to v3 | 1 | 0 | no | — |
GHSA-jfqx-fxh3-c62jCVE-2026-34768 | Low | Electron: Unquoted executable path in app.setLoginItemSettings on Windows | 1 | 0 | no | 0.1% |
GHSA-jp82-jpqv-5vv3CVE-2026-54282 | Low | Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname | 1 | 0 | no | 0.3% |
GHSA-m6qw-4cw2-hm4mCVE-2026-50269 | Low | aiohttp: CRLF injection in multipart headers | 1 | 0 | no | 0.5% |
GHSA-m7cr-m3pv-hgrpCVE-2026-45570 | Low | go-git: Improper single-quote escaping in go-git SSH transport | 1 | 0 | no | 0.4% |
GHSA-m959-cc7f-wv43CVE-2026-34073 | Low | cryptography has incomplete DNS name constraint enforcement on peer names | 1 | 0 | no | 0.2% |
GHSA-mq8j-3h7h-p8g7CVE-2022-29247 | Low | Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled | 1 | 0 | no | 1.0% |
GHSA-p98j-92pf-mc4p | Low | DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS | 1 | 0 | no | — |
GHSA-pfmc-3mgc-p6fpCVE-2026-70598 | Low | Electron: Off-screen rendering trusts GPU-supplied geometry over shared-memory size | 1 | 0 | no | 0.1% |
GHSA-vffw-93wf-4j4qCVE-2026-53537 | Low | python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters | 1 | 0 | no | 0.3% |
GHSA-vfv6-92ff-j949CVE-2026-44582 | Low | Next.js vulnerable to cache poisoning via collisions in React Server Component cache-busting | 1 | 0 | no | 0.2% |
GHSA-vpq2-c234-7xj6CVE-2026-3449 | Low | @tootallnate/once vulnerable to Incorrect Control Flow Scoping | 1 | 0 | no | 0.1% |
GHSA-vxmw-7h4f-hqxh | Low | PyPI publish GitHub Action vulnerable to injectable expression expansions in action steps | 1 | 0 | no | — |
GHSA-vxr8-fq34-vvx9CVE-2026-65899 | Low | DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output | 1 | 0 | no | 0.4% |
GHSA-w9m9-85wc-3x92CVE-2026-9358 | Low | postcss-selector-parser allows denial of service through uncontrolled AST recursion | 1 | 0 | no | 0.3% |
GHSA-wxhq-pm8v-cw75 | Low | Regular Expression Denial of Service in clean-css | 1 | 0 | no | — |
GHSA-x4vx-rjvf-j5p4CVE-2026-65901 | Low | DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supp | 1 | 0 | no | 0.3% |
GHSA-x8rc-wpg4-grpfCVE-2026-70600 | Low | Electron: Cross-origin iframe can position native autofill popup | 1 | 0 | no | 0.2% |
GHSA-xvq9-wjp8-hwqfCVE-2026-105800 | Low | i18next-http-backend incomplete URL validation permits SSRF | 1 | 0 | no | 0.3% |
GHSA-3fxj-6jh8-hvhxGO-2026-5774 | Unknown | Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi | 1 | 0 | no | — |
GHSA-9g5q-2w5x-hmxfGO-2026-5775 | Unknown | Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi | 1 | 0 | no | — |
GHSA-rjr7-jggh-pgcpGO-2026-5777 | Unknown | Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi | 1 | 0 | no | — |
Vulnerabilities are known advisories that Grype matches against the dependencies declared in each project's release source (manifests and lockfiles, including development and build dependencies). A match does not mean the tool is exploitable: the vulnerable code may be unused, test-only, or not shipped in the released binary.