{ "history": [ { "added": 0, "commit": "75a67ea9cb6d0fdf35ff185d08dad0d45587e6f7", "date": "2026-11-01", "dependencies": 163, "errors": [], "fixable": 35, "go_version": null, "in_binary": null, "new_vulnerabilities": 0, "osv_confirmed": 34, "osv_only": 100, "ref": "0.9.1", "release_changed": false, "release_integrity": "no-assets", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": 5.7, "upgraded": 0, "vulnerabilities": { "Critical": 3, "High": 16, "Low": 2, "Medium": 15, "Negligible": 0, "Unknown": 0 }, "workflow": { "High": 0, "Low": 0, "Medium": 1, "files": 7 } }, { "added": 842, "commit": "75a67ea9cb6d0fdf35ff185d08dad0d45587e6f7", "date": "2026-11-02", "dependencies": 1005, "errors": [], "fixable": 144, "go_version": null, "in_binary": null, "kev": 0, "kev_new": 0, "new_vulnerabilities": 95, "osv_confirmed": 144, "osv_only": 0, "ref": "0.9.1", "release_changed": false, "release_integrity": "no-assets", "removed": 0, "resolved_vulnerabilities": 1, "scorecard": 5.7, "scorecard_date": "2026-10-26", "scorecard_note": null, "scorecard_source": "openssf-api", "upgraded": 0, "vulnerabilities": { "Critical": 5, "High": 67, "Low": 16, "Medium": 57, "Negligible": 0, "Unknown": 0 }, "vulnerable_packages": 50, "workflow": { "High": 0, "Low": 0, "Medium": 1, "files": 7 } } ], "latest": { "archived": false, "category": "Cloud Security", "changes": { "added": [ "@achrinza/node-ipc@9.2.10", "@babel/code-frame@7.29.0", "@babel/compat-data@7.29.0", "@babel/core@7.29.0", "@babel/eslint-parser@7.28.6", "@babel/helper-annotate-as-pure@7.27.3", "@babel/helper-compilation-targets@7.28.6", "@babel/helper-create-class-features-plugin@7.28.6", "@babel/helper-create-regexp-features-plugin@7.28.5", "@babel/helper-define-polyfill-provider@0.6.6", "@babel/helper-globals@7.28.0", "@babel/helper-member-expression-to-functions@7.28.5", "@babel/helper-module-imports@7.28.6", "@babel/helper-module-transforms@7.28.6", "@babel/helper-optimise-call-expression@7.27.1", "@babel/helper-plugin-utils@7.28.6", "@babel/helper-remap-async-to-generator@7.27.1", "@babel/helper-replace-supers@7.28.6", "@babel/helper-skip-transparent-expression-wrappers@7.27.1", "@babel/helper-validator-option@7.27.1", "@babel/helper-wrap-function@7.28.6", "@babel/helpers@7.28.6", "@babel/plugin-bugfix-firefox-class-in-computed-class-key@7.28.5", "@babel/plugin-bugfix-safari-class-field-initializer-scope@7.27.1", "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@7.27.1", "@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining@7.27.1", "@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly@7.28.6", "@babel/plugin-proposal-class-properties@7.18.6", "@babel/plugin-proposal-decorators@7.29.0", "@babel/plugin-proposal-private-property-in-object@7.21.0-placeholder-for-preset-env.2", "@babel/plugin-syntax-decorators@7.28.6", "@babel/plugin-syntax-dynamic-import@7.8.3", "@babel/plugin-syntax-import-assertions@7.28.6", "@babel/plugin-syntax-import-attributes@7.28.6", "@babel/plugin-syntax-jsx@7.28.6", "@babel/plugin-syntax-unicode-sets-regex@7.18.6", "@babel/plugin-transform-arrow-functions@7.27.1", "@babel/plugin-transform-async-generator-functions@7.29.0", "@babel/plugin-transform-async-to-generator@7.28.6", "@babel/plugin-transform-block-scoped-functions@7.27.1", "@babel/plugin-transform-block-scoping@7.28.6", "@babel/plugin-transform-class-properties@7.28.6", "@babel/plugin-transform-class-static-block@7.28.6", "@babel/plugin-transform-classes@7.28.6", "@babel/plugin-transform-computed-properties@7.28.6", "@babel/plugin-transform-destructuring@7.28.5", "@babel/plugin-transform-dotall-regex@7.28.6", "@babel/plugin-transform-duplicate-keys@7.27.1", "@babel/plugin-transform-duplicate-named-capturing-groups-regex@7.29.0", "@babel/plugin-transform-dynamic-import@7.27.1", "@babel/plugin-transform-explicit-resource-management@7.28.6", "@babel/plugin-transform-exponentiation-operator@7.28.6", "@babel/plugin-transform-export-namespace-from@7.27.1", "@babel/plugin-transform-for-of@7.27.1", "@babel/plugin-transform-function-name@7.27.1", "@babel/plugin-transform-json-strings@7.28.6", "@babel/plugin-transform-literals@7.27.1", "@babel/plugin-transform-logical-assignment-operators@7.28.6", "@babel/plugin-transform-member-expression-literals@7.27.1", "@babel/plugin-transform-modules-amd@7.27.1", "@babel/plugin-transform-modules-commonjs@7.28.6", "@babel/plugin-transform-modules-systemjs@7.29.4", "@babel/plugin-transform-modules-umd@7.27.1", "@babel/plugin-transform-named-capturing-groups-regex@7.29.0", "@babel/plugin-transform-new-target@7.27.1", "@babel/plugin-transform-nullish-coalescing-operator@7.28.6", "@babel/plugin-transform-numeric-separator@7.28.6", "@babel/plugin-transform-object-rest-spread@7.28.6", "@babel/plugin-transform-object-super@7.27.1", "@babel/plugin-transform-optional-catch-binding@7.28.6", "@babel/plugin-transform-optional-chaining@7.28.6", "@babel/plugin-transform-parameters@7.27.7", "@babel/plugin-transform-private-methods@7.28.6", "@babel/plugin-transform-private-property-in-object@7.28.6", "@babel/plugin-transform-property-literals@7.27.1", "@babel/plugin-transform-regenerator@7.29.0", "@babel/plugin-transform-regexp-modifiers@7.28.6", "@babel/plugin-transform-reserved-words@7.27.1", "@babel/plugin-transform-runtime@7.29.0", "@babel/plugin-transform-shorthand-properties@7.27.1", "@babel/plugin-transform-spread@7.28.6", "@babel/plugin-transform-sticky-regex@7.27.1", "@babel/plugin-transform-template-literals@7.27.1", "@babel/plugin-transform-typeof-symbol@7.27.1", "@babel/plugin-transform-unicode-escapes@7.27.1", "@babel/plugin-transform-unicode-property-regex@7.28.6", "@babel/plugin-transform-unicode-regex@7.27.1", "@babel/plugin-transform-unicode-sets-regex@7.28.6", "@babel/preset-env@7.29.0", "@babel/preset-modules@0.1.6-no-external-plugins", "@babel/runtime@7.28.6", "@babel/template@7.28.6", "@babel/traverse@7.29.0", "@discoveryjs/json-ext@0.5.7", "@eslint-community/eslint-utils@4.9.1", "@eslint-community/regexpp@4.12.2", "@eslint/eslintrc@2.1.4", "@eslint/js@8.57.1", "@hapi/hoek@9.3.0", "@hapi/topo@5.1.0", "@humanwhocodes/config-array@0.13.0", "@humanwhocodes/module-importer@1.0.1", "@humanwhocodes/object-schema@2.0.3", "@isaacs/cliui@8.0.2", "@jridgewell/source-map@0.3.11", "@leichtgewicht/ip-codec@2.0.5", "@nicolo-ribaudo/eslint-scope-5-internals@5.1.1-v1", "@node-ipc/js-queue@2.0.3", "@nodelib/fs.scandir@2.1.5", "@nodelib/fs.stat@2.0.5", "@nodelib/fs.walk@1.2.8", "@pkgjs/parseargs@0.11.0", "@polka/url@1.0.0-next.29", "@sideway/address@4.1.5", "@sideway/formula@3.0.1", "@sideway/pinpoint@2.0.0", "@soda/friendly-errors-webpack-plugin@1.8.1", "@soda/get-current-script@1.0.2", "@types/body-parser@1.19.6", "@types/bonjour@3.5.13", "@types/connect@3.4.38", "@types/connect-history-api-fallback@1.5.4", "@types/eslint@8.56.12", "@types/eslint-scope@3.7.7", "@types/estree@1.0.8", "@types/express@4.17.25", "@types/express-serve-static-core@4.19.8", "@types/express-serve-static-core@5.1.1", "@types/html-minifier-terser@6.1.0", "@types/http-errors@2.0.5", "@types/http-proxy@1.17.17", "@types/json-schema@7.0.15", "@types/mime@1.3.5", "@types/minimist@1.2.5", "@types/node@25.3.2", "@types/node-forge@1.3.14", "@types/normalize-package-data@2.4.4", "@types/parse-json@4.0.2", "@types/qs@6.14.0", "@types/range-parser@1.2.7", "@types/retry@0.12.0", "@types/send@0.17.6", "@types/send@1.2.1", "@types/serve-index@1.9.4", "@types/serve-static@1.15.10", "@types/sockjs@0.3.36", "@types/ws@8.18.1", "@ungap/structured-clone@1.3.0", "@vue/babel-helper-vue-jsx-merge-props@1.4.0", "@vue/babel-helper-vue-transform-on@1.5.0", "@vue/babel-plugin-jsx@1.5.0", "@vue/babel-plugin-resolve-type@1.5.0", "@vue/babel-plugin-transform-vue-jsx@1.4.0", "@vue/babel-preset-app@5.0.9", "@vue/babel-preset-jsx@1.4.0", "@vue/babel-sugar-composition-api-inject-h@1.4.0", "@vue/babel-sugar-composition-api-render-instance@1.4.0", "@vue/babel-sugar-functional-vue@1.4.0", "@vue/babel-sugar-inject-h@1.4.0", "@vue/babel-sugar-v-model@1.4.0", "@vue/babel-sugar-v-on@1.4.0", "@vue/cli-overlay@5.0.9", "@vue/cli-plugin-babel@5.0.9", "@vue/cli-plugin-eslint@5.0.9", "@vue/cli-plugin-router@5.0.9", "@vue/cli-plugin-vuex@5.0.9", "@vue/cli-service@5.0.9", "@vue/cli-shared-utils@5.0.9", "@vue/component-compiler-utils@3.3.0", "@vue/web-component-wrapper@1.3.0", "@webassemblyjs/ast@1.14.1", "@webassemblyjs/floating-point-hex-parser@1.13.2", "@webassemblyjs/helper-api-error@1.13.2", "@webassemblyjs/helper-buffer@1.14.1", "@webassemblyjs/helper-numbers@1.13.2", "@webassemblyjs/helper-wasm-bytecode@1.13.2", "@webassemblyjs/helper-wasm-section@1.14.1", "@webassemblyjs/ieee754@1.13.2", "@webassemblyjs/leb128@1.13.2", "@webassemblyjs/utf8@1.13.2", "@webassemblyjs/wasm-edit@1.14.1", "@webassemblyjs/wasm-gen@1.14.1", "@webassemblyjs/wasm-opt@1.14.1", "@webassemblyjs/wasm-parser@1.14.1", "@webassemblyjs/wast-printer@1.14.1", "@xtuc/ieee754@1.2.0", "@xtuc/long@4.2.2", "accepts@1.3.8", "acorn-import-phases@1.0.4", "acorn-jsx@5.3.2", "acorn-walk@8.3.5", "address@1.2.2", "ajv@6.14.0", "ajv@8.18.0", "ajv-formats@2.1.1", "ajv-keywords@3.5.2", "ajv-keywords@5.1.0", "ansi-escapes@3.2.0", "ansi-html-community@0.0.8", "ansi-regex@3.0.1", "ansi-regex@5.0.1", "ansi-regex@6.2.2", "ansi-styles@3.2.1", "ansi-styles@4.3.0", "ansi-styles@6.2.3", "any-promise@1.3.0", "anymatch@3.1.3", "arch@2.2.0", "argparse@2.0.1", "array-flatten@1.1.1", "array-union@2.1.0", "async@3.2.6", "at-least-node@1.0.0", "autoprefixer@10.4.27", "babel-loader@8.4.1", "babel-plugin-dynamic-import-node@2.3.3", "babel-plugin-polyfill-corejs2@0.4.15", "babel-plugin-polyfill-corejs3@0.13.0", "babel-plugin-polyfill-corejs3@0.14.0", "babel-plugin-polyfill-regenerator@0.6.6", "balanced-match@1.0.2", "base64-js@1.5.1", "baseline-browser-mapping@2.10.0", "batch@0.6.1", "big.js@5.2.2", "binary-extensions@2.3.0", "bl@4.1.0", "bluebird@3.7.2", "body-parser@1.20.5", "bonjour-service@1.3.0", "boolbase@1.0.0", "brace-expansion@1.1.12", "brace-expansion@2.0.2", "braces@3.0.3", "browser-stdout@1.3.1", "browserslist@4.28.1", "buffer@5.7.1", "buffer-from@1.1.2", "bytes@3.1.2", "call-bind@1.0.8", "call-bind-apply-helpers@1.0.2", "call-bound@1.0.4", "callsites@3.1.0", "camel-case@4.1.2", "camelcase@5.3.1", "camelcase@6.3.0", "caniuse-api@3.0.0", "caniuse-lite@1.0.30001774", "case-sensitive-paths-webpack-plugin@2.4.0", "chai@6.2.2", "chalk@2.4.2", "chalk@3.0.0", "chalk@4.1.2", "chokidar@3.6.0", "chokidar@4.0.3", "chrome-trace-event@1.0.4", "ci-info@1.6.0", "clean-css@5.3.3", "cli-cursor@2.1.0", "cli-cursor@3.1.0", "cli-highlight@2.1.11", "cli-spinners@2.9.2", "clipboardy@2.3.0", "cliui@7.0.4", "cliui@8.0.1", "clone@1.0.4", "clone-deep@4.0.1", "color-convert@1.9.3", "color-convert@2.0.1", "color-name@1.1.3", "color-name@1.1.4", "colord@2.9.3", "colorette@2.0.20", "commander@2.20.3", "commander@7.2.0", "commander@8.3.0", "commondir@1.0.1", "compressible@2.0.18", "compression@1.8.1", "concat-map@0.0.1", "connect-history-api-fallback@2.0.0", "consolidate@0.15.1", "content-disposition@0.5.4", "content-type@1.0.5", "convert-source-map@2.0.0", "cookie@0.7.2", "cookie-signature@1.0.7", "copy-webpack-plugin@9.1.0", "core-js-compat@3.48.0", "core-util-is@1.0.3", "cosmiconfig@7.1.0", "cross-spawn@5.1.0", "cross-spawn@6.0.6", "cross-spawn@7.0.6", "css-declaration-sorter@6.4.1", "css-loader@6.11.0", "css-minimizer-webpack-plugin@3.4.1", "css-select@4.3.0", "css-tree@1.1.3", "css-what@6.2.2", "cssesc@3.0.0", "cssnano@5.1.15", "cssnano-preset-default@5.2.14", "cssnano-utils@3.1.0", "csso@4.2.0", "debounce@1.2.1", "debug@2.6.9", "debug@4.4.3", "decamelize@4.0.0", "deep-is@0.1.4", "deepmerge@1.5.2", "default-gateway@6.0.3", "defaults@1.0.4", "define-data-property@1.1.4", "define-lazy-prop@2.0.0", "define-properties@1.2.1", "depd@1.1.2", "depd@2.0.0", "destroy@1.2.0", "detect-node@2.1.0", "diff@7.0.0", "dir-glob@3.0.1", "dns-packet@5.6.1", "doctrine@3.0.0", "dom-converter@0.2.0", "dom-serializer@1.4.1", "domelementtype@2.3.0", "domhandler@4.3.1", "domutils@2.8.0", "dot-case@3.0.4", "dotenv@10.0.0", "dotenv-expand@5.1.0", "dunder-proto@1.0.1", "duplexer@0.1.2", "eastasianwidth@0.2.0", "easy-stack@1.0.1", "ee-first@1.1.1", "electron-to-chromium@1.5.302", "emoji-regex@8.0.0", "emoji-regex@9.2.2", "emojis-list@3.0.0", "encodeurl@2.0.0", "end-of-stream@1.4.5", "enhanced-resolve@5.20.0", "entities@2.2.0", "entities@4.5.0", "error-ex@1.3.4", "error-stack-parser@2.1.4", "es-define-property@1.0.1", "es-errors@1.3.0", "es-module-lexer@2.0.0", "es-object-atoms@1.1.1", "escalade@3.2.0", "escape-html@1.0.3", "escape-string-regexp@1.0.5", "escape-string-regexp@4.0.0", "eslint@8.57.1", "eslint-plugin-vue@9.33.0", "eslint-scope@5.1.1", "eslint-scope@7.2.2", "eslint-visitor-keys@2.1.0", "eslint-visitor-keys@3.4.3", "eslint-webpack-plugin@3.2.0", "espree@9.6.1", "esquery@1.7.0", "esrecurse@4.3.0", "estraverse@4.3.0", "estraverse@5.3.0", "esutils@2.0.3", "etag@1.8.1", "event-pubsub@4.3.0", "eventemitter3@4.0.7", "events@3.3.0", "execa@0.8.0", "execa@1.0.0", "execa@5.1.1", "express@4.22.2", "fast-deep-equal@3.1.3", "fast-glob@3.3.3", "fast-json-stable-stringify@2.1.0", "fast-levenshtein@2.0.6", "fast-uri@3.1.2", "fastq@1.20.1", "faye-websocket@0.11.4", "figures@2.0.0", "file-entry-cache@6.0.1", "fill-range@7.1.1", "finalhandler@1.3.2", "find-cache-dir@3.3.2", "find-up@4.1.0", "find-up@5.0.0", "flat@5.0.2", "flat-cache@3.2.0", "flatted@3.4.2", "follow-redirects@1.16.0", "foreground-child@3.3.1", "forwarded@0.2.0", "fraction.js@5.3.4", "fresh@0.5.2", "fs-extra@9.1.0", "fs-monkey@1.1.0", "fs.realpath@1.0.0", "fsevents@2.3.3", "function-bind@1.1.2", "gensync@1.0.0-beta.2", "get-caller-file@2.0.5", "get-intrinsic@1.3.0", "get-proto@1.0.1", "get-stream@3.0.0", "get-stream@4.1.0", "get-stream@6.0.1", "glob@10.5.0", "glob@7.2.3", "glob-parent@5.1.2", "glob-parent@6.0.2", "glob-to-regexp@0.4.1", "globals@13.24.0", "globby@11.1.0", "gopd@1.2.0", "graceful-fs@4.2.11", "graphemer@1.4.0", "gzip-size@6.0.0", "handle-thing@2.0.1", "has-flag@3.0.0", "has-flag@4.0.0", "has-property-descriptors@1.0.2", "has-symbols@1.1.0", "hash-sum@1.0.2", "hash-sum@2.0.0", "hasown@2.0.2", "he@1.2.0", "highlight.js@10.7.3", "hosted-git-info@2.8.9", "hpack.js@2.1.6", "html-entities@2.6.0", "html-escaper@2.0.2", "html-minifier-terser@6.1.0", "html-tags@2.0.0", "html-webpack-plugin@5.6.6", "htmlparser2@6.1.0", "http-deceiver@1.2.7", "http-errors@1.8.1", "http-errors@2.0.1", "http-parser-js@0.5.10", "http-proxy@1.18.1", "http-proxy-middleware@2.0.9", "human-signals@2.1.0", "iconv-lite@0.4.24", "icss-utils@5.1.0", "ieee754@1.2.1", "ignore@5.3.2", "import-fresh@3.3.1", "imurmurhash@0.1.4", "inflight@1.0.6", "inherits@2.0.4", "inline-chunk-html-plugin@1.1.1", "ipaddr.js@1.9.1", "ipaddr.js@2.3.0", "is-arrayish@0.2.1", "is-binary-path@2.1.0", "is-ci@1.2.1", "is-core-module@2.16.1", "is-docker@2.2.1", "is-extglob@2.1.1", "is-file-esm@1.0.0", "is-fullwidth-code-point@2.0.0", "is-fullwidth-code-point@3.0.0", "is-glob@4.0.3", "is-interactive@1.0.0", "is-number@1.1.2", "is-number@7.0.0", "is-path-inside@3.0.3", "is-plain-obj@2.1.0", "is-plain-obj@3.0.0", "is-plain-object@2.0.4", "is-stream@1.1.0", "is-stream@2.0.1", "is-unicode-supported@0.1.0", "is-wsl@2.2.0", "isarray@1.0.0", "isexe@2.0.0", "isobject@1.0.2", "isobject@3.0.1", "jackspeak@3.4.3", "javascript-stringify@2.1.0", "jest-worker@27.5.1", "jest-worker@28.1.3", "joi@17.13.3", "js-message@1.0.7", "js-tokens@4.0.0", "js-yaml@4.1.1", "json-buffer@3.0.1", "json-parse-better-errors@1.0.2", "json-parse-even-better-errors@2.3.1", "json-schema-traverse@0.4.1", "json-schema-traverse@1.0.0", "json-stable-stringify-without-jsonify@1.0.1", "json5@1.0.2", "jsonfile@6.2.0", "keyv@4.5.4", "kind-of@6.0.3", "klona@2.0.6", "launch-editor@2.13.1", "launch-editor-middleware@2.13.1", "levn@0.4.1", "lilconfig@2.1.0", "lines-and-columns@1.2.4", "linkify-it@5.0.0", "loader-runner@4.3.1", "loader-utils@1.4.2", "loader-utils@2.0.4", "locate-path@5.0.0", "locate-path@6.0.0", "lodash@4.18.1", "lodash.debounce@4.0.8", "lodash.defaultsdeep@4.6.1", "lodash.kebabcase@4.1.1", "lodash.mapvalues@4.6.0", "lodash.memoize@4.1.2", "lodash.merge@4.6.2", "lodash.uniq@4.5.0", "log-symbols@4.1.0", "log-update@2.3.0", "lower-case@2.0.2", "lru-cache@10.4.3", "lru-cache@4.1.5", "lru-cache@5.1.1", "lru-cache@6.0.0", "make-dir@3.1.0", "markdown-anchor@0.2.0", "markdown-it@14.1.1", "math-intrinsics@1.1.0", "mdn-data@2.0.14", "mdurl@2.0.0", "media-typer@0.3.0", "memfs@3.5.3", "merge-descriptors@1.0.3", "merge-source-map@1.1.0", "merge-stream@2.0.0", "merge2@1.4.1", "methods@1.1.2", "micromatch@4.0.8", "mime@1.6.0", "mime-db@1.52.0", "mime-types@2.1.35", "mimic-fn@1.2.0", "mimic-fn@2.1.0", "mini-css-extract-plugin@2.10.0", "minimalistic-assert@1.0.1", "minimatch@3.1.5", "minimatch@9.0.9", "minimist@1.2.8", "minipass@3.3.6", "minipass@7.1.3", "mocha@11.7.5", "module-alias@2.3.4", "mrmime@2.0.1", "ms@2.0.0", "ms@2.1.3", "multicast-dns@7.2.5", "mz@2.7.0", "natural-compare@1.4.0", "negotiator@0.6.3", "negotiator@0.6.4", "neo-async@2.6.2", "nice-try@1.0.5", "no-case@3.0.4", "node-fetch@2.7.0", "node-forge@1.4.0", "node-releases@2.0.27", "normalize-package-data@2.5.0", "normalize-path@1.0.0", "normalize-path@3.0.0", "normalize-url@6.1.0", "npm-run-path@2.0.2", "npm-run-path@4.0.1", "nth-check@2.1.1", "object-assign@4.1.1", "object-inspect@1.13.4", "object-keys@1.1.1", "object.assign@4.1.7", "obuf@1.1.2", "on-finished@2.4.1", "on-headers@1.1.0", "once@1.4.0", "onetime@2.0.1", "onetime@5.1.2", "open@8.4.2", "opener@1.5.2", "optionator@0.9.4", "ora@5.4.1", "p-finally@1.0.0", "p-limit@2.3.0", "p-limit@3.1.0", "p-locate@4.1.0", "p-locate@5.0.0", "p-retry@4.6.2", "p-try@2.2.0", "package-json-from-dist@1.0.1", "param-case@3.0.4", "parent-module@1.0.1", "parse-json@5.2.0", "parse5@5.1.1", "parse5@6.0.1", "parse5-htmlparser2-tree-adapter@6.0.1", "parseurl@1.3.3", "pascal-case@3.1.2", "path-exists@4.0.0", "path-is-absolute@1.0.1", "path-key@2.0.1", "path-key@3.1.1", "path-parse@1.0.7", "path-scurry@1.11.1", "path-to-regexp@0.1.12", "path-type@4.0.0", "picocolors@0.2.1", "picomatch@2.3.2", "pkg-dir@4.2.0", "portfinder@1.0.38", "postcss@7.0.39", "postcss-calc@8.2.4", "postcss-colormin@5.3.1", "postcss-convert-values@5.1.3", "postcss-discard-comments@5.1.2", "postcss-discard-duplicates@5.1.0", "postcss-discard-empty@5.1.1", "postcss-discard-overridden@5.1.0", "postcss-loader@6.2.1", "postcss-merge-longhand@5.1.7", "postcss-merge-rules@5.1.4", "postcss-minify-font-values@5.1.0", "postcss-minify-gradients@5.1.1", "postcss-minify-params@5.1.4", "postcss-minify-selectors@5.2.1", "postcss-modules-extract-imports@3.1.0", "postcss-modules-local-by-default@4.2.0", "postcss-modules-scope@3.2.1", "postcss-modules-values@4.0.0", "postcss-normalize-charset@5.1.0", "postcss-normalize-display-values@5.1.0", "postcss-normalize-positions@5.1.1", "postcss-normalize-repeat-style@5.1.1", "postcss-normalize-string@5.1.0", "postcss-normalize-timing-functions@5.1.0", "postcss-normalize-unicode@5.1.1", "postcss-normalize-url@5.1.0", "postcss-normalize-whitespace@5.1.1", "postcss-ordered-values@5.1.3", "postcss-reduce-initial@5.1.2", "postcss-reduce-transforms@5.1.0", "postcss-selector-parser@6.1.2", "postcss-selector-parser@7.1.1", "postcss-svgo@5.1.0", "postcss-unique-selectors@5.1.1", "postcss-value-parser@4.2.0", "preload-webpack-plugin@3.0.0-beta.4", "prelude-ls@1.2.1", "prettier@2.8.8", "pretty-error@4.0.0", "process-nextick-args@2.0.1", "progress-webpack-plugin@1.0.16", "proxy-addr@2.0.7", "pseudomap@1.0.2", "pump@3.0.4", "punycode@2.3.1", "punycode.js@2.3.1", "qs@6.15.2", "queue-microtask@1.2.3", "randombytes@2.1.0", "range-parser@1.2.1", "raw-body@2.5.3", "read-pkg@5.2.0", "read-pkg-up@7.0.1", "readable-stream@2.3.8", "readable-stream@3.6.2", "readdirp@3.6.0", "readdirp@4.1.2", "regenerate@1.4.2", "regenerate-unicode-properties@10.2.2", "regexpu-core@6.4.0", "regjsgen@0.8.0", "regjsparser@0.13.0", "relateurl@0.2.7", "renderkid@3.0.0", "require-directory@2.1.1", "require-from-string@2.0.2", "requires-port@1.0.0", "resolve@1.22.11", "resolve-from@4.0.0", "restore-cursor@2.0.0", "restore-cursor@3.1.0", "retry@0.13.1", "reusify@1.1.0", "rimraf@3.0.2", "run-parallel@1.2.0", "safe-buffer@5.1.2", "safe-buffer@5.2.1", "safer-buffer@2.1.2", "sax@1.5.0", "schema-utils@2.7.1", "schema-utils@3.3.0", "schema-utils@4.3.3", "select-hose@2.0.0", "selfsigned@2.4.1", "semver@5.7.2", "semver@6.3.1", "semver@7.7.4", "send@0.19.2", "serialize-javascript@6.0.2", "serve-index@1.9.2", "serve-static@1.16.3", "set-function-length@1.2.2", "setprototypeof@1.2.0", "shallow-clone@3.0.1", "shebang-command@1.2.0", "shebang-command@2.0.0", "shebang-regex@1.0.0", "shebang-regex@3.0.0", "shell-quote@1.8.4", "side-channel@1.1.0", "side-channel-list@1.0.1", "side-channel-map@1.0.1", "side-channel-weakmap@1.0.2", "signal-exit@3.0.7", "signal-exit@4.1.0", "sirv@2.0.4", "slash@3.0.0", "sockjs@0.3.24", "source-map@0.6.1", "source-map-support@0.5.21", "spdx-correct@3.2.0", "spdx-exceptions@2.5.0", "spdx-expression-parse@3.0.1", "spdx-license-ids@3.0.23", "spdy@4.0.2", "spdy-transport@3.0.0", "ssri@8.0.1", "stable@0.1.8", "stackframe@1.3.4", "statuses@1.5.0", "statuses@2.0.2", "string-width@2.1.1", "string-width@4.2.3", "string-width@5.1.2", "string_decoder@1.1.1", "string_decoder@1.3.0", "stringify-github-anchor@0.1.1", "stringify-github-url@0.1.0", "strip-ansi@4.0.0", "strip-ansi@6.0.1", "strip-ansi@7.2.0", "strip-eof@1.0.0", "strip-final-newline@2.0.0", "strip-indent@2.0.0", "strip-json-comments@3.1.1", "stylehacks@5.1.1", "supports-color@5.5.0", "supports-color@7.2.0", "supports-color@8.1.1", "supports-preserve-symlinks-flag@1.0.0", "svg-tags@1.0.0", "svgo@2.8.2", "tapable@2.3.0", "terser@5.46.0", "terser-webpack-plugin@5.3.16", "text-table@0.2.0", "thenify@3.3.1", "thenify-all@1.6.0", "thread-loader@3.0.4", "thunky@1.1.0", "to-regex-range@5.0.1", "toidentifier@1.0.1", "totalist@3.0.1", "tr46@0.0.3", "tslib@2.8.1", "type-check@0.4.0", "type-fest@0.20.2", "type-fest@0.6.0", "type-fest@0.8.1", "type-is@1.6.18", "uc.micro@2.1.0", "undici-types@7.18.2", "unicode-canonical-property-names-ecmascript@2.0.1", "unicode-match-property-ecmascript@2.0.0", "unicode-match-property-value-ecmascript@2.2.1", "unicode-property-aliases-ecmascript@2.2.0", "universalify@2.0.1", "unpipe@1.0.0", "update-browserslist-db@1.2.3", "uri-js@4.4.1", "util-deprecate@1.0.2", "utila@0.4.0", "utils-merge@1.0.1", "uuid@8.3.2", "validate-npm-package-license@3.0.4", "vary@1.1.2", "vue-eslint-parser@9.4.3", "vue-hot-reload-api@2.3.4", "vue-loader@15.11.1", "vue-loader@17.4.2", "vue-style-loader@4.1.3", "vue-template-es2015-compiler@1.9.1", "watchpack@2.5.1", "wbuf@1.7.3", "wcwidth@1.0.1", "webidl-conversions@3.0.1", "webpack@5.105.3", "webpack-bundle-analyzer@4.10.2", "webpack-chain@6.5.1", "webpack-dev-middleware@5.3.4", "webpack-dev-server@4.15.2", "webpack-merge@5.10.0", "webpack-sources@3.3.4", "webpack-virtual-modules@0.4.6", "websocket-driver@0.7.4", "websocket-extensions@0.1.4", "whatwg-fetch@3.6.20", "whatwg-url@5.0.0", "which@1.3.1", "which@2.0.2", "wildcard@2.0.1", "word-wrap@1.2.5", "workerpool@9.3.4", "wrap-ansi@3.0.1", "wrap-ansi@7.0.0", "wrap-ansi@8.1.0", "wrappy@1.0.2", "ws@7.5.10", "ws@8.19.0", "xml-name-validator@4.0.0", "y18n@5.0.8", "yallist@2.1.2", "yallist@3.1.1", "yallist@4.0.0", "yaml@1.10.3", "yargs@16.2.0", "yargs@17.7.2", "yargs-parser@20.2.9", "yargs-parser@21.1.1", "yargs-unparser@2.0.0", "yocto-queue@0.1.0", "yorkie@2.0.0" ], "any": true, "baseline": false, "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [ { "aliases": [ "CVE-2026-48801" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48801", "percentile": 0.3357, "score": 0.00394 }, "fix_state": "fixed", "fixed_in": [ "5.0.1" ], "id": "GHSA-22p9-wv53-3rq4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "linkify-it", "severity": "High", "summary": "LinkifyIt#match scan loop has quadratic algorithmic complexity", "url": "https://github.com/advisories/GHSA-22p9-wv53-3rq4", "version": "5.0.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "14.3.1" ], "id": "GHSA-253c-mchw-3w2r", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds", "url": "https://github.com/advisories/GHSA-253c-mchw-3w2r", "version": "14.1.1" }, { "aliases": [ "CVE-2026-111181" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111181", "percentile": 0.32919, "score": 0.00388 }, "fix_state": "fixed", "fixed_in": [ "1.20.9" ], "id": "GHSA-27r3-jxmh-p828", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "body-parser", "severity": "High", "summary": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body", "url": "https://github.com/advisories/GHSA-27r3-jxmh-p828", "version": "1.20.5" }, { "aliases": [ "CVE-2026-84375" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84375", "percentile": 0.45503, "score": 0.00541 }, "fix_state": "fixed", "fixed_in": [ "4.3.2" ], "id": "GHSA-2883-xcg3-v3hh", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources", "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh", "version": "4.1.1" }, { "aliases": [ "CVE-2026-73650" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73650", "percentile": 0.37761, "score": 0.00435 }, "fix_state": "fixed", "fixed_in": [ "2.8.3" ], "id": "GHSA-2p49-hgcm-8545", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "svgo", "severity": "High", "summary": "SVGO removeScripts plugin leaves some executable scripts intact", "url": "https://github.com/advisories/GHSA-2p49-hgcm-8545", "version": "2.8.2" }, { "aliases": [ "CVE-2026-85062" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-85062", "percentile": 0.43256, "score": 0.00507 }, "fix_state": "fixed", "fixed_in": [ "2.9.4" ], "id": "GHSA-2wm5-q62r-hmrv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "colord", "severity": "Medium", "summary": "Colord: Slow rejection of oversized malformed color strings", "url": "https://github.com/advisories/GHSA-2wm5-q62r-hmrv", "version": "2.9.3" }, { "aliases": [ "CVE-2026-110725" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110725", "percentile": 0.22997, "score": 0.00302 }, "fix_state": "fixed", "fixed_in": [ "3.1.9" ], "id": "GHSA-333x-w4r6-6crp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "Low", "summary": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references", "url": "https://github.com/advisories/GHSA-333x-w4r6-6crp", "version": "3.1.2" }, { "aliases": [ "CVE-2026-4867" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-4867", "percentile": 0.43909, "score": 0.00515 }, "fix_state": "fixed", "fixed_in": [ "0.1.13" ], "id": "GHSA-37ch-88jc-xwx2", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "path-to-regexp", "severity": "High", "summary": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters", "url": "https://github.com/advisories/GHSA-37ch-88jc-xwx2", "version": "0.1.12" }, { "aliases": [ "CVE-2026-13311" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-13311", "percentile": 0.29829, "score": 0.0036 }, "fix_state": "fixed", "fixed_in": [ "1.9.0" ], "id": "GHSA-395f-4hp3-45gv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "shell-quote", "severity": "High", "summary": "shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)", "url": "https://github.com/advisories/GHSA-395f-4hp3-45gv", "version": "1.8.4" }, { "aliases": [ "CVE-2026-118773" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118773", "percentile": 0.28707, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "14.0.2" ], "id": "GHSA-3g3m-2fjr-6pw4", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "glob", "severity": "Medium", "summary": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal", "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4", "version": "10.5.0" }, { "aliases": [ "CVE-2026-13149" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-13149", "percentile": 0.3024, "score": 0.00364 }, "fix_state": "fixed", "fixed_in": [ "2.1.2" ], "id": "GHSA-3jxr-9vmj-r5cp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups", "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp", "version": "2.0.2" }, { "aliases": [ "CVE-2024-21538" ], "ecosystem": "npm", "epss": { "cve": "CVE-2024-21538", "percentile": 0.58749, "score": 0.00868 }, "fix_state": "fixed", "fixed_in": [ "6.0.6" ], "id": "GHSA-3xgq-45jj-v275", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "cross-spawn", "severity": "High", "summary": "Regular Expression Denial of Service (ReDoS) in cross-spawn", "url": "https://github.com/advisories/GHSA-3xgq-45jj-v275", "version": "5.1.0" }, { "aliases": [ "CVE-2026-118780" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118780", "percentile": 0.06585, "score": 0.00172 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-4487-j8r4-4g2f", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store", "url": "https://github.com/advisories/GHSA-4487-j8r4-4g2f", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118772" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118772", "percentile": 0.40455, "score": 0.00467 }, "fix_state": "fixed", "fixed_in": [ "17.13.9" ], "id": "GHSA-4528-x5fx-h6hg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "joi", "severity": "High", "summary": "joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service", "url": "https://github.com/advisories/GHSA-4528-x5fx-h6hg", "version": "17.13.3" }, { "aliases": [ "CVE-2026-118775" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118775", "percentile": 0.24273, "score": 0.00313 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-4642-5mcj-2rqw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: ASN.1 OID first arc truncation in asn1.oidToDer", "url": "https://github.com/advisories/GHSA-4642-5mcj-2rqw", "version": "1.4.0" }, { "aliases": [ "CVE-2026-13676" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-13676", "percentile": 0.52904, "score": 0.00692 }, "fix_state": "fixed", "fixed_in": [ "3.1.3" ], "id": "GHSA-4c8g-83qw-93j6", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "High", "summary": "fast-uri vulnerable to host confusion via failed IDN canonicalization", "url": "https://github.com/advisories/GHSA-4c8g-83qw-93j6", "version": "3.1.2" }, { "aliases": [ "CVE-2026-82417" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-82417", "percentile": 0.33809, "score": 0.00396 }, "fix_state": "fixed", "fixed_in": [ "6.16.0" ], "id": "GHSA-4mjr-xmp4-gh2g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs: Denial of Service via Attacker Controlled isBuffer", "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g", "version": "6.15.2" }, { "aliases": [ "CVE-2025-30359" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-30359", "percentile": 0.48631, "score": 0.00598 }, "fix_state": "fixed", "fixed_in": [ "5.2.1" ], "id": "GHSA-4v9v-hfq4-rm2v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server users' source code may be stolen when they access a malicious web site", "url": "https://github.com/advisories/GHSA-4v9v-hfq4-rm2v", "version": "4.15.2" }, { "aliases": [ "CVE-2026-84369" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84369", "percentile": 0.37221, "score": 0.0043 }, "fix_state": "fixed", "fixed_in": [ "2.8.4" ], "id": "GHSA-4vpr-x523-8j87", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "svgo", "severity": "Medium", "summary": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements", "url": "https://github.com/advisories/GHSA-4vpr-x523-8j87", "version": "2.8.2" }, { "aliases": [ "CVE-2026-49356" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-49356", "percentile": 0.04312, "score": 0.00152 }, "fix_state": "fixed", "fixed_in": [ "7.29.6" ], "id": "GHSA-4x5r-pxfx-6jf8", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@babel/core", "severity": "Low", "summary": "@babel/core: Arbitrary File Read via sourceMappingURL Comment", "url": "https://github.com/advisories/GHSA-4x5r-pxfx-6jf8", "version": "7.29.0" }, { "aliases": [ "CVE-2026-118778" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118778", "percentile": 0.10363, "score": 0.00204 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-525v-9gp9-w22h", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: TLS client crash when the server sends no certificate", "url": "https://github.com/advisories/GHSA-525v-9gp9-w22h", "version": "1.4.0" }, { "aliases": [ "CVE-2026-59869" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-59869", "percentile": 0.47992, "score": 0.00585 }, "fix_state": "fixed", "fixed_in": [ "4.3.0" ], "id": "GHSA-52cp-r559-cp3m", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "js-yaml: YAML merge-key chains can force quadratic CPU consumption", "url": "https://github.com/advisories/GHSA-52cp-r559-cp3m", "version": "4.1.1" }, { "aliases": [ "CVE-2026-112942" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-112942", "percentile": 0.71406, "score": 0.01344 }, "fix_state": "fixed", "fixed_in": [ "2.14.2" ], "id": "GHSA-587h-7wmj-h5pm", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "launch-editor", "severity": "High", "summary": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows", "url": "https://github.com/advisories/GHSA-587h-7wmj-h5pm", "version": "2.13.1" }, { "aliases": [ "CVE-2026-45736" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-45736", "percentile": 0.54801, "score": 0.00745 }, "fix_state": "fixed", "fixed_in": [ "8.20.1" ], "id": "GHSA-58qx-3vcg-4xpx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ws", "severity": "Medium", "summary": "ws: Uninitialized memory disclosure", "url": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx", "version": "8.19.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "7.0.3" ], "id": "GHSA-5c6j-r48x-rmvq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "serialize-javascript", "severity": "High", "summary": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()", "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq", "version": "6.0.2" }, { "aliases": [ "CVE-2026-119186" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119186", "percentile": 0.1069, "score": 0.00206 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-5cwg-6vw7-rj6p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: AES-GCM authentication bypass via unvalidated tagLength option", "url": "https://github.com/advisories/GHSA-5cwg-6vw7-rj6p", "version": "1.4.0" }, { "aliases": [], "ecosystem": "npm", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.3.1" ], "id": "GHSA-5p4m-2wfm-xmqj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "High", "summary": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported", "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj", "version": "4.1.1" }, { "aliases": [ "CVE-2026-119190" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119190", "percentile": 0.15892, "score": 0.00246 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-5x38-2vff-x55p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13", "url": "https://github.com/advisories/GHSA-5x38-2vff-x55p", "version": "1.4.0" }, { "aliases": [ "CVE-2026-55602" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-55602", "percentile": 0.31755, "score": 0.00378 }, "fix_state": "fixed", "fixed_in": [ "2.0.10" ], "id": "GHSA-64mm-vxmg-q3vj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "http-proxy-middleware", "severity": "Medium", "summary": "http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass", "url": "https://github.com/advisories/GHSA-64mm-vxmg-q3vj", "version": "2.0.9" }, { "aliases": [ "CVE-2026-112943" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-112943", "percentile": 0.35737, "score": 0.00414 }, "fix_state": "fixed", "fixed_in": [ "2.14.2" ], "id": "GHSA-698v-4r3x-3vcv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "launch-editor", "severity": "Medium", "summary": "launch-editor: escapeCmdArgs() omits % escaping on Windows", "url": "https://github.com/advisories/GHSA-698v-4r3x-3vcv", "version": "2.13.1" }, { "aliases": [ "CVE-2026-92599" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-92599", "percentile": 0.47795, "score": 0.00582 }, "fix_state": "fixed", "fixed_in": [ "17.13.7" ], "id": "GHSA-6h2x-m376-mqjq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "joi", "severity": "High", "summary": "joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`", "url": "https://github.com/advisories/GHSA-6h2x-m376-mqjq", "version": "17.13.3" }, { "aliases": [ "CVE-2026-102276" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-102276", "percentile": 0.39514, "score": 0.00455 }, "fix_state": "fixed", "fixed_in": [ "2.1.5" ], "id": "GHSA-6j4f-fj2g-mc7p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "High", "summary": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion", "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p", "version": "2.0.2" }, { "aliases": [ "CVE-2026-110816" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110816", "percentile": 0.30708, "score": 0.00368 }, "fix_state": "fixed", "fixed_in": [ "6.16.1" ], "id": "GHSA-6pq8-jhm2-2vcw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)", "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw", "version": "6.15.2" }, { "aliases": [ "CVE-2026-48988" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48988", "percentile": 0.3186, "score": 0.00379 }, "fix_state": "fixed", "fixed_in": [ "14.2.0" ], "id": "GHSA-6v5v-wf23-fmfq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Medium", "summary": "markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operations", "url": "https://github.com/advisories/GHSA-6v5v-wf23-fmfq", "version": "14.1.1" }, { "aliases": [ "CVE-2026-84368" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84368", "percentile": 0.33029, "score": 0.00389 }, "fix_state": "fixed", "fixed_in": [ "17.13.6" ], "id": "GHSA-6w3j-5fw6-r9vr", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "joi", "severity": "Low", "summary": "joi: Prototype pollution via a `__proto__` language key in custom messages", "url": "https://github.com/advisories/GHSA-6w3j-5fw6-r9vr", "version": "17.13.3" }, { "aliases": [ "CVE-2026-118777" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118777", "percentile": 0.17154, "score": 0.00255 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-6wvx-3r32-xmcg", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Medium", "summary": "Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie", "url": "https://github.com/advisories/GHSA-6wvx-3r32-xmcg", "version": "1.4.0" }, { "aliases": [ "CVE-2026-24001" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-24001", "percentile": 0.49541, "score": 0.00616 }, "fix_state": "fixed", "fixed_in": [ "8.0.3" ], "id": "GHSA-73rr-hh4g-fpgx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "diff", "severity": "Low", "summary": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "version": "7.0.0" }, { "aliases": [ "CVE-2026-73088" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73088", "percentile": 0.51498, "score": 0.00658 }, "fix_state": "fixed", "fixed_in": [ "4.28.7" ], "id": "GHSA-73wf-gq98-2v4g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "browserslist", "severity": "High", "summary": "Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)", "url": "https://github.com/advisories/GHSA-73wf-gq98-2v4g", "version": "4.28.1" }, { "aliases": [ "CVE-2026-6402" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-6402", "percentile": 0.21731, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "5.2.4" ], "id": "GHSA-79cf-xcqc-c78w", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins", "url": "https://github.com/advisories/GHSA-79cf-xcqc-c78w", "version": "4.15.2" }, { "aliases": [ "CVE-2023-44270" ], "ecosystem": "npm", "epss": { "cve": "CVE-2023-44270", "percentile": 0.62035, "score": 0.00973 }, "fix_state": "fixed", "fixed_in": [ "8.4.31" ], "id": "GHSA-7fh5-64p2-3v2j", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "postcss", "severity": "Medium", "summary": "PostCSS line return parsing error", "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j", "version": "7.0.39" }, { "aliases": [ "CVE-2026-18446" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-18446", "percentile": 0.32004, "score": 0.0038 }, "fix_state": "fixed", "fixed_in": [ "3.1.5" ], "id": "GHSA-7p8r-x3mc-p8w7", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "High", "summary": "fast-uri vulnerable to host confusion via backslash authority introducer", "url": "https://github.com/advisories/GHSA-7p8r-x3mc-p8w7", "version": "3.1.2" }, { "aliases": [ "CVE-2026-118779" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118779", "percentile": 0.46398, "score": 0.00556 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-7wch-p9px-956x", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Regular expression denial of service in PEM decoding (pem.decode)", "url": "https://github.com/advisories/GHSA-7wch-p9px-956x", "version": "1.4.0" }, { "aliases": [ "CVE-2026-85393" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-85393", "percentile": 0.16151, "score": 0.00248 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-86w9-cpqp-85rv", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements", "url": "https://github.com/advisories/GHSA-86w9-cpqp-85rv", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119188" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119188", "percentile": 0.35414, "score": 0.00411 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-8hrf-8g6f-7xwp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message", "url": "https://github.com/advisories/GHSA-8hrf-8g6f-7xwp", "version": "1.4.0" }, { "aliases": [ "CVE-2026-111755" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111755", "percentile": 0.40761, "score": 0.00471 }, "fix_state": "fixed", "fixed_in": [ "1.16.1" ], "id": "GHSA-8r9p-f939-6h3c", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "follow-redirects", "severity": "High", "summary": "follow-redirects sensitiveHeaders regex escaping can expose credential headers", "url": "https://github.com/advisories/GHSA-8r9p-f939-6h3c", "version": "1.16.0" }, { "aliases": [ "CVE-2026-48779" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-48779", "percentile": 0.72944, "score": 0.01426 }, "fix_state": "fixed", "fixed_in": [ "8.21.0" ], "id": "GHSA-96hv-2xvq-fx4p", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ws", "severity": "High", "summary": "ws: Memory exhaustion DoS from tiny fragments and data chunks", "url": "https://github.com/advisories/GHSA-96hv-2xvq-fx4p", "version": "8.19.0" }, { "aliases": [ "CVE-2025-30360" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-30360", "percentile": 0.29476, "score": 0.00357 }, "fix_state": "fixed", "fixed_in": [ "5.2.1" ], "id": "GHSA-9jgg-88mc-972h", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser", "url": "https://github.com/advisories/GHSA-9jgg-88mc-972h", "version": "4.15.2" }, { "aliases": [ "CVE-2026-73089" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-73089", "percentile": 0.51386, "score": 0.00655 }, "fix_state": "fixed", "fixed_in": [ "4.28.7" ], "id": "GHSA-c83g-rgw3-j3cx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "browserslist", "severity": "High", "summary": "Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM", "url": "https://github.com/advisories/GHSA-c83g-rgw3-j3cx", "version": "4.28.1" }, { "aliases": [ "CVE-2026-14620" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-14620", "percentile": 0.44254, "score": 0.00521 }, "fix_state": "fixed", "fixed_in": [ "5.2.6" ], "id": "GHSA-f5vj-f2hx-8m93", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints", "url": "https://github.com/advisories/GHSA-f5vj-f2hx-8m93", "version": "4.15.2" }, { "aliases": [ "CVE-2026-75975" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-75975", "percentile": 0.12576, "score": 0.0022 }, "fix_state": "fixed", "fixed_in": [ "3.1.6" ], "id": "GHSA-f65p-4m7j-42xc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "High", "summary": "fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization", "url": "https://github.com/advisories/GHSA-f65p-4m7j-42xc", "version": "3.1.2" }, { "aliases": [ "CVE-2026-33750" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-33750", "percentile": 0.38904, "score": 0.00447 }, "fix_state": "fixed", "fixed_in": [ "2.0.3" ], "id": "GHSA-f886-m6hf-6m8v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "brace-expansion", "severity": "Medium", "summary": "brace-expansion: Zero-step sequence causes process hang and memory exhaustion", "url": "https://github.com/advisories/GHSA-f886-m6hf-6m8v", "version": "2.0.2" }, { "aliases": [ "CVE-2026-75899" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-75899", "percentile": 0.12575, "score": 0.0022 }, "fix_state": "fixed", "fixed_in": [ "3.1.6" ], "id": "GHSA-fph4-wmhf-6fwf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "High", "summary": "fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding", "url": "https://github.com/advisories/GHSA-fph4-wmhf-6fwf", "version": "3.1.2" }, { "aliases": [ "CVE-2026-118764" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118764", "percentile": 0.21751, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "11.0.1" ], "id": "GHSA-g3hv-75wg-m249", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "minimatch", "severity": "Medium", "summary": "minimatch has potential denial of service via globparts amplification", "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249", "version": "9.0.9" }, { "aliases": [ "CVE-2026-76844" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-76844", "percentile": 0.48311, "score": 0.00592 }, "fix_state": "fixed", "fixed_in": [ "7.4.6" ], "id": "GHSA-g84c-rxfj-3j2c", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-middleware", "severity": "High", "summary": "webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath", "url": "https://github.com/advisories/GHSA-g84c-rxfj-3j2c", "version": "5.3.4" }, { "aliases": [ "CVE-2026-111758" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111758", "percentile": 0.46036, "score": 0.0055 }, "fix_state": "fixed", "fixed_in": [ "14.3.3" ], "id": "GHSA-gfr2-rv44-r23c", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "High", "summary": "markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)", "url": "https://github.com/advisories/GHSA-gfr2-rv44-r23c", "version": "14.1.1" }, { "aliases": [ "CVE-2026-84367" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84367", "percentile": 0.33029, "score": 0.00389 }, "fix_state": "fixed", "fixed_in": [ "17.13.5" ], "id": "GHSA-gg4h-3hg2-grpc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "joi", "severity": "Low", "summary": "joi: object().rename() with a template target can set the validated object's prototype", "url": "https://github.com/advisories/GHSA-gg4h-3hg2-grpc", "version": "17.13.3" }, { "aliases": [ "CVE-2026-53550" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-53550", "percentile": 0.35866, "score": 0.00415 }, "fix_state": "fixed", "fixed_in": [ "4.2.0" ], "id": "GHSA-h67p-54hq-rp68", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "js-yaml", "severity": "Medium", "summary": "JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases", "url": "https://github.com/advisories/GHSA-h67p-54hq-rp68", "version": "4.1.1" }, { "aliases": [ "CVE-2026-118781" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118781", "percentile": 0.01734, "score": 0.00119 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-h6cr-wjv9-3cpp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)", "url": "https://github.com/advisories/GHSA-h6cr-wjv9-3cpp", "version": "1.4.0" }, { "aliases": [ "CVE-2026-119187" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-119187", "percentile": 0.35799, "score": 0.00415 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-hqq3-7jhf-c5jx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: Denial of service in TLS record processing via call stack exhaustion", "url": "https://github.com/advisories/GHSA-hqq3-7jhf-c5jx", "version": "1.4.0" }, { "aliases": [ "CVE-2026-86472" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-86472", "percentile": 0.16796, "score": 0.00253 }, "fix_state": "fixed", "fixed_in": [ "3.1.8" ], "id": "GHSA-hrr3-gc8f-f4qj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "Medium", "summary": "fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets", "url": "https://github.com/advisories/GHSA-hrr3-gc8f-f4qj", "version": "3.1.2" }, { "aliases": [ "CVE-2026-118782" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118782", "percentile": 0.02195, "score": 0.00125 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-jc66-7q78-782g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "High", "summary": "Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count", "url": "https://github.com/advisories/GHSA-jc66-7q78-782g", "version": "1.4.0" }, { "aliases": [ "CVE-2026-90711" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-90711", "percentile": 0.177, "score": 0.0026 }, "fix_state": "fixed", "fixed_in": [ "2.0.8" ], "id": "GHSA-jqcg-44mw-7w3h", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "proxy-addr", "severity": "Critical", "summary": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet", "url": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h", "version": "2.0.7" }, { "aliases": [ "CVE-2026-76172" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-76172", "percentile": 0.14134, "score": 0.00232 }, "fix_state": "fixed", "fixed_in": [ "3.1.6" ], "id": "GHSA-jqff-g426-hqxp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "High", "summary": "fast-uri vulnerable to host confusion via percent-encoded scheme normalization", "url": "https://github.com/advisories/GHSA-jqff-g426-hqxp", "version": "3.1.2" }, { "aliases": [ "CVE-2026-14631" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-14631", "percentile": 0.4399, "score": 0.00517 }, "fix_state": "fixed", "fixed_in": [ "5.2.6" ], "id": "GHSA-m28w-2pqf-7qgj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header", "url": "https://github.com/advisories/GHSA-m28w-2pqf-7qgj", "version": "4.15.2" }, { "aliases": [ "CVE-2026-115897" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-115897", "percentile": 0.23496, "score": 0.00307 }, "fix_state": "fixed", "fixed_in": [ "7.1.3" ], "id": "GHSA-m5mm-p8h7-m29v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "serialize-javascript", "severity": "Low", "summary": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped in its CSS Stringify Output", "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93", "version": "7.0.39" }, { "aliases": [ "CVE-2026-41305" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-41305", "percentile": 0.10477, "score": 0.00205 }, "fix_state": "fixed", "fixed_in": [ "8.5.10" ], "id": "GHSA-qx2v-qp2m-jg93", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "postcss", "severity": "Medium", "summary": "PostCSS has XSS via Unescaped in its CSS Stringify Output", "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93", "version": "8.5.6" }, { "aliases": [ "CVE-2026-104844" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-104844", "percentile": 0.32994, "score": 0.00389 }, "fix_state": "fixed", "fixed_in": [ "6.1.5" ], "id": "GHSA-rj75-hqrm-r3gf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "postcss-selector-parser", "severity": "Medium", "summary": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion", "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf", "version": "6.1.2" }, { "aliases": [ "CVE-2026-104844" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-104844", "percentile": 0.32994, "score": 0.00389 }, "fix_state": "fixed", "fixed_in": [ "7.1.6" ], "id": "GHSA-rj75-hqrm-r3gf", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "postcss-selector-parser", "severity": "Medium", "summary": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion", "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf", "version": "7.1.1" }, { "aliases": [ "CVE-2026-61632" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-61632", "percentile": 0.34571, "score": 0.00403 }, "fix_state": "fixed", "fixed_in": [ "11.0.0" ], "id": "GHSA-9xwg-3r6f-jcx2", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "pymdown-extensions", "severity": "Medium", "summary": "PyMdown Extensions: Path traversal in the b64 extension lets read files outside base_path", "url": "https://github.com/advisories/GHSA-9xwg-3r6f-jcx2", "version": "10.21.3" }, { "aliases": [ "CVE-2026-82417" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-82417", "percentile": 0.33809, "score": 0.00396 }, "fix_state": "fixed", "fixed_in": [ "6.16.0" ], "id": "GHSA-4mjr-xmp4-gh2g", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs: Denial of Service via Attacker Controlled isBuffer", "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g", "version": "6.15.2" }, { "aliases": [ "CVE-2026-110816" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110816", "percentile": 0.30708, "score": 0.00368 }, "fix_state": "fixed", "fixed_in": [ "6.16.1" ], "id": "GHSA-6pq8-jhm2-2vcw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)", "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw", "version": "6.15.2" }, { "aliases": [ "CVE-2026-82562" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-82562", "percentile": 0.45453, "score": 0.0054 }, "fix_state": "fixed", "fixed_in": [ "6.16.0" ], "id": "GHSA-x5fp-wj9c-mxmx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "qs", "severity": "Medium", "summary": "qs array-limit bypass via bracket-key comma parsing", "url": "https://github.com/advisories/GHSA-x5fp-wj9c-mxmx", "version": "6.15.2" }, { "aliases": [ "CVE-2026-34043" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-34043", "percentile": 0.42201, "score": 0.00491 }, "fix_state": "fixed", "fixed_in": [ "7.0.5" ], "id": "GHSA-qj8w-gfj5-8c6v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "serialize-javascript", "severity": "Medium", "summary": "Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects", "url": "https://github.com/advisories/GHSA-qj8w-gfj5-8c6v", "version": "6.0.2" }, { "aliases": [ "CVE-2026-86000" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-86000", "percentile": 0.49167, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "2.9.0" ], "id": "GHSA-gjv8-xp57-g29c", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "soupsieve", "severity": "Medium", "summary": "Soup Sieve: Polynomial-time ReDoS (O(n\u00b2)) in the `IDENTIFIER` / `VALUE` selector sub-patterns", "url": "https://github.com/advisories/GHSA-gjv8-xp57-g29c", "version": "2.8.3" }, { "aliases": [ "CVE-2026-85999" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-85999", "percentile": 0.49167, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "2.9.0" ], "id": "GHSA-j934-xhv5-fg8f", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "soupsieve", "severity": "Medium", "summary": "Soup Sieve: Polynomial-time ReDoS (O(n\u00b2)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)", "url": "https://github.com/advisories/GHSA-j934-xhv5-fg8f", "version": "2.8.3" }, { "aliases": [ "CVE-2026-84369" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84369", "percentile": 0.37221, "score": 0.0043 }, "fix_state": "fixed", "fixed_in": [ "2.8.4" ], "id": "GHSA-4vpr-x523-8j87", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "svgo", "severity": "Medium", "summary": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements", "url": "https://github.com/advisories/GHSA-4vpr-x523-8j87", "version": "2.8.2" }, { "aliases": [ "CVE-2026-97688" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-97688", "percentile": 0.21778, "score": 0.00292 }, "fix_state": "fixed", "fixed_in": [ "2.8.0" ], "id": "GHSA-gh4c-6fx4-qh6g", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "urllib3", "severity": "Medium", "summary": "urllib3: Chunked Deflate streaming can enter an infinite loop", "url": "https://github.com/advisories/GHSA-gh4c-6fx4-qh6g", "version": "2.7.0" }, { "aliases": [ "CVE-2026-41907" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-41907", "percentile": 0.28633, "score": 0.0035 }, "fix_state": "fixed", "fixed_in": [ "11.1.1" ], "id": "GHSA-w5hq-g745-h8pq", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "uuid", "severity": "Medium", "summary": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided", "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq", "version": "8.3.2" }, { "aliases": [ "CVE-2025-30359" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-30359", "percentile": 0.48631, "score": 0.00598 }, "fix_state": "fixed", "fixed_in": [ "5.2.1" ], "id": "GHSA-4v9v-hfq4-rm2v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server users' source code may be stolen when they access a malicious web site", "url": "https://github.com/advisories/GHSA-4v9v-hfq4-rm2v", "version": "4.15.2" }, { "aliases": [ "CVE-2026-6402" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-6402", "percentile": 0.21731, "score": 0.00291 }, "fix_state": "fixed", "fixed_in": [ "5.2.4" ], "id": "GHSA-79cf-xcqc-c78w", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins", "url": "https://github.com/advisories/GHSA-79cf-xcqc-c78w", "version": "4.15.2" }, { "aliases": [ "CVE-2025-30360" ], "ecosystem": "npm", "epss": { "cve": "CVE-2025-30360", "percentile": 0.29476, "score": 0.00357 }, "fix_state": "fixed", "fixed_in": [ "5.2.1" ], "id": "GHSA-9jgg-88mc-972h", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser", "url": "https://github.com/advisories/GHSA-9jgg-88mc-972h", "version": "4.15.2" }, { "aliases": [ "CVE-2026-14620" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-14620", "percentile": 0.44254, "score": 0.00521 }, "fix_state": "fixed", "fixed_in": [ "5.2.6" ], "id": "GHSA-f5vj-f2hx-8m93", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints", "url": "https://github.com/advisories/GHSA-f5vj-f2hx-8m93", "version": "4.15.2" }, { "aliases": [ "CVE-2026-14631" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-14631", "percentile": 0.4399, "score": 0.00517 }, "fix_state": "fixed", "fixed_in": [ "5.2.6" ], "id": "GHSA-m28w-2pqf-7qgj", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header", "url": "https://github.com/advisories/GHSA-m28w-2pqf-7qgj", "version": "4.15.2" }, { "aliases": [ "CVE-2026-9595" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-9595", "percentile": 0.05474, "score": 0.00163 }, "fix_state": "fixed", "fixed_in": [ "5.2.5" ], "id": "GHSA-mx8g-39q3-5c79", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "webpack-dev-server", "severity": "Medium", "summary": "webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies", "url": "https://github.com/advisories/GHSA-mx8g-39q3-5c79", "version": "4.15.2" }, { "aliases": [ "CVE-2026-54490" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-54490", "percentile": 0.3869, "score": 0.00445 }, "fix_state": "fixed", "fixed_in": [ "0.7.5" ], "id": "GHSA-mp7j-qc5w-4988", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "websocket-driver", "severity": "Medium", "summary": "websocket-driver: Resource limit bypass via message compression", "url": "https://github.com/advisories/GHSA-mp7j-qc5w-4988", "version": "0.7.4" }, { "aliases": [ "CVE-2026-102598" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-102598", "percentile": 0.30916, "score": 0.0037 }, "fix_state": "fixed", "fixed_in": [ "3.1.9" ], "id": "GHSA-g6x2-hccm-hh4m", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "werkzeug", "severity": "Medium", "summary": "Werkzeug safe_join() allows Windows special device names", "url": "https://github.com/advisories/GHSA-g6x2-hccm-hh4m", "version": "3.1.8" }, { "aliases": [ "CVE-2026-45736" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-45736", "percentile": 0.54801, "score": 0.00745 }, "fix_state": "fixed", "fixed_in": [ "8.20.1" ], "id": "GHSA-58qx-3vcg-4xpx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "ws", "severity": "Medium", "summary": "ws: Uninitialized memory disclosure", "url": "https://github.com/advisories/GHSA-58qx-3vcg-4xpx", "version": "8.19.0" }, { "aliases": [ "CVE-2026-49356" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-49356", "percentile": 0.04312, "score": 0.00152 }, "fix_state": "fixed", "fixed_in": [ "7.29.6" ], "id": "GHSA-4x5r-pxfx-6jf8", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "@babel/core", "severity": "Low", "summary": "@babel/core: Arbitrary File Read via sourceMappingURL Comment", "url": "https://github.com/advisories/GHSA-4x5r-pxfx-6jf8", "version": "7.29.0" }, { "aliases": [ "CVE-2026-12590" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-12590", "percentile": 0.3549, "score": 0.00412 }, "fix_state": "fixed", "fixed_in": [ "1.20.6" ], "id": "GHSA-v422-hmwv-36x6", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "body-parser", "severity": "Low", "summary": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement", "url": "https://github.com/advisories/GHSA-v422-hmwv-36x6", "version": "1.20.5" }, { "aliases": [ "CVE-2026-24001" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-24001", "percentile": 0.49541, "score": 0.00616 }, "fix_state": "fixed", "fixed_in": [ "8.0.3" ], "id": "GHSA-73rr-hh4g-fpgx", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "diff", "severity": "Low", "summary": "jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch", "url": "https://github.com/advisories/GHSA-73rr-hh4g-fpgx", "version": "7.0.0" }, { "aliases": [ "CVE-2026-110725" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110725", "percentile": 0.22997, "score": 0.00302 }, "fix_state": "fixed", "fixed_in": [ "3.1.9" ], "id": "GHSA-333x-w4r6-6crp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "Low", "summary": "fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references", "url": "https://github.com/advisories/GHSA-333x-w4r6-6crp", "version": "3.1.2" }, { "aliases": [ "CVE-2026-110095" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-110095", "percentile": 0.21547, "score": 0.00289 }, "fix_state": "fixed", "fixed_in": [ "3.1.9" ], "id": "GHSA-xhq7-xmqj-769h", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "fast-uri", "severity": "Low", "summary": "fast-uri vulnerable to improper path equivalence in relative reference normalization", "url": "https://github.com/advisories/GHSA-xhq7-xmqj-769h", "version": "3.1.2" }, { "aliases": [ "CVE-2026-112907" ], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-567q-5qvw-pf92", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Low", "summary": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break", "url": "https://github.com/advisories/GHSA-567q-5qvw-pf92", "version": "3.29.0" }, { "aliases": [ "CVE-2026-112913" ], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "4.2.1" ], "id": "GHSA-9vhv-jxww-xfm5", "kev": null, "location": "uv.lock", "osv_confirmed": true, "package": "filelock", "severity": "Low", "summary": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database", "url": "https://github.com/advisories/GHSA-9vhv-jxww-xfm5", "version": "3.29.0" }, { "aliases": [ "CVE-2026-84368" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84368", "percentile": 0.33029, "score": 0.00389 }, "fix_state": "fixed", "fixed_in": [ "17.13.6" ], "id": "GHSA-6w3j-5fw6-r9vr", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "joi", "severity": "Low", "summary": "joi: Prototype pollution via a `__proto__` language key in custom messages", "url": "https://github.com/advisories/GHSA-6w3j-5fw6-r9vr", "version": "17.13.3" }, { "aliases": [ "CVE-2026-84367" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-84367", "percentile": 0.33029, "score": 0.00389 }, "fix_state": "fixed", "fixed_in": [ "17.13.5" ], "id": "GHSA-gg4h-3hg2-grpc", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "joi", "severity": "Low", "summary": "joi: object().rename() with a template target can set the validated object's prototype", "url": "https://github.com/advisories/GHSA-gg4h-3hg2-grpc", "version": "17.13.3" }, { "aliases": [ "CVE-2026-111766" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-111766", "percentile": 0.37056, "score": 0.00428 }, "fix_state": "fixed", "fixed_in": [ "14.3.3" ], "id": "GHSA-vfgh-jcmw-g37q", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "markdown-it", "severity": "Low", "summary": "markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled", "url": "https://github.com/advisories/GHSA-vfgh-jcmw-g37q", "version": "14.1.1" }, { "aliases": [ "CVE-2026-118780" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118780", "percentile": 0.06585, "score": 0.00172 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-4487-j8r4-4g2f", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store", "url": "https://github.com/advisories/GHSA-4487-j8r4-4g2f", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118775" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118775", "percentile": 0.24273, "score": 0.00313 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-4642-5mcj-2rqw", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: ASN.1 OID first arc truncation in asn1.oidToDer", "url": "https://github.com/advisories/GHSA-4642-5mcj-2rqw", "version": "1.4.0" }, { "aliases": [ "CVE-2026-118781" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-118781", "percentile": 0.01734, "score": 0.00119 }, "fix_state": "fixed", "fixed_in": [ "1.4.1" ], "id": "GHSA-h6cr-wjv9-3cpp", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "node-forge", "severity": "Low", "summary": "Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)", "url": "https://github.com/advisories/GHSA-h6cr-wjv9-3cpp", "version": "1.4.0" }, { "aliases": [ "CVE-2026-9358" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-9358", "percentile": 0.25604, "score": 0.00325 }, "fix_state": "fixed", "fixed_in": [ "6.1.3" ], "id": "GHSA-w9m9-85wc-3x92", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "postcss-selector-parser", "severity": "Low", "summary": "postcss-selector-parser allows denial of service through uncontrolled AST recursion", "url": "https://github.com/advisories/GHSA-w9m9-85wc-3x92", "version": "6.1.2" }, { "aliases": [ "CVE-2026-9358" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-9358", "percentile": 0.25604, "score": 0.00325 }, "fix_state": "fixed", "fixed_in": [ "7.1.3" ], "id": "GHSA-w9m9-85wc-3x92", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "postcss-selector-parser", "severity": "Low", "summary": "postcss-selector-parser allows denial of service through uncontrolled AST recursion", "url": "https://github.com/advisories/GHSA-w9m9-85wc-3x92", "version": "7.1.1" }, { "aliases": [ "CVE-2026-115897" ], "ecosystem": "npm", "epss": { "cve": "CVE-2026-115897", "percentile": 0.23496, "score": 0.00307 }, "fix_state": "fixed", "fixed_in": [ "7.1.3" ], "id": "GHSA-m5mm-p8h7-m29v", "kev": null, "location": "package-lock.json", "osv_confirmed": true, "package": "serialize-javascript", "severity": "Low", "summary": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped