{"matches":[{"vulnerability":{"id":"GHSA-587h-7wmj-h5pm","dataSource":"https://github.com/advisories/GHSA-587h-7wmj-h5pm","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm","https://nvd.nist.gov/vuln/detail/CVE-2026-112942","https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":1.008},"relatedVulnerabilities":[{"id":"CVE-2026-112942","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory component plus a line-and-column suffix: the path is resolved while the suffix is still present, and launch-editor removes the suffix before its existsSync check, leaving the existing parent directory for existsSync and allowing the attacker-controlled file argument to pass filename existence validation without requiring the malicious filename to exist. The bypass can lead to OS command injection when combined with the separately described Windows percent-expansion flaw. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112942","epss":0.01344,"percentile":0.71405,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112942","cwe":"CWE-77","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.5"}},"found":{"vulnerabilityID":"GHSA-587h-7wmj-h5pm","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.5?package-id=21002728682f55ec","name":"vite","version":"7.3.5","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:vitejs:vite:7.3.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-rq7h-c2jc-7f22","dataSource":"https://github.com/advisories/GHSA-rq7h-c2jc-7f22","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22","https://nvd.nist.gov/vuln/detail/CVE-2026-112946","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"],"description":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.4813799999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112946","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112946","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa","https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721","https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905","https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0","https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3","https://github.com/vitejs/vite/pull/23656","https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, import analysis can record a root-relative browser URL in safeModulePaths instead of the cleaned resolved module identifier. On a network-accessible, non-Windows development server, an imported project file whose URL matches an absolute host path can authorize a later raw-filesystem request for that host file, provided server.fs.deny does not block it. The request can disclose the matching file outside the project root, but it does not allow arbitrary path traversal because the host path must correspond to a project-relative URL authorized by the application graph. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112946","epss":0.00852,"percentile":0.58266,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112946","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112946","cwe":"CWE-284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.5"}},"found":{"vulnerabilityID":"GHSA-rq7h-c2jc-7f22","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.5?package-id=21002728682f55ec","name":"vite","version":"7.3.5","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:vitejs:vite:7.3.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-7w5x-hrqm-74c2","dataSource":"https://github.com/advisories/GHSA-7w5x-hrqm-74c2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2","https://nvd.nist.gov/vuln/detail/CVE-2026-85730","https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f","https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1","https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0"],"description":"smol-toml: Denial of Service via malformed TOML documents","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85730","epss":0.00524,"percentile":0.44443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85730","cwe":"CWE-606","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85730","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.1"],"state":"fixed","available":[{"version":"1.7.1","date":"2026-09-10","kind":"first-observed"}]},"advisories":[],"risk":0.41134},"relatedVulnerabilities":[{"id":"CVE-2026-85730","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85730","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/squirrelchat/smol-toml/commit/30f5c367d946b695f379b5d4f0946b2f0a0a8c2f","https://github.com/squirrelchat/smol-toml/releases/tag/v1.7.1","https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-7w5x-hrqm-74c2","https://medium.com/@ravindu.lakmina1/seven-bytes-that-freeze-a-node-js-server-forever-the-story-of-cve-2026-85730-3213328b38f0"],"description":"smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-85730","epss":0.00524,"percentile":0.44443,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-85730","cwe":"CWE-606","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-85730","cwe":"CWE-835","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"smol-toml","version":"1.6.1"}},"found":{"vulnerabilityID":"GHSA-7w5x-hrqm-74c2","versionConstraint":"<=1.7.0 (semantic)"},"fix":{"suggestedVersion":"1.7.1"}}],"artifact":{"id":"pkg:npm/smol-toml@1.6.1?package-id=fd797d8e4bb12fb5","name":"smol-toml","version":"1.6.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:smol-toml:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol-toml:smol_toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol_toml:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol_toml:smol_toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol:smol_toml:1.6.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/smol-toml@1.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2883-xcg3-v3hh","dataSource":"https://github.com/advisories/GHSA-2883-xcg3-v3hh","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh","https://nvd.nist.gov/vuln/detail/CVE-2026-84375","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2"],"description":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.3.2"],"state":"fixed","available":[{"version":"4.3.2","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.40575000000000006},"relatedVulnerabilities":[{"id":"CVE-2026-84375","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639","https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480","https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b","https://github.com/nodeca/js-yaml/pull/797","https://github.com/nodeca/js-yaml/releases/tag/3.15.2","https://github.com/nodeca/js-yaml/releases/tag/4.3.2","https://github.com/nodeca/js-yaml/releases/tag/5.4.1","https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"],"description":"js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumption in applications that parse untrusted YAML, and merge processing is enabled by default on these release lines. In v3 & v4, merge is enabled by default so the severity score is higher. This issue is fixed in versions 3.15.2, 4.3.2, and 5.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84375","epss":0.00541,"percentile":0.45507,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84375","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-84375","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"4.3.1"}},"found":{"vulnerabilityID":"GHSA-2883-xcg3-v3hh","versionConstraint":">=4.0.0,<4.3.2 (semantic)"},"fix":{"suggestedVersion":"4.3.2"}}],"artifact":{"id":"pkg:npm/js-yaml@4.3.1?package-id=75b680452405c6f2","name":"js-yaml","version":"4.3.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:nodeca:js-yaml:4.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@4.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r825-w8mm-5pxw","dataSource":"https://github.com/advisories/GHSA-r825-w8mm-5pxw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw","https://nvd.nist.gov/vuln/detail/CVE-2026-112944","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.398325},"relatedVulnerabilities":[{"id":"CVE-2026-112944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4","https://github.com/vitejs/launch-editor/pull/156","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative WSL path, launchEditor forwards the path without forcing it to be interpreted as a positional filename. Editor option parsing then treats the attacker-controlled filename as a command-line flag, which can cause unintended file overwrite or arbitrary command execution by the selected editor. The affected editors are Vim and gVim, MacVim, Emacs and Emacsclient, and Notepad++ when a plugin exposes dangerous operations; WSL path conversion keeps Vite and newer middleware callers exposed. This issue is fixed in version 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112944","epss":0.00705,"percentile":0.53381,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112944","cwe":"CWE-88","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.5"}},"found":{"vulnerabilityID":"GHSA-r825-w8mm-5pxw","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.5?package-id=21002728682f55ec","name":"vite","version":"7.3.5","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:vitejs:vite:7.3.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-9m75-vc3g-4x39","dataSource":"https://github.com/advisories/GHSA-9m75-vc3g-4x39","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39","https://nvd.nist.gov/vuln/detail/CVE-2026-119195","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119195","epss":0.00527,"percentile":0.44645,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119195","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.39525000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-119195","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119195","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119195","epss":0.00527,"percentile":0.44645,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119195","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-9m75-vc3g-4x39","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=fd73e2a7fda103d2","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-9m75-vc3g-4x39","dataSource":"https://github.com/advisories/GHSA-9m75-vc3g-4x39","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39","https://nvd.nist.gov/vuln/detail/CVE-2026-119195","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119195","epss":0.00527,"percentile":0.44645,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119195","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.39525000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-119195","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119195","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119195","epss":0.00527,"percentile":0.44645,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119195","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-9m75-vc3g-4x39","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=6d8f5cf4ff280993","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.20"],"state":"fixed","available":[{"version":"1.1.20","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.18"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":"<1.1.20 (semantic)"},"fix":{"suggestedVersion":"1.1.20"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.18?package-id=43299567a6e6a94d","name":"brace-expansion","version":"1.1.18","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhr7-859c-m2p7","dataSource":"https://github.com/advisories/GHSA-qhr7-859c-m2p7","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7","https://nvd.nist.gov/vuln/detail/CVE-2026-102278","https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"],"description":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.11"],"state":"fixed","available":[{"version":"5.0.11","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.36825},"relatedVulnerabilities":[{"id":"CVE-2026-102278","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b","https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c","https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied as an untrusted pattern. expand_ is affected. expand is affected. Comma members is affected. Single set is affected. native stack exhaustion during nested sub-expansion. process-terminating denial of service. This issue is fixed in versions 1.1.20, 2.1.6, 3.0.8, and 5.0.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102278","epss":0.00491,"percentile":0.42217,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102278","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102278","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-qhr7-859c-m2p7","versionConstraint":">=4.0.0,<5.0.11 (semantic)"},"fix":{"suggestedVersion":"5.0.11"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=14a0d92beb12e302","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-68fv-2mgg-jv7q","dataSource":"https://github.com/advisories/GHSA-68fv-2mgg-jv7q","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-93749","https://github.com/7rulnik/source-map-js/issues/76","https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service","https://github.com/7rulnik/source-map-js/pull/79","https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016","https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"],"description":"source-map-js allows event-loop denial of service through indexed source-map section offsets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["1.2.2"],"state":"fixed","available":[{"version":"1.2.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.35490000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-93749","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/7rulnik/source-map-js","https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118","https://github.com/7rulnik/source-map-js/issues/76","https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"],"description":"source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93749","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93749","cwe":"CWE-1284","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"source-map-js","version":"1.2.1"}},"found":{"vulnerabilityID":"GHSA-68fv-2mgg-jv7q","versionConstraint":">=1.0.0,<1.2.2 (semantic)"},"fix":{"suggestedVersion":"1.2.2"}}],"artifact":{"id":"pkg:npm/source-map-js@1.2.1?package-id=736a8d1744a0be51","name":"source-map-js","version":"1.2.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:source-map-js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map-js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map_js:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source-map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source_map:source_map_js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source-map-js:1.2.1:*:*:*:*:*:*:*","cpe:2.3:a:source:source_map_js:1.2.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/source-map-js@1.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-45c3-73f7-pv4m","dataSource":"https://github.com/advisories/GHSA-45c3-73f7-pv4m","namespace":"github:language:python","severity":"High","urls":["https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m","https://nvd.nist.gov/vuln/detail/CVE-2026-114605","https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023","https://github.com/rthalley/dnspython/releases/tag/v2.9.0"],"description":"dnspython dns.name.from_wire_parser() excessive CPU use","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114605","epss":0.00466,"percentile":0.40323,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114605","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.9.0"],"state":"fixed","available":[{"version":"2.9.0","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.3495},"relatedVulnerabilities":[{"id":"CVE-2026-114605","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114605","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023","https://github.com/rthalley/dnspython/releases/tag/v2.9.0","https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m"],"description":"dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications that process untrusted DNS messages. This issue is fixed in version 2.9.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114605","epss":0.00466,"percentile":0.40323,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114605","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"dnspython","version":"2.8.0"}},"found":{"vulnerabilityID":"GHSA-45c3-73f7-pv4m","versionConstraint":"<2.9.0 (python)"},"fix":{"suggestedVersion":"2.9.0"}}],"artifact":{"id":"pkg:pypi/dnspython@2.8.0?package-id=cccc24be988cb62c","name":"dnspython","version":"2.8.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-dnspython:python-dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python-dnspython:python_dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_dnspython:python-dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_dnspython:python_dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:dnspython:python-dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:dnspython:python_dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python-dnspython:dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python_dnspython:dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:dnspython:dnspython:2.8.0:*:*:*:*:*:*:*","cpe:2.3:a:python:dnspython:2.8.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/dnspython@2.8.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.19"],"state":"fixed","available":[{"version":"1.1.19","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.18"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":"<1.1.19 (semantic)"},"fix":{"suggestedVersion":"1.1.19"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.18?package-id=43299567a6e6a94d","name":"brace-expansion","version":"1.1.18","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-6j4f-fj2g-mc7p","dataSource":"https://github.com/advisories/GHSA-6j4f-fj2g-mc7p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p","https://nvd.nist.gov/vuln/detail/CVE-2026-102276","https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"],"description":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.10"],"state":"fixed","available":[{"version":"5.0.10","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.34125},"relatedVulnerabilities":[{"id":"CVE-2026-102276","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc","https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c","https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc","https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array triggers the argument-array path without deep recursion. These paths cause recursive and argument-array native stack exhaustion before max or maxLength can limit output, potentially terminating the Node.js process in a process-terminating denial of service. This issue is fixed in versions 1.1.19, 2.1.5, 3.0.7, and 5.0.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102276","epss":0.00455,"percentile":0.3952,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102276","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102276","cwe":"CWE-674","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-6j4f-fj2g-mc7p","versionConstraint":">=4.0.0,<5.0.10 (semantic)"},"fix":{"suggestedVersion":"5.0.10"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=14a0d92beb12e302","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-fm9c-5rcf-2q5p","dataSource":"https://github.com/advisories/GHSA-fm9c-5rcf-2q5p","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p","https://nvd.nist.gov/vuln/detail/CVE-2026-119194","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119194","epss":0.00425,"percentile":0.36826,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119194","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119194","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119194","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p"],"description":"pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119194","epss":0.00425,"percentile":0.36826,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119194","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-fm9c-5rcf-2q5p","versionConstraint":">=0.3.3,<0.6.5 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=fd73e2a7fda103d2","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-fm9c-5rcf-2q5p","dataSource":"https://github.com/advisories/GHSA-fm9c-5rcf-2q5p","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p","https://nvd.nist.gov/vuln/detail/CVE-2026-119194","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119194","epss":0.00425,"percentile":0.36826,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119194","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119194","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119194","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p"],"description":"pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119194","epss":0.00425,"percentile":0.36826,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119194","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-fm9c-5rcf-2q5p","versionConstraint":">=0.3.3,<0.6.5 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=6d8f5cf4ff280993","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-2qm8-x737-gmw5","dataSource":"https://github.com/advisories/GHSA-2qm8-x737-gmw5","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5","https://nvd.nist.gov/vuln/detail/CVE-2026-119196","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119196","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119196","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119196","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119196","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119196","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119196","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-2qm8-x737-gmw5","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=6d8f5cf4ff280993","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-2qm8-x737-gmw5","dataSource":"https://github.com/advisories/GHSA-2qm8-x737-gmw5","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5","https://nvd.nist.gov/vuln/detail/CVE-2026-119196","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119196","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119196","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119196","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119196","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119196","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119196","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-2qm8-x737-gmw5","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=fd73e2a7fda103d2","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-mm57-4v3p-rchx","dataSource":"https://github.com/advisories/GHSA-mm57-4v3p-rchx","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx","https://nvd.nist.gov/vuln/detail/CVE-2026-119197","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic-complexity denial of service in binary REAL decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119197","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119197","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119197","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119197","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119197","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119197","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-mm57-4v3p-rchx","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=6d8f5cf4ff280993","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-mm57-4v3p-rchx","dataSource":"https://github.com/advisories/GHSA-mm57-4v3p-rchx","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx","https://nvd.nist.gov/vuln/detail/CVE-2026-119197","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic-complexity denial of service in binary REAL decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119197","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119197","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119197","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119197","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119197","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119197","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-mm57-4v3p-rchx","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=fd73e2a7fda103d2","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-w5vr-8v7q-w6rv","dataSource":"https://github.com/advisories/GHSA-w5vr-8v7q-w6rv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-45819","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","https://www.npmjs.com/package/baseline-browser-mapping","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137","https://github.com/web-platform-dx/baseline-browser-mapping/commit/de733e2d8959559f7bb255d5927f3afcb6f31589","https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0"],"description":"baseline-browser-mapping process termination on invalid input causes denial of service","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45819","epss":0.00507,"percentile":0.43261,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45819","cwe":"CWE-705","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45819","cwe":"CWE-755","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}],"fix":{"versions":["2.11.0"],"state":"fixed","available":[{"version":"2.11.0","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.29406},"relatedVulnerabilities":[{"id":"CVE-2026-45819","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45819","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/web-platform-dx/baseline-browser-mapping/blob/b7881aa61c8a057e24468ab5ee18c5ecedbbf691/src/index.ts#L142","https://github.com/web-platform-dx/baseline-browser-mapping/pull/137/changes#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519","https://www.npmjs.com/package/baseline-browser-mapping"],"description":"baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.","cvss":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber","metrics":{"baseScore":6.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-45819","epss":0.00507,"percentile":0.43261,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-45819","cwe":"CWE-705","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"},{"cve":"CVE-2026-45819","cwe":"CWE-755","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"baseline-browser-mapping","version":"2.10.29"}},"found":{"vulnerabilityID":"GHSA-w5vr-8v7q-w6rv","versionConstraint":">=2.0.0,<2.11.0 (semantic)"},"fix":{"suggestedVersion":"2.11.0"}}],"artifact":{"id":"pkg:npm/baseline-browser-mapping@2.10.29?package-id=445e70f2b81a5be6","name":"baseline-browser-mapping","version":"2.10.29","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:baseline-browser-mapping:baseline-browser-mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser-mapping:baseline_browser_mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser_mapping:baseline-browser-mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser_mapping:baseline_browser_mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser:baseline-browser-mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline-browser:baseline_browser_mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser:baseline-browser-mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline_browser:baseline_browser_mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline:baseline-browser-mapping:2.10.29:*:*:*:*:*:*:*","cpe:2.3:a:baseline:baseline_browser_mapping:2.10.29:*:*:*:*:*:*:*"],"purl":"pkg:npm/baseline-browser-mapping@2.10.29","upstreams":[]}},{"vulnerability":{"id":"GHSA-27r3-jxmh-p828","dataSource":"https://github.com/advisories/GHSA-27r3-jxmh-p828","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"description":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.4.0"],"state":"fixed","available":[{"version":"2.4.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.29100000000000004},"relatedVulnerabilities":[{"id":"CVE-2026-111181","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111181","epss":0.00388,"percentile":0.32923,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111181","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"body-parser","version":"2.3.0"}},"found":{"vulnerabilityID":"GHSA-27r3-jxmh-p828","versionConstraint":">=2.0.0,<2.4.0 (semantic)"},"fix":{"suggestedVersion":"2.4.0"}}],"artifact":{"id":"pkg:npm/body-parser@2.3.0?package-id=9181651607d7cac1","name":"body-parser","version":"2.3.0","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:body-parser:2.3.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/body-parser@2.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-82fw-gwwq-j7x9","dataSource":"https://github.com/advisories/GHSA-82fw-gwwq-j7x9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9","https://nvd.nist.gov/vuln/detail/CVE-2026-84373","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"],"description":"Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.11"],"state":"fixed","available":[{"version":"4.1.11","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.28721500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-84373","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84373","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2","https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"],"description":"Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"4.1.10"}},"found":{"vulnerabilityID":"GHSA-82fw-gwwq-j7x9","versionConstraint":">=2.1.0,<4.1.11 (semantic)"},"fix":{"suggestedVersion":"4.1.11"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@4.1.10?package-id=59bedc6c9ca48906","name":"@vitest/mocker","version":"4.1.10","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:4.1.10:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@4.1.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-82fw-gwwq-j7x9","dataSource":"https://github.com/advisories/GHSA-82fw-gwwq-j7x9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9","https://nvd.nist.gov/vuln/detail/CVE-2026-84373","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2"],"description":"Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.11"],"state":"fixed","available":[{"version":"4.1.11","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.28721500000000005},"relatedVulnerabilities":[{"id":"CVE-2026-84373","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84373","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/51edf2b072902aec6d30c90ebaafd8f121c6f9d8","https://github.com/vitest-dev/vitest/commit/8ff9b9a9efca7c6cfd5243569440de8d7a33aec4","https://github.com/vitest-dev/vitest/commit/fe5a11d3ceac5ec10d6d7d21a46d4caca132c48f","https://github.com/vitest-dev/vitest/pull/10972","https://github.com/vitest-dev/vitest/pull/10974","https://github.com/vitest-dev/vitest/releases/tag/v4.1.11","https://github.com/vitest-dev/vitest/releases/tag/v5.0.0-rc.2","https://github.com/vitest-dev/vitest/security/advisories/GHSA-82fw-gwwq-j7x9"],"description":"Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84373","epss":0.00527,"percentile":0.44677,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84373","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vitest","version":"4.1.10"}},"found":{"vulnerabilityID":"GHSA-82fw-gwwq-j7x9","versionConstraint":">=2.1.0,<4.1.11 (semantic)"},"fix":{"suggestedVersion":"4.1.11"}}],"artifact":{"id":"pkg:npm/vitest@4.1.10?package-id=9b3003c87b0087e7","name":"vitest","version":"4.1.10","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:vitest.dev:vitest:4.1.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vitest@4.1.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-58mr-gqgx-xq4g","dataSource":"https://github.com/advisories/GHSA-58mr-gqgx-xq4g","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g","https://nvd.nist.gov/vuln/detail/CVE-2026-84394","https://github.com/fastify/fast-uri/pull/214","https://github.com/fastify/fast-uri/commit/e00815236bc94107e44ef1b2f5318a06bac225c0","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.6","https://github.com/fastify/fast-uri/releases/tag/v3.1.7","https://github.com/fastify/fast-uri/releases/tag/v4.1.4"],"description":"fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84394","epss":0.0038,"percentile":0.32008,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84394","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.7"],"state":"fixed","available":[{"version":"3.1.7","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.28500000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-84394","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84394","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-58mr-gqgx-xq4g"],"description":"fast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSRF denylist, a redirect allowlist, or proxy routing, and then passes the original URL to an HTTP client evaluates its policy against a string that is not the host the request reaches. The same host is carried through normalize, equal, and resolve. This affects fast-uri versions 2.4.5, 3.1.6, and 4.1.3, and is fixed in 2.4.6, 3.1.7, and 4.1.4, where parse() reports a malformed host for any host that contains a bracket but is not a valid IPv6 literal.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84394","epss":0.0038,"percentile":0.32008,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84394","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.6"}},"found":{"vulnerabilityID":"GHSA-58mr-gqgx-xq4g","versionConstraint":"=3.1.6 (semantic)"},"fix":{"suggestedVersion":"3.1.7"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.6?package-id=dd54ffdcc402f136","name":"fast-uri","version":"3.1.6","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-84m7-p3x7-pcfv","dataSource":"https://github.com/advisories/GHSA-84m7-p3x7-pcfv","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv","https://nvd.nist.gov/vuln/detail/CVE-2026-59951","https://github.com/modelcontextprotocol/python-sdk/pull/3395","https://github.com/modelcontextprotocol/python-sdk/pull/3426","https://github.com/modelcontextprotocol/python-sdk/commit/92120b4b0f50385af096592d7cee932fc1d994e7","https://github.com/modelcontextprotocol/python-sdk/commit/d2290ca3434731b68ea3e2270bc06a6e6575931b","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"],"description":"MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59951","epss":0.00458,"percentile":0.39727,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59951","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-59951","cwe":"CWE-772","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.30.0"],"state":"fixed","available":[{"version":"1.30.0","date":"2026-10-16","kind":"first-observed"}]},"advisories":[],"risk":0.27938},"relatedVulnerabilities":[{"id":"CVE-2026-59951","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59951","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/modelcontextprotocol/python-sdk/commit/92120b4b0f50385af096592d7cee932fc1d994e7","https://github.com/modelcontextprotocol/python-sdk/commit/d2290ca3434731b68ea3e2270bc06a6e6575931b","https://github.com/modelcontextprotocol/python-sdk/pull/3395","https://github.com/modelcontextprotocol/python-sdk/pull/3426","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0","https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv"],"description":"The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59951","epss":0.00458,"percentile":0.39727,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59951","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-59951","cwe":"CWE-772","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"mcp","version":"1.28.1"}},"found":{"vulnerabilityID":"GHSA-84m7-p3x7-pcfv","versionConstraint":">=1.8.0,<1.30.0 (python)"},"fix":{"suggestedVersion":"1.30.0"}}],"artifact":{"id":"pkg:pypi/mcp@1.28.1?package-id=d7d4753b83fd405f","name":"mcp","version":"1.28.1","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python-mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python-mcp:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:mcp:1.28.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/mcp@1.28.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-22jm-h49p-29qw","dataSource":"https://github.com/advisories/GHSA-22jm-h49p-29qw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa"],"description":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111767","epss":0.00345,"percentile":0.28049,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111767","cwe":"CWE-862","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.32.0"],"state":"fixed","available":[{"version":"1.32.0","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.277725},"relatedVulnerabilities":[{"id":"CVE-2026-111767","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111767","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/commit/727075b5bbeb77fbea22041b36b72a73042160fa","https://github.com/modelcontextprotocol/typescript-sdk/pull/2925","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-22jm-h49p-29qw"],"description":"MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","metrics":{"baseScore":8.6,"exploitabilityScore":3.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111767","epss":0.00345,"percentile":0.28049,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111767","cwe":"CWE-639","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-111767","cwe":"CWE-862","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.26.0"}},"found":{"vulnerabilityID":"GHSA-22jm-h49p-29qw","versionConstraint":">=1.24.0,<1.32.0 (semantic)"},"fix":{"suggestedVersion":"1.32.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0?package-id=37565713f4347e4e","name":"@modelcontextprotocol/sdk","version":"1.26.0","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.26.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g6gw-c38x-mqfc","dataSource":"https://github.com/advisories/GHSA-g6gw-c38x-mqfc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc","https://nvd.nist.gov/vuln/detail/CVE-2026-84364","https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5"],"description":"Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84364","epss":0.00529,"percentile":0.44782,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.13.5"],"state":"fixed","available":[{"version":"4.13.5","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.27243500000000004},"relatedVulnerabilities":[{"id":"CVE-2026-84364","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84364","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/531e9c5a3ae058d10de33f643055bd4009a87178","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-g6gw-c38x-mqfc"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84364","epss":0.00529,"percentile":0.44782,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84364","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.34"}},"found":{"vulnerabilityID":"GHSA-g6gw-c38x-mqfc","versionConstraint":"<4.13.5 (semantic)"},"fix":{"suggestedVersion":"4.13.5"}}],"artifact":{"id":"pkg:npm/hono@4.12.34?package-id=7501660e9106d928","name":"hono","version":"4.12.34","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.34","upstreams":[]}},{"vulnerability":{"id":"GHSA-gqvv-2mrq-wpjv","dataSource":"https://github.com/advisories/GHSA-gqvv-2mrq-wpjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv","https://nvd.nist.gov/vuln/detail/CVE-2026-84365","https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5"],"description":"Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84365","epss":0.00437,"percentile":0.38025,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.13.5"],"state":"fixed","available":[{"version":"4.13.5","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.25127499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-84365","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84365","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/3a67f7f3997e1437d108f7bcba2dbcee2df69221","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-gqvv-2mrq-wpjv"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84365","epss":0.00437,"percentile":0.38025,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84365","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.34"}},"found":{"vulnerabilityID":"GHSA-gqvv-2mrq-wpjv","versionConstraint":"<4.13.5 (semantic)"},"fix":{"suggestedVersion":"4.13.5"}}],"artifact":{"id":"pkg:npm/hono@4.12.34?package-id=7501660e9106d928","name":"hono","version":"4.12.34","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.34","upstreams":[]}},{"vulnerability":{"id":"GHSA-xcq7-p3pf-p88h","dataSource":"https://github.com/advisories/GHSA-xcq7-p3pf-p88h","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1"],"description":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114603","epss":0.00487,"percentile":0.41954,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114603","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114603","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.1"],"state":"fixed","available":[{"version":"1.45.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.250805},"relatedVulnerabilities":[{"id":"CVE-2026-114603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114603","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1","https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h"],"description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114603","epss":0.00487,"percentile":0.41954,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114603","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114603","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"opentelemetry-api","version":"1.39.1"}},"found":{"vulnerabilityID":"GHSA-xcq7-p3pf-p88h","versionConstraint":"<=1.45.0 (python)"},"fix":{"suggestedVersion":"1.45.1"}}],"artifact":{"id":"pkg:pypi/opentelemetry-api@1.39.1?package-id=24116564041f1a10","name":"opentelemetry-api","version":"1.39.1","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-opentelemetry-api:python-opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:python_opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:python-opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:python_opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:python-opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:python_opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:python-opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:python_opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:python-opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:python_opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:python-opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:python_opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:python-opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:python_opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_opentelemetry_api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python:opentelemetry-api:1.39.1:*:*:*:*:*:*:*","cpe:2.3:a:python:opentelemetry_api:1.39.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/opentelemetry-api@1.39.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xcq7-p3pf-p88h","dataSource":"https://github.com/advisories/GHSA-xcq7-p3pf-p88h","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1"],"description":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114603","epss":0.00487,"percentile":0.41954,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114603","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114603","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.1"],"state":"fixed","available":[{"version":"1.45.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.250805},"relatedVulnerabilities":[{"id":"CVE-2026-114603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114603","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1","https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h"],"description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114603","epss":0.00487,"percentile":0.41954,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114603","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114603","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"opentelemetry-api","version":"1.41.1"}},"found":{"vulnerabilityID":"GHSA-xcq7-p3pf-p88h","versionConstraint":"<=1.45.0 (python)"},"fix":{"suggestedVersion":"1.45.1"}}],"artifact":{"id":"pkg:pypi/opentelemetry-api@1.41.1?package-id=1bbfbfb179857ed6","name":"opentelemetry-api","version":"1.41.1","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-opentelemetry-api:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python:opentelemetry_api:1.41.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/opentelemetry-api@1.41.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xcq7-p3pf-p88h","dataSource":"https://github.com/advisories/GHSA-xcq7-p3pf-p88h","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1"],"description":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114603","epss":0.00487,"percentile":0.41954,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114603","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114603","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.45.1"],"state":"fixed","available":[{"version":"1.45.1","date":"2026-10-23","kind":"first-observed"}]},"advisories":[],"risk":0.250805},"relatedVulnerabilities":[{"id":"CVE-2026-114603","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114603","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06","https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b","https://github.com/open-telemetry/opentelemetry-python/pull/5749","https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1","https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h"],"description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in opentelemetry/trace/span.py, reached through TraceContextTextMapPropagator.extract, parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking before the member-count limit is applied. Services using the default W3C Trace Context propagator can therefore spend excessive CPU time on one unauthenticated request when the HTTP server, parser, gateway, or custom carrier accepts a sufficiently large header. The processing can occupy a synchronous worker or delay unrelated requests on the same asynchronous event loop. The impact is limited to availability and does not expose or modify telemetry data or allow code execution. This issue is fixed in version 1.45.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114603","epss":0.00487,"percentile":0.41954,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114603","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-114603","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"opentelemetry-api","version":"1.41.1"}},"found":{"vulnerabilityID":"GHSA-xcq7-p3pf-p88h","versionConstraint":"<=1.45.0 (python)"},"fix":{"suggestedVersion":"1.45.1"}}],"artifact":{"id":"pkg:pypi/opentelemetry-api@1.41.1?package-id=8767cd0ccc0a9f48","name":"opentelemetry-api","version":"1.41.1","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-opentelemetry-api:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry-api:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry_api:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python-opentelemetry:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python_opentelemetry:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry-api:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry_api:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:opentelemetry:opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_opentelemetry_api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python:opentelemetry-api:1.41.1:*:*:*:*:*:*:*","cpe:2.3:a:python:opentelemetry_api:1.41.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/opentelemetry-api@1.41.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-crvj-82cr-hjcx","dataSource":"https://github.com/advisories/GHSA-crvj-82cr-hjcx","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx","https://nvd.nist.gov/vuln/detail/CVE-2026-84363","https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5"],"description":"Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84363","epss":0.00448,"percentile":0.38985,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.13.5"],"state":"fixed","available":[{"version":"4.13.5","date":"2026-09-09","kind":"first-observed"}]},"advisories":[],"risk":0.24416},"relatedVulnerabilities":[{"id":"CVE-2026-84363","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84363","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc","https://github.com/honojs/hono/releases/tag/v4.13.5","https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84363","epss":0.00448,"percentile":0.38985,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84363","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.34"}},"found":{"vulnerabilityID":"GHSA-crvj-82cr-hjcx","versionConstraint":"<4.13.5 (semantic)"},"fix":{"suggestedVersion":"4.13.5"}}],"artifact":{"id":"pkg:npm/hono@4.12.34?package-id=7501660e9106d928","name":"hono","version":"4.12.34","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.34","upstreams":[]}},{"vulnerability":{"id":"GHSA-698v-4r3x-3vcv","dataSource":"https://github.com/advisories/GHSA-698v-4r3x-3vcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv","https://nvd.nist.gov/vuln/detail/CVE-2026-112943","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"],"description":"launch-editor: escapeCmdArgs() omits % escaping on Windows","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0.23390999999999992},"relatedVulnerabilities":[{"id":"CVE-2026-112943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc","https://github.com/vitejs/launch-editor/pull/155","https://github.com/vitejs/launch-editor/releases/tag/v2.14.2","https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"],"description":"launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This vulnerability is fixed in 2.14.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112943","epss":0.00414,"percentile":0.35746,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112943","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.5"}},"found":{"vulnerabilityID":"GHSA-698v-4r3x-3vcv","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.5?package-id=21002728682f55ec","name":"vite","version":"7.3.5","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:vitejs:vite:7.3.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-54p9-h82j-f925","dataSource":"https://github.com/advisories/GHSA-54p9-h82j-f925","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925","https://nvd.nist.gov/vuln/detail/CVE-2026-104874","https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40","https://github.com/aio-libs/multidict/releases/tag/v6.9.1"],"description":"Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104874","epss":0.00448,"percentile":0.38972,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104874","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.9.1"],"state":"fixed","available":[{"version":"6.9.1","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.23071999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-104874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104874","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40","https://github.com/aio-libs/multidict/releases/tag/v6.9.1","https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925"],"description":"Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104874","epss":0.00448,"percentile":0.38972,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104874","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"multidict","version":"6.7.1"}},"found":{"vulnerabilityID":"GHSA-54p9-h82j-f925","versionConstraint":">=6.7.0,<=6.9.0 (python)"},"fix":{"suggestedVersion":"6.9.1"}}],"artifact":{"id":"pkg:pypi/multidict@6.7.1?package-id=485c8810411b9fc4","name":"multidict","version":"6.7.1","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python-multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python-multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:multidict:6.7.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/multidict@6.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-54p9-h82j-f925","dataSource":"https://github.com/advisories/GHSA-54p9-h82j-f925","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925","https://nvd.nist.gov/vuln/detail/CVE-2026-104874","https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40","https://github.com/aio-libs/multidict/releases/tag/v6.9.1"],"description":"Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104874","epss":0.00448,"percentile":0.38972,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104874","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.9.1"],"state":"fixed","available":[{"version":"6.9.1","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.23071999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-104874","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104874","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40","https://github.com/aio-libs/multidict/releases/tag/v6.9.1","https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925"],"description":"Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_itemsview_sub1_impl fail to release new key-identity and value references returned for each operand element. Applications that perform these operations over attacker-influenced sequences can leak two strong references per element, and garbage collection cannot reclaim them, so repeated operations can cause unbounded process memory growth and denial of service. Forward union, intersection, non-tuple operand elements, and pure-Python builds are not affected by this reference leak. This issue is fixed in version 6.9.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104874","epss":0.00448,"percentile":0.38972,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104874","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"multidict","version":"6.7.1"}},"found":{"vulnerabilityID":"GHSA-54p9-h82j-f925","versionConstraint":">=6.7.0,<=6.9.0 (python)"},"fix":{"suggestedVersion":"6.9.1"}}],"artifact":{"id":"pkg:pypi/multidict@6.7.1?package-id=c98403877039f050","name":"multidict","version":"6.7.1","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python-multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python-multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python_multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:multidict:multidict:6.7.1:*:*:*:*:*:*:*","cpe:2.3:a:python:multidict:6.7.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/multidict@6.7.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-2vr4-cq9g-pvrc","dataSource":"https://github.com/advisories/GHSA-2vr4-cq9g-pvrc","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc","https://nvd.nist.gov/vuln/detail/CVE-2026-101910","https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"description":"ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101910","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.1"],"state":"fixed","available":[{"version":"10.5.1","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.22967},"relatedVulnerabilities":[{"id":"CVE-2026-101910","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101910","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range. A successful bypass can cross the intended network trust boundary. This issue is fixed in version 10.5.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101910","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101910","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.3.1"}},"found":{"vulnerabilityID":"GHSA-2vr4-cq9g-pvrc","versionConstraint":">=10.2.0,<=10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.3.1?package-id=a94188c1d0de8dd0","name":"ip-address","version":"10.3.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h35f-9h28-mq5c","dataSource":"https://github.com/advisories/GHSA-h35f-9h28-mq5c","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c","https://nvd.nist.gov/vuln/detail/CVE-2026-59890","https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2026-3447.yaml","https://github.com/pypa/setuptools/releases/tag/v83.0.0"],"description":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59890","epss":0.00405,"percentile":0.34805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-59890","cwe":"CWE-697","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["83.0.0"],"state":"fixed","available":[{"version":"83.0.0","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.22477499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-59890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","https://github.com/pypa/setuptools/releases/tag/v83.0.0","https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"],"description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59890","epss":0.00405,"percentile":0.34805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-59890","cwe":"CWE-697","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"setuptools","version":"80.10.2"}},"found":{"vulnerabilityID":"GHSA-h35f-9h28-mq5c","versionConstraint":"<83.0.0 (python)"},"fix":{"suggestedVersion":"83.0.0"}}],"artifact":{"id":"pkg:pypi/setuptools@80.10.2?package-id=995d50ef013af393","name":"setuptools","version":"80.10.2","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:setuptools:80.10.2:*:*:*:*:*:*:*"],"purl":"pkg:pypi/setuptools@80.10.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-h35f-9h28-mq5c","dataSource":"https://github.com/advisories/GHSA-h35f-9h28-mq5c","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c","https://nvd.nist.gov/vuln/detail/CVE-2026-59890","https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2026-3447.yaml","https://github.com/pypa/setuptools/releases/tag/v83.0.0"],"description":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59890","epss":0.00405,"percentile":0.34805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-59890","cwe":"CWE-697","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["83.0.0"],"state":"fixed","available":[{"version":"83.0.0","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.22477499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-59890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","https://github.com/pypa/setuptools/releases/tag/v83.0.0","https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"],"description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59890","epss":0.00405,"percentile":0.34805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-59890","cwe":"CWE-697","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"setuptools","version":"82.0.1"}},"found":{"vulnerabilityID":"GHSA-h35f-9h28-mq5c","versionConstraint":"<83.0.0 (python)"},"fix":{"suggestedVersion":"83.0.0"}}],"artifact":{"id":"pkg:pypi/setuptools@82.0.1?package-id=b618b530c0db1100","name":"setuptools","version":"82.0.1","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:setuptools:82.0.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/setuptools@82.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.1.21"],"state":"fixed","available":[{"version":"1.1.21","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"1.1.18"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":"<1.1.21 (semantic)"},"fix":{"suggestedVersion":"1.1.21"}}],"artifact":{"id":"pkg:npm/brace-expansion@1.1.18?package-id=43299567a6e6a94d","name":"brace-expansion","version":"1.1.18","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:1.1.18:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@1.1.18","upstreams":[]}},{"vulnerability":{"id":"GHSA-q2hr-2g5m-vwhr","dataSource":"https://github.com/advisories/GHSA-q2hr-2g5m-vwhr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr","https://nvd.nist.gov/vuln/detail/CVE-2026-102277","https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"],"description":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["5.0.12"],"state":"fixed","available":[{"version":"5.0.12","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.22042},"relatedVulnerabilities":[{"id":"CVE-2026-102277","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96","https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22","https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364","https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"],"description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a recoverable CPU denial of service. This issue is fixed in versions 1.1.21, 2.1.7, 3.0.9, and 5.0.12.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102277","epss":0.00428,"percentile":0.37125,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102277","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102277","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"brace-expansion","version":"5.0.9"}},"found":{"vulnerabilityID":"GHSA-q2hr-2g5m-vwhr","versionConstraint":">=4.0.0,<5.0.12 (semantic)"},"fix":{"suggestedVersion":"5.0.12"}}],"artifact":{"id":"pkg:npm/brace-expansion@5.0.9?package-id=14a0d92beb12e302","name":"brace-expansion","version":"5.0.9","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:juliangruber:brace-expansion:5.0.9:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/brace-expansion@5.0.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-rpw4-54j3-4h4q","dataSource":"https://github.com/advisories/GHSA-rpw4-54j3-4h4q","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q","https://nvd.nist.gov/vuln/detail/CVE-2026-101913","https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1"],"description":"ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101913","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101913","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.1"],"state":"fixed","available":[{"version":"10.5.1","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.21809},"relatedVulnerabilities":[{"id":"CVE-2026-101913","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101913","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546","https://github.com/beaugunderson/ip-address/releases/tag/v10.5.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101913","epss":0.00386,"percentile":0.32688,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101913","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101913","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.3.1"}},"found":{"vulnerabilityID":"GHSA-rpw4-54j3-4h4q","versionConstraint":"<=10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.3.1?package-id=a94188c1d0de8dd0","name":"ip-address","version":"10.3.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-5h93-6whr-6q8j","dataSource":"https://github.com/advisories/GHSA-5h93-6whr-6q8j","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-5h93-6whr-6q8j","https://github.com/modelcontextprotocol/python-sdk/pull/3397","https://github.com/modelcontextprotocol/python-sdk/pull/3448","https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e","https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"],"description":"Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116685","epss":0.00399,"percentile":0.34176,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116685","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.30.0"],"state":"fixed","available":[{"version":"1.30.0","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.21745499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-116685","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116685","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e","https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99","https://github.com/modelcontextprotocol/python-sdk/pull/3397","https://github.com/modelcontextprotocol/python-sdk/pull/3448","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0","https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-5h93-6whr-6q8j"],"description":"The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116685","epss":0.00399,"percentile":0.34176,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116685","cwe":"CWE-200","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"mcp","version":"1.28.1"}},"found":{"vulnerabilityID":"GHSA-5h93-6whr-6q8j","versionConstraint":">=1.8.0,<1.30.0 (python)"},"fix":{"suggestedVersion":"1.30.0"}}],"artifact":{"id":"pkg:pypi/mcp@1.28.1?package-id=d7d4753b83fd405f","name":"mcp","version":"1.28.1","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python-mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python-mcp:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:mcp:1.28.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/mcp@1.28.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-h3mg-xc3c-68pw","dataSource":"https://github.com/advisories/GHSA-h3mg-xc3c-68pw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw","https://nvd.nist.gov/vuln/detail/CVE-2026-101911","https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"description":"ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101911","epss":0.00383,"percentile":0.32363,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101911","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.7.1"],"state":"fixed","available":[{"version":"10.7.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.216395},"relatedVulnerabilities":[{"id":"CVE-2026-101911","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101911","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134","https://github.com/beaugunderson/ip-address/commit/8b34a21e0839b37c094066816fb2c2c48a2adcf5","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; common defaults typically exclude 32 MiB fields. Megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB. The affected entry points include Address6.isValid and construction paths that reach parse. This issue is fixed in version 10.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101911","epss":0.00383,"percentile":0.32363,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101911","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101911","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.3.1"}},"found":{"vulnerabilityID":"GHSA-h3mg-xc3c-68pw","versionConstraint":"<=10.7.0 (semantic)"},"fix":{"suggestedVersion":"10.7.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.3.1?package-id=a94188c1d0de8dd0","name":"ip-address","version":"10.3.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-w4fh-qvv9-3v23","dataSource":"https://github.com/advisories/GHSA-w4fh-qvv9-3v23","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23","https://github.com/modelcontextprotocol/python-sdk/pull/3447","https://github.com/modelcontextprotocol/python-sdk/pull/3451","https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40","https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"],"description":"Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116684","epss":0.00365,"percentile":0.30377,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116684","cwe":"CWE-863","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.30.0"],"state":"fixed","available":[{"version":"1.30.0","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.21535},"relatedVulnerabilities":[{"id":"CVE-2026-116684","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116684","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40","https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512","https://github.com/modelcontextprotocol/python-sdk/pull/3447","https://github.com/modelcontextprotocol/python-sdk/pull/3451","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0","https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23"],"description":"The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. This issue is fixed in versions 1.30.0 and 2.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116684","epss":0.00365,"percentile":0.30377,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116684","cwe":"CWE-863","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"mcp","version":"1.28.1"}},"found":{"vulnerabilityID":"GHSA-w4fh-qvv9-3v23","versionConstraint":">=1.10.0,<1.30.0 (python)"},"fix":{"suggestedVersion":"1.30.0"}}],"artifact":{"id":"pkg:pypi/mcp@1.28.1?package-id=d7d4753b83fd405f","name":"mcp","version":"1.28.1","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python-mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python-mcp:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:mcp:1.28.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/mcp@1.28.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-6hr6-w5qg-qmwg","dataSource":"https://github.com/advisories/GHSA-6hr6-w5qg-qmwg","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg","https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6"],"description":"h2: Duplicate Host header could facilitate request smuggling","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71554","epss":0.00418,"percentile":0.36141,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71554","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.4.1"],"state":"fixed","available":[{"version":"4.4.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.21527},"relatedVulnerabilities":[{"id":"CVE-2026-71554","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71554","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6","https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg"],"description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71554","epss":0.00418,"percentile":0.36141,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71554","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"h2","version":"4.3.0"}},"found":{"vulnerabilityID":"GHSA-6hr6-w5qg-qmwg","versionConstraint":"<=4.4.0 (python)"},"fix":{"suggestedVersion":"4.4.1"}}],"artifact":{"id":"pkg:pypi/h2@4.3.0?package-id=e06e46ca19c5ae7d","name":"h2","version":"4.3.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-h2:python-h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python-h2:python_h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python_h2:python-h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python_h2:python_h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:h2:python-h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:h2:python_h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python-h2:h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python_h2:h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python:h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:h2:h2:4.3.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/h2@4.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6hr6-w5qg-qmwg","dataSource":"https://github.com/advisories/GHSA-6hr6-w5qg-qmwg","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg","https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6"],"description":"h2: Duplicate Host header could facilitate request smuggling","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71554","epss":0.00418,"percentile":0.36141,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71554","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.4.1"],"state":"fixed","available":[{"version":"4.4.1","date":"2026-08-07","kind":"first-observed"}]},"advisories":[],"risk":0.21527},"relatedVulnerabilities":[{"id":"CVE-2026-71554","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-71554","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6","https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg"],"description":"h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-71554","epss":0.00418,"percentile":0.36141,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-71554","cwe":"CWE-444","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"h2","version":"4.3.0"}},"found":{"vulnerabilityID":"GHSA-6hr6-w5qg-qmwg","versionConstraint":"<=4.4.0 (python)"},"fix":{"suggestedVersion":"4.4.1"}}],"artifact":{"id":"pkg:pypi/h2@4.3.0?package-id=a5dc73c41ca2a5f5","name":"h2","version":"4.3.0","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-h2:python-h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python-h2:python_h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python_h2:python-h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python_h2:python_h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:h2:python-h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:h2:python_h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python-h2:h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python_h2:h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:python:h2:4.3.0:*:*:*:*:*:*:*","cpe:2.3:a:h2:h2:4.3.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/h2@4.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-42vr-xj54-vc7v","dataSource":"https://github.com/advisories/GHSA-42vr-xj54-vc7v","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"description":"PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101918","epss":0.00413,"percentile":0.35602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.212695},"relatedVulnerabilities":[{"id":"CVE-2026-101918","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101918","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101918","epss":0.00413,"percentile":0.35602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.14.0"}},"found":{"vulnerabilityID":"GHSA-42vr-xj54-vc7v","versionConstraint":">=2.0.0a1,<=2.14.0 (python)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.14.0?package-id=c185931ab69da106","name":"pyjwt","version":"2.14.0","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.14.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-42vr-xj54-vc7v","dataSource":"https://github.com/advisories/GHSA-42vr-xj54-vc7v","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"description":"PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101918","epss":0.00413,"percentile":0.35602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.212695},"relatedVulnerabilities":[{"id":"CVE-2026-101918","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101918","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101918","epss":0.00413,"percentile":0.35602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.14.0"}},"found":{"vulnerabilityID":"GHSA-42vr-xj54-vc7v","versionConstraint":">=2.0.0a1,<=2.14.0 (python)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.14.0?package-id=2caeccfa94890562","name":"pyjwt","version":"2.14.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.14.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-42vr-xj54-vc7v","dataSource":"https://github.com/advisories/GHSA-42vr-xj54-vc7v","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"description":"PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101918","epss":0.00413,"percentile":0.35602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.212695},"relatedVulnerabilities":[{"id":"CVE-2026-101918","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101918","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101918","epss":0.00413,"percentile":0.35602,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.14.0"}},"found":{"vulnerabilityID":"GHSA-42vr-xj54-vc7v","versionConstraint":">=2.0.0a1,<=2.14.0 (python)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.14.0?package-id=eb0fa5441abafe20","name":"pyjwt","version":"2.14.0","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.14.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rj75-hqrm-r3gf","dataSource":"https://github.com/advisories/GHSA-rj75-hqrm-r3gf","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf","https://nvd.nist.gov/vuln/detail/CVE-2026-104844","https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/pull/346","https://github.com/postcss/postcss-selector-parser/commit/70b0779c843462197380d25daa02d1528bf7eae5","https://github.com/postcss/postcss-selector-parser/releases/tag/6.1.5"],"description":"PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.1.5"],"state":"fixed","available":[{"version":"6.1.5","date":"2026-10-26","kind":"first-observed"}]},"advisories":[],"risk":0.212005},"relatedVulnerabilities":[{"id":"CVE-2026-104844","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104844","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd","https://github.com/postcss/postcss-selector-parser/releases/tag/7.1.6","https://github.com/postcss/postcss-selector-parser/security/advisories/GHSA-rj75-hqrm-r3gf"],"description":"PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The uniqs() deduplication and per-index class and ID membership checks repeatedly scan the class and ID index arrays, while a separate Sass-interpolation filtering pass also performs repeated linear scanning. Together, these passes make parsing quadratic in the number of indexes and allow a crafted selector to occupy a synchronous parser thread. The maxNestingDepth guard does not mitigate the issue because the hostile selector can have zero nesting depth. Only consumers that synchronously parse untrusted selectors in an exposed request path are affected; ordinary build-time parsing of trusted sources is not affected. This issue is fixed in version 7.1.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104844","epss":0.00389,"percentile":0.32999,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104844","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-104844","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"postcss-selector-parser","version":"6.0.10"}},"found":{"vulnerabilityID":"GHSA-rj75-hqrm-r3gf","versionConstraint":"<6.1.5 (semantic)"},"fix":{"suggestedVersion":"6.1.5"}}],"artifact":{"id":"pkg:npm/postcss-selector-parser@6.0.10?package-id=682c522dee503f76","name":"postcss-selector-parser","version":"6.0.10","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:postcss-selector-parser:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector-parser:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector_parser:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss-selector:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss_selector:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss-selector-parser:6.0.10:*:*:*:*:*:*:*","cpe:2.3:a:postcss:postcss_selector_parser:6.0.10:*:*:*:*:*:*:*"],"purl":"pkg:npm/postcss-selector-parser@6.0.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-j6r3-76f7-8jcv","dataSource":"https://github.com/advisories/GHSA-j6r3-76f7-8jcv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv","https://nvd.nist.gov/vuln/detail/CVE-2026-101912","https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1"],"description":"ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101912","epss":0.0037,"percentile":0.30998,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101912","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.7.1"],"state":"fixed","available":[{"version":"10.7.1","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.20904999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-101912","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101912","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.1","https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv"],"description":"ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-101912","epss":0.0037,"percentile":0.30998,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-101912","cwe":"CWE-697","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-101912","cwe":"CWE-843","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.3.1"}},"found":{"vulnerabilityID":"GHSA-j6r3-76f7-8jcv","versionConstraint":"<=10.7.0 (semantic)"},"fix":{"suggestedVersion":"10.7.1"}}],"artifact":{"id":"pkg:npm/ip-address@10.3.1?package-id=a94188c1d0de8dd0","name":"ip-address","version":"10.3.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-g6x2-hccm-hh4m","dataSource":"https://github.com/advisories/GHSA-g6x2-hccm-hh4m","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m","https://nvd.nist.gov/vuln/detail/CVE-2026-102598","https://github.com/pallets/werkzeug/pull/3309","https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6","https://github.com/pallets/werkzeug/releases/tag/3.1.9"],"description":"Werkzeug safe_join() allows Windows special device names","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102598","epss":0.0037,"percentile":0.3092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102598","cwe":"CWE-67","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.20904999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-102598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102598","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6","https://github.com/pallets/werkzeug/pull/3309","https://github.com/pallets/werkzeug/releases/tag/3.1.9","https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m"],"description":"Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102598","epss":0.0037,"percentile":0.3092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102598","cwe":"CWE-67","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"werkzeug","version":"3.1.7"}},"found":{"vulnerabilityID":"GHSA-g6x2-hccm-hh4m","versionConstraint":"<3.1.9 (python)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:pypi/werkzeug@3.1.7?package-id=5f130b8667dd0bc2","name":"werkzeug","version":"3.1.7","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-werkzeug:python-werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:python-werkzeug:python_werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:python-werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:python_werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:python-werkzeug:werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:python-werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:python_werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:werkzeug:3.1.7:*:*:*:*:*:*:*","cpe:2.3:a:python:werkzeug:3.1.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/werkzeug@3.1.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-g6x2-hccm-hh4m","dataSource":"https://github.com/advisories/GHSA-g6x2-hccm-hh4m","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m","https://nvd.nist.gov/vuln/detail/CVE-2026-102598","https://github.com/pallets/werkzeug/pull/3309","https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6","https://github.com/pallets/werkzeug/releases/tag/3.1.9"],"description":"Werkzeug safe_join() allows Windows special device names","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102598","epss":0.0037,"percentile":0.3092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102598","cwe":"CWE-67","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.20904999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-102598","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102598","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6","https://github.com/pallets/werkzeug/pull/3309","https://github.com/pallets/werkzeug/releases/tag/3.1.9","https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m"],"description":"Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102598","epss":0.0037,"percentile":0.3092,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102598","cwe":"CWE-67","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"werkzeug","version":"3.1.8"}},"found":{"vulnerabilityID":"GHSA-g6x2-hccm-hh4m","versionConstraint":"<3.1.9 (python)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:pypi/werkzeug@3.1.8?package-id=51fc83403330430a","name":"werkzeug","version":"3.1.8","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-werkzeug:python-werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python-werkzeug:python_werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:python-werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:python_werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python-werkzeug:werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python_werkzeug:werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:python-werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:python_werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python-werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python_werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:werkzeug:werkzeug:3.1.8:*:*:*:*:*:*:*","cpe:2.3:a:python:werkzeug:3.1.8:*:*:*:*:*:*:*"],"purl":"pkg:pypi/werkzeug@3.1.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-6pq8-jhm2-2vcw","dataSource":"https://github.com/advisories/GHSA-6pq8-jhm2-2vcw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw","https://nvd.nist.gov/vuln/detail/CVE-2026-110816","https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/releases/tag/v6.16.1"],"description":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.16.1"],"state":"fixed","available":[{"version":"6.16.1","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.19872},"relatedVulnerabilities":[{"id":"CVE-2026-110816","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727","https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"],"description":"### Summary\n\n\n\n`qs.stringify` with `arrayFormat: 'comma'` throws `TypeError: Cannot convert object to primitive value` when an array element cannot be coerced to a string, such as an object with an own non-callable `toString` (`{ \"toString\": \"x\" }`) or a null-prototype object. The comma format joins array elements with `Array.prototype.join` and, under `encodeValuesOnly`, first passes each element through `String()` in `utils.encode`; neither guards against an element whose string coercion fails.\n\n\n\n### Details\n\n\n\nIn `lib/stringify.js`, the comma branch collapses the array with `obj.join(',')`. For an element whose own `toString` is not callable, `ToPrimitive` skips it, falls through to `Object.prototype.valueOf` (which returns the object itself), and throws. Under `encodeValuesOnly: true`, the same element first reaches `String(str)` in `utils.encode` (`lib/utils.js`) and throws there. Nested arrays (`{ \"a\": [[{ \"toString\": \"x\" }]] }`) throw the same way, through `Array.prototype.toString`. The `indices`, `brackets`, and `repeat` formats walk into object elements instead of coercing them, and are not affected.\n\n\n\nSuch elements can come from untrusted input. `JSON.parse` produces `{ \"a\": [{ \"toString\": \"x\" }] }` with no qs option involved. `qs.parse(\"a[0][toString]=x\", { allowPrototypes: true })` keeps the `toString` key, and `qs.parse(\"a[][b]=c\", { plainObjects: true })` produces a null-prototype element; the default parse options drop `toString` and produce ordinary objects, which do not throw. Express 4's default `query parser`, Express 5's `extended` query parser, and body-parser's `urlencoded({ extended: true })` all call `qs.parse` with `allowPrototypes: true`.\n\n\n\n#### PoC\n\n\n\n```js\n\n\n\nvar qs = require(\"qs\");\n\n\n\nqs.stringify(JSON.parse(\"{\\\"a\\\":[{\\\"toString\\\":\\\"x\\\"}]}\"), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[0][toString]=x\", { allowPrototypes: true }), { arrayFormat: \"comma\" });\n\n\n\nqs.stringify(qs.parse(\"a[][b]=c\", { plainObjects: true }), { arrayFormat: \"comma\", encodeValuesOnly: true });\n\n\n\n// TypeError: Cannot convert object to primitive value\n\n\n\n```\n\n\n\n#### Fix\n\n\n\nApplied in a952e75 on `main` and released as v6.16.1: an element whose string coercion would fail is coerced to its primitive `valueOf`, if any, or else to `Object.prototype.toString`, so it renders as `[object Object]`, the same as any other object element already does under the comma format. Nested arrays are walked the way `join` walks them. Every input that did not previously throw serializes exactly as before, and a `toString` or `valueOf` that itself throws still propagates.\n\n\n\n### Affected versions\n\n\n\n`>=6.7.0 <6.16.1`, fixed in v6.16.1.\n\n\n\nThe `join` path was introduced with the comma format in b84acba and first shipped in v6.7.0; v6.6.x and earlier ignore `arrayFormat: 'comma'` and are not affected. The `encodeValuesOnly` `String()` site was introduced in 4c4b23d (v6.11.1); before that, the same input throws at `join`. Every release from v6.7.0 through v6.16.0 is affected.\n\n\n\n### Impact\n\n\n\nAn unauthenticated request can make any code path that re-serializes attacker-influenced data with `qs.stringify` and `arrayFormat: 'comma'` (for example, rebuilding a query string from `req.query` for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an `async` Express 4 handler (where the throw becomes an unhandled promise rejection) or a bare `http` request handler, the process exits, so the impact in that case depends on the application error handling rather than on qs. The default `arrayFormat` (`indices`) is not affected.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110816","epss":0.00368,"percentile":0.30715,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110816","cwe":"CWE-248","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"},{"cve":"CVE-2026-110816","cwe":"CWE-704","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.16.0"}},"found":{"vulnerabilityID":"GHSA-6pq8-jhm2-2vcw","versionConstraint":">=6.7.0,<=6.16.0 (semantic)"},"fix":{"suggestedVersion":"6.16.1"}}],"artifact":{"id":"pkg:npm/qs@6.16.0?package-id=ffa9c984a3d11052","name":"qs","version":"6.16.0","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:qs_project:qs:6.16.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.16.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3g3m-2fjr-6pw4","dataSource":"https://github.com/advisories/GHSA-3g3m-2fjr-6pw4","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4","https://nvd.nist.gov/vuln/detail/CVE-2026-118773","https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2"],"description":"Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["14.0.2"],"state":"fixed","available":[{"version":"14.0.2","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.19774999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-118773","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118773","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-glob/commit/4682e8c9babee1b385202ede36389634e12076d7","https://github.com/isaacs/node-glob/releases/tag/v14.0.2","https://github.com/isaacs/node-glob/security/advisories/GHSA-3g3m-2fjr-6pw4"],"description":"Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB(), GlobUtil.walkCB2(), GlobUtil.walkCBSync(), and GlobUtil.walkCB2Sync(), invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout() rejects or emits an error, execution can continue into processor.processPatterns(), readdirCB(), and recursive traversal. The issue affects glob() and globStream() when applications expose attacker-influenced patterns or directory trees and rely on cancellation as a traversal budget. Repeated timed-out requests can stack background filesystem operations and CPU work, degrading worker throughput or service availability; no confidentiality or integrity impact was observed. This issue is fixed in 14.0.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118773","epss":0.0035,"percentile":0.28709,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118773","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"13.0.6"}},"found":{"vulnerabilityID":"GHSA-3g3m-2fjr-6pw4","versionConstraint":">=9.0.0,<=14.0.1 (semantic)"},"fix":{"suggestedVersion":"14.0.2"}}],"artifact":{"id":"pkg:npm/glob@13.0.6?package-id=63646f7ab1b228fc","name":"glob","version":"13.0.6","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:isaacs:glob:13.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@13.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-rwrf-2pqf-9j8j","dataSource":"https://github.com/advisories/GHSA-rwrf-2pqf-9j8j","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j","https://github.com/modelcontextprotocol/python-sdk/pull/3394","https://github.com/modelcontextprotocol/python-sdk/pull/3396","https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836","https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"],"description":"Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116686","epss":0.00337,"percentile":0.27122,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116686","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.30.0"],"state":"fixed","available":[{"version":"1.30.0","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0.193775},"relatedVulnerabilities":[{"id":"CVE-2026-116686","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116686","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836","https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b","https://github.com/modelcontextprotocol/python-sdk/pull/3394","https://github.com/modelcontextprotocol/python-sdk/pull/3396","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0","https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j"],"description":"The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-116686","epss":0.00337,"percentile":0.27122,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-116686","cwe":"CWE-918","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"mcp","version":"1.28.1"}},"found":{"vulnerabilityID":"GHSA-rwrf-2pqf-9j8j","versionConstraint":">=1.10.0,<1.30.0 (python)"},"fix":{"suggestedVersion":"1.30.0"}}],"artifact":{"id":"pkg:pypi/mcp@1.28.1?package-id=d7d4753b83fd405f","name":"mcp","version":"1.28.1","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python-mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:python-mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:python_mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python-mcp:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python_mcp:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:python:mcp:1.28.1:*:*:*:*:*:*:*","cpe:2.3:a:mcp:mcp:1.28.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/mcp@1.28.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-rmxm-3fg6-px4f","dataSource":"https://github.com/advisories/GHSA-rmxm-3fg6-px4f","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f","https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f","https://github.com/honojs/node-server/releases/tag/v2.1.3"],"description":"@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118663","epss":0.00353,"percentile":0.28982,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118663","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.3"],"state":"fixed","available":[{"version":"2.1.3","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.181795},"relatedVulnerabilities":[{"id":"CVE-2026-118663","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118663","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f","https://github.com/honojs/node-server/releases/tag/v2.1.3","https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f"],"description":"@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root, although the flaw does not permit traversal outside that root. This issue is fixed in version 2.1.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118663","epss":0.00353,"percentile":0.28982,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118663","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@hono/node-server","version":"1.19.17"}},"found":{"vulnerabilityID":"GHSA-rmxm-3fg6-px4f","versionConstraint":">=1.19.10,<2.1.3 (semantic)"},"fix":{"suggestedVersion":"2.1.3"}}],"artifact":{"id":"pkg:npm/%40hono/node-server@1.19.17?package-id=98c2d8d59e76e5e4","name":"@hono/node-server","version":"1.19.17","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@hono\\/node-server:\\@hono\\/node-server:1.19.17:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node-server:\\@hono\\/node_server:1.19.17:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node_server:\\@hono\\/node-server:1.19.17:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node_server:\\@hono\\/node_server:1.19.17:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node:\\@hono\\/node-server:1.19.17:*:*:*:*:*:*:*","cpe:2.3:a:\\@hono\\/node:\\@hono\\/node_server:1.19.17:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40hono/node-server@1.19.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-qw65-cvwx-89v3","dataSource":"https://github.com/advisories/GHSA-qw65-cvwx-89v3","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3","https://nvd.nist.gov/vuln/detail/CVE-2026-84292","https://github.com/fastify/fast-uri/commit/820e8478dd7da3d09f187bfaf35d50b71f67b8b4","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.6","https://github.com/fastify/fast-uri/releases/tag/v3.1.7","https://github.com/fastify/fast-uri/releases/tag/v4.1.4"],"description":"fast-uri vulnerable to authority injection via an unvalidated port in serialize","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.7"],"state":"fixed","available":[{"version":"3.1.7","date":"2026-09-29","kind":"first-observed"}]},"advisories":[],"risk":0.17925000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-84292","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84292","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-qw65-cvwx-89v3"],"description":"fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch it. This affects applications that build URIs from parts and assign untrusted data to the port component through the serialize, normalize, or equal functions in their object forms. The issue affects fast-uri versions before 2.4.6, from 3.0.0 before 3.1.7, and from 4.0.0 before 4.1.4. It is fixed in 2.4.6, 3.1.7, and 4.1.4, where recomposeAuthority rejects any port that is not a digit sequence per RFC 3986.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-84292","epss":0.00239,"percentile":0.15045,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-84292","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.6"}},"found":{"vulnerabilityID":"GHSA-qw65-cvwx-89v3","versionConstraint":">=3.0.0,<3.1.7 (semantic)"},"fix":{"suggestedVersion":"3.1.7"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.6?package-id=dd54ffdcc402f136","name":"fast-uri","version":"3.1.6","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-rxp7-6hxx-x8q5","dataSource":"https://github.com/advisories/GHSA-rxp7-6hxx-x8q5","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5","https://nvd.nist.gov/vuln/detail/CVE-2026-111997","https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd","https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"],"description":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}],"fix":{"versions":["10.7.4"],"state":"fixed","available":[{"version":"10.7.4","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.177975},"relatedVulnerabilities":[{"id":"CVE-2026-111997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"],"description":"ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a function call that uses the Address6 constructor.","cvss":[{"source":"cve@mitre.org","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111997","epss":0.00315,"percentile":0.24412,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111997","cwe":"CWE-1333","source":"cve@mitre.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip-address","version":"10.3.1"}},"found":{"vulnerabilityID":"GHSA-rxp7-6hxx-x8q5","versionConstraint":"<=10.7.3 (semantic)"},"fix":{"suggestedVersion":"10.7.4"}}],"artifact":{"id":"pkg:npm/ip-address@10.3.1?package-id=a94188c1d0de8dd0","name":"ip-address","version":"10.3.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:beaugunderson:ip-address:10.3.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip-address@10.3.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-866g-f22w-33x8","dataSource":"https://github.com/advisories/GHSA-866g-f22w-33x8","namespace":"github:language:javascript","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-8769","https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb","https://vuldb.com/submit/811406","https://vuldb.com/vuln/364394","https://vuldb.com/vuln/364394/cti","https://github.com/vercel/ai/pull/16374","https://github.com/vercel/ai/commit/6a436e31d247d678ddaedfc6f61e73ac0595e4b4","https://github.com/vercel/ai/commit/b30e43ac3fae2432a40b4f4f27f844f3d78b119e","https://github.com/vercel/ai/commit/b85c4fbc603b8173cf50a9790823397aada908a9","https://github.com/vercel/ai/blob/main/packages/provider-utils/CHANGELOG.md#501","https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@3.0.28","https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@4.0.33","https://github.com/vercel/ai/releases/tag/@ai-sdk/provider-utils@5.0.1"],"description":"@ai-sdk/provider-utils has an Uncontrolled Resource Consumption issue","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8769","epss":0.00561,"percentile":0.46661,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8769","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-8769","cwe":"CWE-404","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["4.0.33"],"state":"fixed","available":[{"version":"4.0.33","date":"2026-09-08","kind":"first-observed"}]},"advisories":[],"risk":0.17391},"relatedVulnerabilities":[{"id":"CVE-2026-8769","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8769","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/YLChen-007/fb1096bc8428bed9a428f764d9d103bb","https://vuldb.com/submit/811406","https://vuldb.com/vuln/364394","https://vuldb.com/vuln/364394/cti"],"description":"A vulnerability was determined in vercel ai up to 3.0.97. The impacted element is the function createJsonResponseHandler/createJsonErrorResponseHandler of the file packages/provider-utils/src/response-handler.ts of the component provider-utils. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"exploitabilityScore":2.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-8769","epss":0.00561,"percentile":0.46661,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-8769","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-8769","cwe":"CWE-404","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@ai-sdk/provider-utils","version":"4.0.29"}},"found":{"vulnerabilityID":"GHSA-866g-f22w-33x8","versionConstraint":">=4.0.0-beta.10,<4.0.33 (semantic)"},"fix":{"suggestedVersion":"4.0.33"}}],"artifact":{"id":"pkg:npm/%40ai-sdk/provider-utils@4.0.29?package-id=59069f8d14b69ab8","name":"@ai-sdk/provider-utils","version":"4.0.29","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@ai-sdk\\/provider-utils:\\@ai-sdk\\/provider-utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai-sdk\\/provider-utils:\\@ai_sdk\\/provider_utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai_sdk\\/provider_utils:\\@ai-sdk\\/provider-utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai_sdk\\/provider_utils:\\@ai_sdk\\/provider_utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai-sdk\\/provider:\\@ai-sdk\\/provider-utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai-sdk\\/provider:\\@ai_sdk\\/provider_utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai_sdk\\/provider:\\@ai-sdk\\/provider-utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai_sdk\\/provider:\\@ai_sdk\\/provider_utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai:\\@ai-sdk\\/provider-utils:4.0.29:*:*:*:*:*:*:*","cpe:2.3:a:\\@ai:\\@ai_sdk\\/provider_utils:4.0.29:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40ai-sdk/provider-utils@4.0.29","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"10.2.3"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@10.2.3?package-id=5af1c8c3442a7e89","name":"minimatch","version":"10.2.3","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:10.2.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@10.2.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.4"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@3.1.4?package-id=c78426a110781b7a","name":"minimatch","version":"3.1.4","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.4:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-g3hv-75wg-m249","dataSource":"https://github.com/advisories/GHSA-g3hv-75wg-m249","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249","https://nvd.nist.gov/vuln/detail/CVE-2026-118764","https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1"],"description":"minimatch has potential denial of service via globparts amplification","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["11.0.1"],"state":"fixed","available":[{"version":"11.0.1","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.173145},"relatedVulnerabilities":[{"id":"CVE-2026-118764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8","https://github.com/isaacs/minimatch/releases/tag/v11.0.1","https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess() so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled **/.. pattern segments inside a fixpoint loop, allowing generated globParts entries to be processed and expanded again. secondPhasePreProcess() then compares the expanded entries pairwise, so a short malicious glob can cause excessive CPU and memory consumption during pattern compilation. This issue is fixed in version 11.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-118764","epss":0.00291,"percentile":0.21753,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-118764","cwe":"CWE-405","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.7"}},"found":{"vulnerabilityID":"GHSA-g3hv-75wg-m249","versionConstraint":"<11.0.1 (semantic)"},"fix":{"suggestedVersion":"11.0.1"}}],"artifact":{"id":"pkg:npm/minimatch@9.0.7?package-id=79d458c591f78b83","name":"minimatch","version":"9.0.7","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.7:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-jpxq-7h8p-2q76","dataSource":"https://github.com/advisories/GHSA-jpxq-7h8p-2q76","namespace":"github:language:python","severity":"High","urls":["https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76","https://nvd.nist.gov/vuln/detail/CVE-2026-119283","https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17","https://github.com/authlib/joserfc/releases/tag/1.7.5"],"description":"joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119283","epss":0.00229,"percentile":0.13729,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119283","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.5"],"state":"fixed","available":[{"version":"1.7.5","date":"2026-10-30","kind":"first-observed"}]},"advisories":[],"risk":0.17174999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-119283","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119283","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17","https://github.com/authlib/joserfc/releases/tag/1.7.5","https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76"],"description":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119283","epss":0.00229,"percentile":0.13729,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119283","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"joserfc","version":"1.6.8"}},"found":{"vulnerabilityID":"GHSA-jpxq-7h8p-2q76","versionConstraint":"<1.7.5 (python)"},"fix":{"suggestedVersion":"1.7.5"}}],"artifact":{"id":"pkg:pypi/joserfc@1.6.8?package-id=5f688e6818a87924","name":"joserfc","version":"1.6.8","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python-joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python-joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:joserfc:1.6.8:*:*:*:*:*:*:*"],"purl":"pkg:pypi/joserfc@1.6.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-jpxq-7h8p-2q76","dataSource":"https://github.com/advisories/GHSA-jpxq-7h8p-2q76","namespace":"github:language:python","severity":"High","urls":["https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76","https://nvd.nist.gov/vuln/detail/CVE-2026-119283","https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17","https://github.com/authlib/joserfc/releases/tag/1.7.5"],"description":"joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119283","epss":0.00229,"percentile":0.13729,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119283","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.5"],"state":"fixed","available":[{"version":"1.7.5","date":"2026-10-30","kind":"first-observed"}]},"advisories":[],"risk":0.17174999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-119283","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119283","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/authlib/joserfc/commit/d6dc8df6c7609277e741069d3733e43996c1cd17","https://github.com/authlib/joserfc/releases/tag/1.7.5","https://github.com/authlib/joserfc/security/advisories/GHSA-jpxq-7h8p-2q76"],"description":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.5, joserfc.jwe.decrypt_json() accepts a JWE General JSON Serialization recipients array without a count limit and calls decrypt_cek() for every entry. An unauthenticated attacker who can submit a JWE to an endpoint using an RSA key-management algorithm can choose the number of private-key decryption operations performed by one request. The verify_all_recipients option does not reduce this work because the affected loop processes every recipient before consulting that setting, allowing repeated requests to exhaust service CPU without affecting confidentiality or integrity. This issue is fixed in version 1.7.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119283","epss":0.00229,"percentile":0.13729,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119283","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"joserfc","version":"1.6.8"}},"found":{"vulnerabilityID":"GHSA-jpxq-7h8p-2q76","versionConstraint":"<1.7.5 (python)"},"fix":{"suggestedVersion":"1.7.5"}}],"artifact":{"id":"pkg:pypi/joserfc@1.6.8?package-id=acea765dd9e63d28","name":"joserfc","version":"1.6.8","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python-joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python-joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:joserfc:1.6.8:*:*:*:*:*:*:*"],"purl":"pkg:pypi/joserfc@1.6.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-9jrq-w75r-8gcw","dataSource":"https://github.com/advisories/GHSA-9jrq-w75r-8gcw","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw","https://nvd.nist.gov/vuln/detail/CVE-2026-112945","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17"],"description":"Vite: Cross origin script execution through Vite custom middleware","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.3.7"],"state":"fixed","available":[{"version":"7.3.7","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.17136},"relatedVulnerabilities":[{"id":"CVE-2026-112945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112945","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17","https://github.com/vitejs/vite/pull/23653","https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw"],"description":"Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an existing local file while preserving attacker-supplied leading slashes in the generated proxy module URL. If the transformed HTML contains an inline module script and a victim browser loads the crafted development-server page, the leading double slash makes the browser fetch and execute an attacker-controlled module in the Vite-served page. This execution can expose sensitive page data or permit critical actions available to the affected application. This issue is fixed in versions 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112945","epss":0.00672,"percentile":0.52077,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112945","cwe":"CWE-80","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vite","version":"7.3.5"}},"found":{"vulnerabilityID":"GHSA-9jrq-w75r-8gcw","versionConstraint":">=7.0.0,<=7.3.6 (semantic)"},"fix":{"suggestedVersion":"7.3.7"}}],"artifact":{"id":"pkg:npm/vite@7.3.5?package-id=21002728682f55ec","name":"vite","version":"7.3.5","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:vitejs:vite:7.3.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vite@7.3.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-8v8h-hg4w-mvq2","dataSource":"https://github.com/advisories/GHSA-8v8h-hg4w-mvq2","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2","https://nvd.nist.gov/vuln/detail/CVE-2026-59980","https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c","https://cs.opensource.google/go/x/net/+/master:http2/hpack/hpack.go;l=468;drc=8e2b117aee74f6b86c207a808b0255de45c0a18a","https://docs.rs/http2/0.5.19/src/http2/hpack/decoder.rs.html#403","https://github.com/python-hyper/hpack/releases/tag/v4.2.0"],"description":"hpack: Unbounded variable integer decoding can cause run-away computation on malformed input","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59980","epss":0.00302,"percentile":0.22937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59980","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-09-25","kind":"first-observed"}]},"advisories":[],"risk":0.17063},"relatedVulnerabilities":[{"id":"CVE-2026-59980","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59980","namespace":"nvd:cpe","severity":"Medium","urls":["https://cs.opensource.google/go/x/net/+/master:http2/hpack/hpack.go;l=468;drc=8e2b117aee74f6b86c207a808b0255de45c0a18a","https://docs.rs/http2/0.5.19/src/http2/hpack/decoder.rs.html#403","https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c","https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2"],"description":"hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59980","epss":0.00302,"percentile":0.22937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59980","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"hpack","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-8v8h-hg4w-mvq2","versionConstraint":"<=4.1.0 (python)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:pypi/hpack@4.1.0?package-id=092e7582df53ed06","name":"hpack","version":"4.1.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-hpack:python-hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python-hpack:python_hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_hpack:python-hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_hpack:python_hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:hpack:python-hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:hpack:python_hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python-hpack:hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_hpack:hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:hpack:hpack:4.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/hpack@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8v8h-hg4w-mvq2","dataSource":"https://github.com/advisories/GHSA-8v8h-hg4w-mvq2","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2","https://nvd.nist.gov/vuln/detail/CVE-2026-59980","https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c","https://cs.opensource.google/go/x/net/+/master:http2/hpack/hpack.go;l=468;drc=8e2b117aee74f6b86c207a808b0255de45c0a18a","https://docs.rs/http2/0.5.19/src/http2/hpack/decoder.rs.html#403","https://github.com/python-hyper/hpack/releases/tag/v4.2.0"],"description":"hpack: Unbounded variable integer decoding can cause run-away computation on malformed input","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59980","epss":0.00302,"percentile":0.22937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59980","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-09-25","kind":"first-observed"}]},"advisories":[],"risk":0.17063},"relatedVulnerabilities":[{"id":"CVE-2026-59980","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59980","namespace":"nvd:cpe","severity":"Medium","urls":["https://cs.opensource.google/go/x/net/+/master:http2/hpack/hpack.go;l=468;drc=8e2b117aee74f6b86c207a808b0255de45c0a18a","https://docs.rs/http2/0.5.19/src/http2/hpack/decoder.rs.html#403","https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c","https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2"],"description":"hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59980","epss":0.00302,"percentile":0.22937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59980","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"hpack","version":"4.1.0"}},"found":{"vulnerabilityID":"GHSA-8v8h-hg4w-mvq2","versionConstraint":"<=4.1.0 (python)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"pkg:pypi/hpack@4.1.0?package-id=fc0f7ac84dce15b3","name":"hpack","version":"4.1.0","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-hpack:python-hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python-hpack:python_hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_hpack:python-hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_hpack:python_hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:hpack:python-hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:hpack:python_hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python-hpack:hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python_hpack:hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:python:hpack:4.1.0:*:*:*:*:*:*:*","cpe:2.3:a:hpack:hpack:4.1.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/hpack@4.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6qxp-vccf-f47h","dataSource":"https://github.com/advisories/GHSA-6qxp-vccf-f47h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h","https://github.com/modelcontextprotocol/typescript-sdk/pull/2887","https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0"],"description":"MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104850","epss":0.00226,"percentile":0.13295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104850","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-104850","cwe":"CWE-522","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["1.31.0"],"state":"fixed","available":[{"version":"1.31.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.16949999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-104850","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-104850","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/commit/edd12e282620ebf770d67316f19cf91d4112a1bd","https://github.com/modelcontextprotocol/typescript-sdk/pull/2887","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/v2.2.0","https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6qxp-vccf-f47h"],"description":"MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its protected resource metadata. Without any user interaction, the client would send that server the `refresh_token` and `client_secret` stored from an earlier sign-in (1.x), or the configured `client_secret` or signed assertion of a bundled non-interactive provider (1.x and 2.x). Only those applications that use the SDK as an MCP client over HTTP with an `authProvider`: your own `OAuthClientProvider`, or the bundled `ClientCredentialsProvider`, `PrivateKeyJwtProvider`, `StaticPrivateKeyJwtProvider` or (2.x) `CrossAppAccessProvider` and that may connect to an MCP server the owners does not fully trust while holding credentials for a legitimate authorization server are affected. `@modelcontextprotocol/sdk` 1.31.0 (1.x) and `@modelcontextprotocol/client` 2.2.0 (2.x) patch the issue. A workaround for those who cannot upgrade is available. 2.0.0 and 2.1.0 already accept `expectedIssuer`. On 1.x, the only workaround is to connect OAuth-enabled clients only to MCP servers you trust.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-104850","epss":0.00226,"percentile":0.13295,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-104850","cwe":"CWE-345","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-104850","cwe":"CWE-522","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.26.0"}},"found":{"vulnerabilityID":"GHSA-6qxp-vccf-f47h","versionConstraint":">=1.12.0,<1.31.0 (semantic)"},"fix":{"suggestedVersion":"1.31.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0?package-id=37565713f4347e4e","name":"@modelcontextprotocol/sdk","version":"1.26.0","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.26.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qxg6-89mg-rqv8","dataSource":"https://github.com/advisories/GHSA-qxg6-89mg-rqv8","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8","https://nvd.nist.gov/vuln/detail/CVE-2026-112949","https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3"],"description":"Vitest: Code injection via unauthenticated manual mock registration","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.1.12"],"state":"fixed","available":[{"version":"4.1.12","date":"2026-10-22","kind":"first-observed"}]},"advisories":[],"risk":0.16296},"relatedVulnerabilities":[{"id":"CVE-2026-112949","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112949","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/vitest-dev/vitest/commit/15cc006aa9f8683dc5f7e895d011fa7dc751ce35","https://github.com/vitest-dev/vitest/commit/b825313243dc55757e8d7c0f9e7a792135e13473","https://github.com/vitest-dev/vitest/releases/tag/v4.1.12","https://github.com/vitest-dev/vitest/releases/tag/v5.0.3","https://github.com/vitest-dev/vitest/security/advisories/GHSA-qxg6-89mg-rqv8"],"description":"Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112949","epss":0.00336,"percentile":0.27047,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112949","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-116","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112949","cwe":"CWE-306","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@vitest/mocker","version":"4.1.10"}},"found":{"vulnerabilityID":"GHSA-qxg6-89mg-rqv8","versionConstraint":">=2.1.0-beta.7,<4.1.12 (semantic)"},"fix":{"suggestedVersion":"4.1.12"}}],"artifact":{"id":"pkg:npm/%40vitest/mocker@4.1.10?package-id=59bedc6c9ca48906","name":"@vitest/mocker","version":"4.1.10","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@vitest\\/mocker:\\@vitest\\/mocker:4.1.10:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40vitest/mocker@4.1.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-5r4p-p66f-jhc7","dataSource":"https://github.com/advisories/GHSA-5r4p-p66f-jhc7","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7","https://nvd.nist.gov/vuln/detail/CVE-2026-111757","https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/releases/tag/v4.13.11"],"description":"Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111757","epss":0.0031,"percentile":0.23888,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.13.11"],"state":"fixed","available":[{"version":"4.13.11","date":"2026-10-20","kind":"first-observed"}]},"advisories":[],"risk":0.15965000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-111757","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111757","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/honojs/hono/commit/8b05c774ef1555c70f5ba5e2991b7e77cc3635cc","https://github.com/honojs/hono/security/advisories/GHSA-5r4p-p66f-jhc7"],"description":"Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the later static-file decode. The affected component is serveStatic. The trigger conditions are an application protects a static prefix with upstream middleware and serveStatic receives an attacker-controlled malformed percent-encoded path. The impact is unauthorized disclosure of a static file that upstream middleware was intended to protect. The issue does not permit traversal outside the configured static root. This issue is fixed in version 4.13.11.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-111757","epss":0.0031,"percentile":0.23888,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-111757","cwe":"CWE-174","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.34"}},"found":{"vulnerabilityID":"GHSA-5r4p-p66f-jhc7","versionConstraint":">=4.12.4,<4.13.11 (semantic)"},"fix":{"suggestedVersion":"4.13.11"}}],"artifact":{"id":"pkg:npm/hono@4.12.34?package-id=7501660e9106d928","name":"hono","version":"4.12.34","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.34","upstreams":[]}},{"vulnerability":{"id":"GHSA-w74x-v6f9-j3xg","dataSource":"https://github.com/advisories/GHSA-w74x-v6f9-j3xg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg","https://nvd.nist.gov/vuln/detail/CVE-2026-110306","https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4","https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3","https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.13874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-110306","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, fast-uri percent-decodes the scheme component with the legacy global unescape() function before validating it, so an input whose decoded scheme is a dangerous token is emitted as a live scheme even though RFC 3986 does not allow percent-encoding in a scheme and no other parser accepts it. An application that screens dangerous schemes on the raw input and then stores or renders the normalized or resolved result can turn an inert string into an executable javascript, data, or vbscript URL, producing a stored or reflected cross-site scripting vector, and the equal() comparison treats an encoded and a plain scheme as the same, which can bypass equality-based allowlists. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject input whose scheme part contains a percent sign, or check the parsed scheme against an allowlist after normalization and use that same parsed result rather than the raw string.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110306","epss":0.0025,"percentile":0.16356,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110306","cwe":"CWE-172","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110306","cwe":"CWE-180","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.6"}},"found":{"vulnerabilityID":"GHSA-w74x-v6f9-j3xg","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.6?package-id=dd54ffdcc402f136","name":"fast-uri","version":"3.1.6","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-wjr9-j795-jxcr","dataSource":"https://github.com/advisories/GHSA-wjr9-j795-jxcr","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr","https://nvd.nist.gov/vuln/detail/CVE-2026-110180","https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a","https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c","https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110180","epss":0.00255,"percentile":0.17126,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110180","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.12494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-110180","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8, and from 4.0.1 through 4.2.2, for HTTP-family schemes the canonicalizeHost() function passes the parsed host to the WHATWG URL parser and adopts its hostname without checking that the parser consumed the entire input as a host, so the authority can be silently rewritten: data before an at-sign is dropped and tab, carriage-return, and line-feed characters are stripped, with no error reported. An application that enforces host-based policy such as denylists, loopback filtering, redirect validation, or outbound proxy routing on one representation can then see the canonical host diverge from what it checked, allowing traffic to be steered to an unintended destination. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, reject an authority that contains more than one at-sign or any tab, carriage-return, or line-feed before calling fast-uri, or treat any non-empty parse error as fatal and compare hosts only from the same parse result.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110180","epss":0.00255,"percentile":0.17126,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110180","cwe":"CWE-20","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110180","cwe":"CWE-436","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.6"}},"found":{"vulnerabilityID":"GHSA-wjr9-j795-jxcr","versionConstraint":">=3.1.3,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.6?package-id=dd54ffdcc402f136","name":"fast-uri","version":"3.1.6","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-hrr3-gc8f-f4qj","dataSource":"https://github.com/advisories/GHSA-hrr3-gc8f-f4qj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj","https://nvd.nist.gov/vuln/detail/CVE-2026-86472","https://github.com/fastify/fast-uri/commit/5dabb86732aa2a7655e258719970e61e12b6b4d1","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.7","https://github.com/fastify/fast-uri/releases/tag/v3.1.8","https://github.com/fastify/fast-uri/releases/tag/v4.1.5"],"description":"fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.8"],"state":"fixed","available":[{"version":"3.1.8","date":"2026-09-30","kind":"first-observed"}]},"advisories":[],"risk":0.12397000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-86472","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86472","namespace":"nvd:cpe","severity":"Medium","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-hrr3-gc8f-f4qj"],"description":"fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"exploitabilityScore":2.3,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-86472","epss":0.00253,"percentile":0.16802,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-86472","cwe":"CWE-178","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.6"}},"found":{"vulnerabilityID":"GHSA-hrr3-gc8f-f4qj","versionConstraint":">=3.0.0,<3.1.8 (semantic)"},"fix":{"suggestedVersion":"3.1.8"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.6?package-id=dd54ffdcc402f136","name":"fast-uri","version":"3.1.6","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-69hj-f68j-2879","dataSource":"https://github.com/advisories/GHSA-69hj-f68j-2879","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879","https://nvd.nist.gov/vuln/detail/CVE-2026-112909","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.12209999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112909","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879"],"description":"filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.20.3"}},"found":{"vulnerabilityID":"GHSA-69hj-f68j-2879","versionConstraint":"<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.20.3?package-id=d8d1e268e92c45e6","name":"filelock","version":"3.20.3","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.20.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.20.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-69hj-f68j-2879","dataSource":"https://github.com/advisories/GHSA-69hj-f68j-2879","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879","https://nvd.nist.gov/vuln/detail/CVE-2026-112909","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.12209999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112909","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879"],"description":"filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.20.3"}},"found":{"vulnerabilityID":"GHSA-69hj-f68j-2879","versionConstraint":"<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.20.3?package-id=94b05fabd7ed0482","name":"filelock","version":"3.20.3","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.20.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.20.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-v9pg-7xvm-68hf","dataSource":"https://github.com/advisories/GHSA-v9pg-7xvm-68hf","namespace":"github:language:python","severity":"Low","urls":["https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf"],"description":"python-multipart: Negative Content-Length in parse_form buffers the entire body in memory","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53540","epss":0.00342,"percentile":0.2776,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53540","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.0.31"],"state":"fixed","available":[{"version":"0.0.31","date":"2026-06-16","kind":"first-observed"}]},"advisories":[],"risk":0.11456999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-53540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53540","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf"],"description":"Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-53540","epss":0.00342,"percentile":0.2776,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-53540","cwe":"CWE-1284","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"python-multipart","version":"0.0.30"}},"found":{"vulnerabilityID":"GHSA-v9pg-7xvm-68hf","versionConstraint":"<0.0.31 (python)"},"fix":{"suggestedVersion":"0.0.31"}}],"artifact":{"id":"pkg:pypi/python-multipart@0.0.30?package-id=5bb8b635db852c9f","name":"python-multipart","version":"0.0.30","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:fastapiexpert:python-multipart:0.0.30:*:*:*:*:python:*:*"],"purl":"pkg:pypi/python-multipart@0.0.30","upstreams":[]}},{"vulnerability":{"id":"GHSA-9pg5-8c7x-5hfx","dataSource":"https://github.com/advisories/GHSA-9pg5-8c7x-5hfx","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx","https://nvd.nist.gov/vuln/detail/CVE-2026-119284","https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39","https://github.com/authlib/joserfc/releases/tag/1.7.6"],"description":"joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119284","epss":0.00192,"percentile":0.08912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119284","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.6"],"state":"fixed","available":[{"version":"1.7.6","date":"2026-10-30","kind":"first-observed"}]},"advisories":[],"risk":0.11424000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-119284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39","https://github.com/authlib/joserfc/releases/tag/1.7.6","https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx"],"description":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119284","epss":0.00192,"percentile":0.08912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119284","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"joserfc","version":"1.6.8"}},"found":{"vulnerabilityID":"GHSA-9pg5-8c7x-5hfx","versionConstraint":"<1.7.6 (python)"},"fix":{"suggestedVersion":"1.7.6"}}],"artifact":{"id":"pkg:pypi/joserfc@1.6.8?package-id=5f688e6818a87924","name":"joserfc","version":"1.6.8","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python-joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python-joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:joserfc:1.6.8:*:*:*:*:*:*:*"],"purl":"pkg:pypi/joserfc@1.6.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-9pg5-8c7x-5hfx","dataSource":"https://github.com/advisories/GHSA-9pg5-8c7x-5hfx","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx","https://nvd.nist.gov/vuln/detail/CVE-2026-119284","https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39","https://github.com/authlib/joserfc/releases/tag/1.7.6"],"description":"joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119284","epss":0.00192,"percentile":0.08912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119284","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["1.7.6"],"state":"fixed","available":[{"version":"1.7.6","date":"2026-10-30","kind":"first-observed"}]},"advisories":[],"risk":0.11424000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-119284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/authlib/joserfc/commit/397e04f4bbce0b94d86e31c1c003f4640af8fb39","https://github.com/authlib/joserfc/releases/tag/1.7.6","https://github.com/authlib/joserfc/security/advisories/GHSA-9pg5-8c7x-5hfx"],"description":"joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. When attacker-controlled compact serialization bytes reach deserialize_compact(), the split creates copies of the header, payload, and signature segments before ExceededSizeError rejects them, causing an additional allocation approximately proportional to the supplied token. Requests that exhaust available process memory can therefore cause an availability failure even though signature verification fails. This issue is fixed in version 1.7.6.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119284","epss":0.00192,"percentile":0.08912,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119284","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"joserfc","version":"1.6.8"}},"found":{"vulnerabilityID":"GHSA-9pg5-8c7x-5hfx","versionConstraint":"<1.7.6 (python)"},"fix":{"suggestedVersion":"1.7.6"}}],"artifact":{"id":"pkg:pypi/joserfc@1.6.8?package-id=acea765dd9e63d28","name":"joserfc","version":"1.6.8","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python-joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python-joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python_joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python-joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:python_joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:joserfc:joserfc:1.6.8:*:*:*:*:*:*:*","cpe:2.3:a:python:joserfc:1.6.8:*:*:*:*:*:*:*"],"purl":"pkg:pypi/joserfc@1.6.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-hxh3-vqpv-xpqv","dataSource":"https://github.com/advisories/GHSA-hxh3-vqpv-xpqv","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://nvd.nist.gov/vuln/detail/CVE-2026-93981","https://github.com/honojs/hono/commit/2b8ed402cdab6dfc5e829b480806dcd8db94161e","https://github.com/honojs/hono/releases/tag/v4.13.7","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"description":"hono/jsx renders plain strings unescaped in boundary components, leading to XSS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93981","epss":0.00227,"percentile":0.13536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}],"fix":{"versions":["4.13.7"],"state":"fixed","available":[{"version":"4.13.7","date":"2026-10-01","kind":"first-observed"}]},"advisories":[],"risk":0.11009499999999998},"relatedVulnerabilities":[{"id":"CVE-2026-93981","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-93981","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/honojs/hono/security/advisories/GHSA-hxh3-vqpv-xpqv","https://www.vulncheck.com/advisories/hono-jsx-before-4.13.7-cross-site-scripting-via-unescaped-strings"],"description":"hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary HTML and execute script under the application's origin.","cvss":[{"source":"disclosure@vulncheck.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"vendorMetadata":{}},{"source":"disclosure@vulncheck.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.7,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-93981","epss":0.00227,"percentile":0.13536,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-93981","cwe":"CWE-79","source":"disclosure@vulncheck.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"hono","version":"4.12.34"}},"found":{"vulnerabilityID":"GHSA-hxh3-vqpv-xpqv","versionConstraint":"<4.13.7 (semantic)"},"fix":{"suggestedVersion":"4.13.7"}}],"artifact":{"id":"pkg:npm/hono@4.12.34?package-id=7501660e9106d928","name":"hono","version":"4.12.34","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:hono:hono:4.12.34:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/hono@4.12.34","upstreams":[]}},{"vulnerability":{"id":"GHSA-333x-w4r6-6crp","dataSource":"https://github.com/advisories/GHSA-333x-w4r6-6crp","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp","https://nvd.nist.gov/vuln/detail/CVE-2026-110725","https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e","https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.10117},"relatedVulnerabilities":[{"id":"CVE-2026-110725","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, when serialize(), normalize(), or resolve() are called with the non-default option reference set to suffix on a reference that has no authority, the emitted relative reference can contain a bare colon in its first path segment without escaping it, even though RFC 3986 forbids that because it makes the string reparse as an absolute URI with a scheme. An application that serializes or normalizes a relative reference with the suffix option and then treats the result as a URI can turn inert input into a live javascript, data, or vbscript URL, a cross-site scripting vector, and the equal() comparison can conflate a scheme-bearing reference with a relative one. Exposure is limited to applications using the non-default suffix reference option. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, avoid the suffix reference option on untrusted input, or percent-encode a colon in the first path segment of the result before treating it as a URI.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110725","epss":0.00302,"percentile":0.23001,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110725","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-110725","cwe":"CWE-116","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.6"}},"found":{"vulnerabilityID":"GHSA-333x-w4r6-6crp","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.6?package-id=dd54ffdcc402f136","name":"fast-uri","version":"3.1.6","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-xhq7-xmqj-769h","dataSource":"https://github.com/advisories/GHSA-xhq7-xmqj-769h","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h","https://nvd.nist.gov/vuln/detail/CVE-2026-110095","https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47","https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9","https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058","https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd","https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a","https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/releases/tag/v2.4.8","https://github.com/fastify/fast-uri/releases/tag/v3.1.9","https://github.com/fastify/fast-uri/releases/tag/v4.2.3"],"description":"fast-uri vulnerable to improper path equivalence in relative reference normalization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["3.1.9"],"state":"fixed","available":[{"version":"3.1.9","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.096815},"relatedVulnerabilities":[{"id":"CVE-2026-110095","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095","namespace":"nvd:cpe","severity":"Low","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"],"description":"fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4.0.0 through 4.2.2, the normalize() and serialize() functions apply RFC 3986 dot-segment removal to the path of a relative-path reference, even though that algorithm is defined only for the merged target path during resolution, so a leading parent-directory segment can be dropped and a document-relative reference can become root-relative. An application that normalizes an attacker-supplied or user-supplied relative reference and then resolves it, or uses it as a cache, deduplication, or authorization key, can have the reference escape its intended directory and point at a different resource. The issue is fixed in fast-uri 2.4.8, 3.1.9, and 4.2.3, and users should upgrade to one of these versions or later. As a workaround, resolve a relative reference against its absolute base first and normalize the absolute result instead of normalizing the reference beforehand.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-110095","epss":0.00289,"percentile":0.21549,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-110095","cwe":"CWE-41","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"fast-uri","version":"3.1.6"}},"found":{"vulnerabilityID":"GHSA-xhq7-xmqj-769h","versionConstraint":">=3.0.0,<3.1.9 (semantic)"},"fix":{"suggestedVersion":"3.1.9"}}],"artifact":{"id":"pkg:npm/fast-uri@3.1.6?package-id=dd54ffdcc402f136","name":"fast-uri","version":"3.1.6","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:openjsf:fast-uri:3.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/fast-uri@3.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-x33g-cr3x-6449","dataSource":"https://github.com/advisories/GHSA-x33g-cr3x-6449","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449","https://nvd.nist.gov/vuln/detail/CVE-2026-102275","https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"description":"PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102275","epss":0.00167,"percentile":0.05937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102275","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.096025},"relatedVulnerabilities":[{"id":"CVE-2026-102275","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102275","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102275","epss":0.00167,"percentile":0.05937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102275","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.14.0"}},"found":{"vulnerabilityID":"GHSA-x33g-cr3x-6449","versionConstraint":">=2.1.0,<=2.14.0 (python)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.14.0?package-id=eb0fa5441abafe20","name":"pyjwt","version":"2.14.0","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.14.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-x33g-cr3x-6449","dataSource":"https://github.com/advisories/GHSA-x33g-cr3x-6449","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449","https://nvd.nist.gov/vuln/detail/CVE-2026-102275","https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"description":"PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102275","epss":0.00167,"percentile":0.05937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102275","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.096025},"relatedVulnerabilities":[{"id":"CVE-2026-102275","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102275","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102275","epss":0.00167,"percentile":0.05937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102275","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.14.0"}},"found":{"vulnerabilityID":"GHSA-x33g-cr3x-6449","versionConstraint":">=2.1.0,<=2.14.0 (python)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.14.0?package-id=c185931ab69da106","name":"pyjwt","version":"2.14.0","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.14.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-x33g-cr3x-6449","dataSource":"https://github.com/advisories/GHSA-x33g-cr3x-6449","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449","https://nvd.nist.gov/vuln/detail/CVE-2026-102275","https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"description":"PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102275","epss":0.00167,"percentile":0.05937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102275","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.15.0"],"state":"fixed","available":[{"version":"2.15.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.096025},"relatedVulnerabilities":[{"id":"CVE-2026-102275","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102275","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"],"description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in  jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-102275","epss":0.00167,"percentile":0.05937,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-102275","cwe":"CWE-348","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyjwt","version":"2.14.0"}},"found":{"vulnerabilityID":"GHSA-x33g-cr3x-6449","versionConstraint":">=2.1.0,<=2.14.0 (python)"},"fix":{"suggestedVersion":"2.15.0"}}],"artifact":{"id":"pkg:pypi/pyjwt@2.14.0?package-id=2caeccfa94890562","name":"pyjwt","version":"2.14.0","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python-pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:python_pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python-pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python_pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:python:pyjwt:2.14.0:*:*:*:*:*:*:*","cpe:2.3:a:pyjwt:pyjwt:2.14.0:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pyjwt@2.14.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-238p-pmpm-9mq7","dataSource":"https://github.com/advisories/GHSA-238p-pmpm-9mq7","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7","https://nvd.nist.gov/vuln/detail/CVE-2026-103923","https://github.com/KaTeX/KaTeX/pull/4260","https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4","https://github.com/KaTeX/KaTeX/releases/tag/v0.18.2"],"description":"KaTeX: Existing prototype pollution can bypass trust restrictions","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-103923","epss":0.003,"percentile":0.22689,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-103923","cwe":"CWE-807","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.18.2"],"state":"fixed","available":[{"version":"0.18.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.07650000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-103923","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103923","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4","https://github.com/KaTeX/KaTeX/pull/4260","https://github.com/KaTeX/KaTeX/releases/tag/v0.18.2","https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7"],"description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration, allowing inherited properties to be treated as explicitly supplied values. When Object.prototype is already polluted or an attacker controls the options object's prototype, attacker-controlled mathematical expressions can use an inherited trust value to enable trusted rendering and produce links capable of user-interaction cross-site scripting or loading attacker-selected external resources in a consuming application that inserts unsanitized KaTeX output into a page. KaTeX does not itself create the prototype pollution, and rendering an expression alone does not execute script. This issue is fixed in version 0.18.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-103923","epss":0.003,"percentile":0.22689,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-103923","cwe":"CWE-807","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"katex","version":"0.16.27"}},"found":{"vulnerabilityID":"GHSA-238p-pmpm-9mq7","versionConstraint":">=0.11.0,<0.18.2 (semantic)"},"fix":{"suggestedVersion":"0.18.2"}}],"artifact":{"id":"pkg:npm/katex@0.16.27?package-id=d8c5386e3081fef1","name":"katex","version":"0.16.27","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:katex:katex:0.16.27:*:*:*:*:*:*:*"],"purl":"pkg:npm/katex@0.16.27","upstreams":[]}},{"vulnerability":{"id":"GHSA-238p-pmpm-9mq7","dataSource":"https://github.com/advisories/GHSA-238p-pmpm-9mq7","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7","https://nvd.nist.gov/vuln/detail/CVE-2026-103923","https://github.com/KaTeX/KaTeX/pull/4260","https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4","https://github.com/KaTeX/KaTeX/releases/tag/v0.18.2"],"description":"KaTeX: Existing prototype pollution can bypass trust restrictions","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-103923","epss":0.003,"percentile":0.22689,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-103923","cwe":"CWE-807","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.18.2"],"state":"fixed","available":[{"version":"0.18.2","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0.07650000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-103923","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103923","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4","https://github.com/KaTeX/KaTeX/pull/4260","https://github.com/KaTeX/KaTeX/releases/tag/v0.18.2","https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7"],"description":"KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration, allowing inherited properties to be treated as explicitly supplied values. When Object.prototype is already polluted or an attacker controls the options object's prototype, attacker-controlled mathematical expressions can use an inherited trust value to enable trusted rendering and produce links capable of user-interaction cross-site scripting or loading attacker-selected external resources in a consuming application that inserts unsanitized KaTeX output into a page. KaTeX does not itself create the prototype pollution, and rendering an expression alone does not execute script. This issue is fixed in version 0.18.2.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-103923","epss":0.003,"percentile":0.22689,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-103923","cwe":"CWE-807","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"katex","version":"0.16.47"}},"found":{"vulnerabilityID":"GHSA-238p-pmpm-9mq7","versionConstraint":">=0.11.0,<0.18.2 (semantic)"},"fix":{"suggestedVersion":"0.18.2"}}],"artifact":{"id":"pkg:npm/katex@0.16.47?package-id=1c4a41d463ce024d","name":"katex","version":"0.16.47","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:katex:katex:0.16.47:*:*:*:*:*:*:*"],"purl":"pkg:npm/katex@0.16.47","upstreams":[]}},{"vulnerability":{"id":"GHSA-22qq-2fwx-7p67","dataSource":"https://github.com/advisories/GHSA-22qq-2fwx-7p67","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67","https://nvd.nist.gov/vuln/detail/CVE-2026-114608","https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d","https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca","https://github.com/pylint-dev/pylint/releases/tag/v4.0.9"],"description":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":5.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114608","epss":0.00115,"percentile":0.01534,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114608","cwe":"CWE-502","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.9"],"state":"fixed","available":[{"version":"4.0.9","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.0598},"relatedVulnerabilities":[{"id":"CVE-2026-114608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114608","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d","https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca","https://github.com/pylint-dev/pylint/releases/tag/v4.0.9","https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67"],"description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114608","epss":0.00115,"percentile":0.01534,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114608","cwe":"CWE-502","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pylint","version":"3.2.5"}},"found":{"vulnerabilityID":"GHSA-22qq-2fwx-7p67","versionConstraint":"<4.0.9 (python)"},"fix":{"suggestedVersion":"4.0.9"}}],"artifact":{"id":"pkg:pypi/pylint@3.2.5?package-id=048b65bbce56abe8","name":"pylint","version":"3.2.5","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pylint:python-pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:python-pylint:python_pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:python_pylint:python-pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:python_pylint:python_pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:pylint:python-pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:pylint:python_pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:python-pylint:pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:python_pylint:pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:pylint:pylint:3.2.5:*:*:*:*:*:*:*","cpe:2.3:a:python:pylint:3.2.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pylint@3.2.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-22qq-2fwx-7p67","dataSource":"https://github.com/advisories/GHSA-22qq-2fwx-7p67","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67","https://nvd.nist.gov/vuln/detail/CVE-2026-114608","https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d","https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca","https://github.com/pylint-dev/pylint/releases/tag/v4.0.9"],"description":"Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":5.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114608","epss":0.00115,"percentile":0.01534,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114608","cwe":"CWE-502","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.9"],"state":"fixed","available":[{"version":"4.0.9","date":"2026-10-27","kind":"first-observed"}]},"advisories":[],"risk":0.0598},"relatedVulnerabilities":[{"id":"CVE-2026-114608","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114608","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d","https://github.com/pylint-dev/pylint/commit/5b241f66318220e9ba7b21ca631fbfe8e77682ca","https://github.com/pylint-dev/pylint/releases/tag/v4.0.9","https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67"],"description":"Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, Pylint stores module statistics in predictable files under PYLINT_HOME and loads those files with pickle.load on a later run. An attacker who can write to a shared, group-writable, or otherwise untrusted cache directory can replace a stats cache with crafted serialized data, causing arbitrary code to execute with the privileges of the user who next runs Pylint. The default per-user cache is not normally writable by another user. This issue is fixed in version 4.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-114608","epss":0.00115,"percentile":0.01534,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-114608","cwe":"CWE-502","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pylint","version":"3.3.4"}},"found":{"vulnerabilityID":"GHSA-22qq-2fwx-7p67","versionConstraint":"<4.0.9 (python)"},"fix":{"suggestedVersion":"4.0.9"}}],"artifact":{"id":"pkg:pypi/pylint@3.3.4?package-id=5c90b51804b28bd5","name":"pylint","version":"3.3.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pylint:python-pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:python-pylint:python_pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:python_pylint:python-pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:python_pylint:python_pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:pylint:python-pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:pylint:python_pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:python-pylint:pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:python_pylint:pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:pylint:pylint:3.3.4:*:*:*:*:*:*:*","cpe:2.3:a:python:pylint:3.3.4:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pylint@3.3.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-5xjx-3w67-w9x9","dataSource":"https://github.com/advisories/GHSA-5xjx-3w67-w9x9","namespace":"github:language:github-action","severity":"Critical","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9"],"description":"pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"fix":{"versions":["1.14.3"],"state":"fixed","available":[{"version":"1.14.3","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"v1.14.2"}},"found":{"vulnerabilityID":"GHSA-5xjx-3w67-w9x9","versionConstraint":"<=1.14.2 (unknown)"},"fix":{"suggestedVersion":"1.14.3"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@v1.14.2?package-id=15c64187f7449270","name":"pypa/gh-action-pypi-publish","version":"v1.14.2","type":"github-action","locations":[{"path":"/.github/workflows/sdk-pypi-release.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@v1.14.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-5xjx-3w67-w9x9","dataSource":"https://github.com/advisories/GHSA-5xjx-3w67-w9x9","namespace":"github:language:github-action","severity":"Critical","urls":["https://github.com/pypa/gh-action-pypi-publish/security/advisories/GHSA-5xjx-3w67-w9x9"],"description":"pypi-publish action revocation of CA in the chain that Sigstore uses in Trusted Publishing and Digital Attestations for PyPI","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":9.3},"vendorMetadata":{}}],"fix":{"versions":["1.14.3"],"state":"fixed","available":[{"version":"1.14.3","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"stock-matcher","searchedBy":{"language":"","namespace":"github:language:github-action","package":{"name":"pypa/gh-action-pypi-publish","version":"v1.14.2"}},"found":{"vulnerabilityID":"GHSA-5xjx-3w67-w9x9","versionConstraint":"<=1.14.2 (unknown)"},"fix":{"suggestedVersion":"1.14.3"}}],"artifact":{"id":"pkg:github/pypa/gh-action-pypi-publish@v1.14.2?package-id=42bdfb04e29d18b5","name":"pypa/gh-action-pypi-publish","version":"v1.14.2","type":"github-action","locations":[{"path":"/.github/workflows/mcp-pypi-release.yml","accessPath":""}],"language":"","licenses":[],"cpes":["cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi-publish:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi_publish:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action-pypi:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action_pypi:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh-action:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh_action:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh-action-pypi-publish:v1.14.2:*:*:*:*:*:*:*","cpe:2.3:a:pypa\\/gh:pypa\\/gh_action_pypi_publish:v1.14.2:*:*:*:*:*:*:*"],"purl":"pkg:github/pypa/gh-action-pypi-publish@v1.14.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-46jr-4wx8-v453","dataSource":"https://github.com/advisories/GHSA-46jr-4wx8-v453","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-46jr-4wx8-v453","https://github.com/modelcontextprotocol/typescript-sdk/pull/2926","https://github.com/modelcontextprotocol/typescript-sdk/pull/2927","https://github.com/modelcontextprotocol/typescript-sdk/commit/6d8dbc6cb590edf766fcb66b636ca6b654e99c37","https://github.com/modelcontextprotocol/typescript-sdk/commit/fd26801b3b387742fe24a90ed4b275dd6072209f"],"description":"MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.32.0"],"state":"fixed","available":[{"version":"1.32.0","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-111768","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.26.0"}},"found":{"vulnerabilityID":"GHSA-46jr-4wx8-v453","versionConstraint":">=1.3.0,<1.32.0 (semantic)"},"fix":{"suggestedVersion":"1.32.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0?package-id=37565713f4347e4e","name":"@modelcontextprotocol/sdk","version":"1.26.0","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.26.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-f897-62hf-6gxq","dataSource":"https://github.com/advisories/GHSA-f897-62hf-6gxq","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-f897-62hf-6gxq","https://github.com/modelcontextprotocol/typescript-sdk/pull/2698","https://github.com/modelcontextprotocol/typescript-sdk/pull/2717","https://github.com/modelcontextprotocol/typescript-sdk/commit/7b781ed4e25355a25d15974f3c76de81299694ed","https://github.com/modelcontextprotocol/typescript-sdk/commit/a9f6eb709b85459d01e8f2a9e881fef2621756c1","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/1.30.1","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/hono@2.0.1","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/node@2.1.0","https://github.com/modelcontextprotocol/typescript-sdk/releases/tag/@modelcontextprotocol/server@2.1.0"],"description":"MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"fix":{"versions":["1.30.1"],"state":"fixed","available":[{"version":"1.30.1","date":"2026-10-28","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.26.0"}},"found":{"vulnerabilityID":"GHSA-f897-62hf-6gxq","versionConstraint":">=1.10.0,<1.30.1 (semantic)"},"fix":{"suggestedVersion":"1.30.1"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0?package-id=37565713f4347e4e","name":"@modelcontextprotocol/sdk","version":"1.26.0","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.26.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-mrhx-c7xc-m3w5","dataSource":"https://github.com/advisories/GHSA-mrhx-c7xc-m3w5","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2023-54404","https://github.com/colinhacks/zod/issues/1872","https://github.com/colinhacks/zod/pull/6475","https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation","https://github.com/colinhacks/zod/pull/6652","https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"],"description":"Zod can exhaust memory while validating oversized constrained collections","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"fix":{"versions":["4.6.6"],"state":"fixed","available":[{"version":"4.6.6","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2023-54404","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404","namespace":"nvd:cpe","severity":"Unknown","urls":[],"description":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, and reflects expected validator behavior rather than a defect in Zod.","cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"zod","version":"4.4.3"}},"found":{"vulnerabilityID":"GHSA-mrhx-c7xc-m3w5","versionConstraint":"<4.6.6 (semantic)"},"fix":{"suggestedVersion":"4.6.6"}}],"artifact":{"id":"pkg:npm/zod@4.4.3?package-id=6b9746218ea59908","name":"zod","version":"4.4.3","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:zod:zod:4.4.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/zod@4.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-6prh-2h8m-c8cw","dataSource":"https://github.com/advisories/GHSA-6prh-2h8m-c8cw","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-6prh-2h8m-c8cw","https://github.com/modelcontextprotocol/typescript-sdk/pull/2901","https://github.com/modelcontextprotocol/typescript-sdk/pull/2902","https://github.com/modelcontextprotocol/typescript-sdk/commit/30bfe5139f4b0825c90cd725f9a7e3f9af5e120d","https://github.com/modelcontextprotocol/typescript-sdk/commit/433eb413dc305ebeb93b8ebcde0095a8fc0d5fa0"],"description":"MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.3,"impactScore":4.3},"vendorMetadata":{}}],"fix":{"versions":["1.32.0"],"state":"fixed","available":[{"version":"1.32.0","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-111769","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.26.0"}},"found":{"vulnerabilityID":"GHSA-6prh-2h8m-c8cw","versionConstraint":"<1.32.0 (semantic)"},"fix":{"suggestedVersion":"1.32.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0?package-id=37565713f4347e4e","name":"@modelcontextprotocol/sdk","version":"1.26.0","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.26.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rvq5-wwqv-78pq","dataSource":"https://github.com/advisories/GHSA-rvq5-wwqv-78pq","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/modelcontextprotocol/typescript-sdk/security/advisories/GHSA-rvq5-wwqv-78pq","https://github.com/modelcontextprotocol/typescript-sdk/commit/40f8f4e229d963cd7fd2890bda2aeebe7005299a","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a0724d14cf34a27a3b070224d2996cdd611df9f","https://github.com/modelcontextprotocol/typescript-sdk/commit/5a1867390b91b8836f49af76c45427279f513325"],"description":"MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"fix":{"versions":["1.32.0"],"state":"fixed","available":[{"version":"1.32.0","date":"2026-10-21","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-111771","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"@modelcontextprotocol/sdk","version":"1.26.0"}},"found":{"vulnerabilityID":"GHSA-rvq5-wwqv-78pq","versionConstraint":">=1.6.0,<1.32.0 (semantic)"},"fix":{"suggestedVersion":"1.32.0"}}],"artifact":{"id":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0?package-id=37565713f4347e4e","name":"@modelcontextprotocol/sdk","version":"1.26.0","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:\\@modelcontextprotocol\\/sdk:\\@modelcontextprotocol\\/sdk:1.26.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/%40modelcontextprotocol/sdk@1.26.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-7xgj-8392-5q4r","dataSource":"https://github.com/advisories/GHSA-7xgj-8392-5q4r","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r","https://github.com/PrefectHQ/fastmcp/pull/5933","https://github.com/PrefectHQ/fastmcp/pull/5934","https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df","https://github.com/PrefectHQ/fastmcp/commit/8649ba5fc91a68568a69729497edeb804a064332","https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.10","https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2"],"description":"FastMCP: Post-transform component authorization is skipped on direct calls","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"fix":{"versions":["3.4.10"],"state":"fixed","available":[{"version":"3.4.10","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"fastmcp","version":"3.4.5"}},"found":{"vulnerabilityID":"GHSA-7xgj-8392-5q4r","versionConstraint":">=3.0.0,<3.4.10 (python)"},"fix":{"suggestedVersion":"3.4.10"}}],"artifact":{"id":"pkg:pypi/fastmcp@3.4.5?package-id=a4297776bd85b039","name":"fastmcp","version":"3.4.5","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-fastmcp:python-fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp:python_fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp:python-fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp:python_fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp:python-fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp:python_fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp:fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp:fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp:fastmcp:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:fastmcp:3.4.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/fastmcp@3.4.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-7xgj-8392-5q4r","dataSource":"https://github.com/advisories/GHSA-7xgj-8392-5q4r","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/PrefectHQ/fastmcp/security/advisories/GHSA-7xgj-8392-5q4r","https://github.com/PrefectHQ/fastmcp/pull/5933","https://github.com/PrefectHQ/fastmcp/pull/5934","https://github.com/PrefectHQ/fastmcp/commit/85df42fbf2aa631cc81e0f986718b314128e91df","https://github.com/PrefectHQ/fastmcp/commit/8649ba5fc91a68568a69729497edeb804a064332","https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.10","https://github.com/PrefectHQ/fastmcp/releases/tag/v4.1.2"],"description":"FastMCP: Post-transform component authorization is skipped on direct calls","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"exploitabilityScore":1.7,"impactScore":5.2},"vendorMetadata":{}}],"fix":{"versions":["3.4.10"],"state":"fixed","available":[{"version":"3.4.10","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"fastmcp-slim","version":"3.4.5"}},"found":{"vulnerabilityID":"GHSA-7xgj-8392-5q4r","versionConstraint":">=3.0.0,<3.4.10 (python)"},"fix":{"suggestedVersion":"3.4.10"}}],"artifact":{"id":"pkg:pypi/fastmcp-slim@3.4.5?package-id=e5c37fe4d604e63f","name":"fastmcp-slim","version":"3.4.5","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-fastmcp-slim:python-fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp-slim:python_fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp_slim:python-fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp_slim:python_fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp:python-fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp:python_fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp:python-fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp:python_fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp-slim:python-fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp-slim:python_fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp_slim:python-fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp_slim:python_fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp-slim:fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp-slim:fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp_slim:fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp_slim:fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp:python-fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp:python_fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp:fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python-fastmcp:fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp:fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python_fastmcp:fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python-fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:python_fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp-slim:fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp-slim:fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp_slim:fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp_slim:fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp:fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:fastmcp:fastmcp_slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:fastmcp-slim:3.4.5:*:*:*:*:*:*:*","cpe:2.3:a:python:fastmcp_slim:3.4.5:*:*:*:*:*:*:*"],"purl":"pkg:pypi/fastmcp-slim@3.4.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-8mx5-7m5m-r77g","dataSource":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112910","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.20.3"}},"found":{"vulnerabilityID":"GHSA-8mx5-7m5m-r77g","versionConstraint":">=3.10.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.20.3?package-id=94b05fabd7ed0482","name":"filelock","version":"3.20.3","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.20.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.20.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-8mx5-7m5m-r77g","dataSource":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112910","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.20.3"}},"found":{"vulnerabilityID":"GHSA-8mx5-7m5m-r77g","versionConstraint":">=3.10.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.20.3?package-id=d8d1e268e92c45e6","name":"filelock","version":"3.20.3","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.20.3:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.20.3:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.20.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4xgf-cpjx-pc3j","dataSource":"https://github.com/advisories/GHSA-4xgf-cpjx-pc3j","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j"],"description":"pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"fix":{"versions":["2.14.2"],"state":"fixed","available":[{"version":"2.14.2","date":"2026-06-20","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pydantic-settings","version":"2.14.1"}},"found":{"vulnerabilityID":"GHSA-4xgf-cpjx-pc3j","versionConstraint":">=2.12.0,<2.14.2 (python)"},"fix":{"suggestedVersion":"2.14.2"}}],"artifact":{"id":"pkg:pypi/pydantic-settings@2.14.1?package-id=28b511db3ee74bb7","name":"pydantic-settings","version":"2.14.1","type":"python","locations":[{"path":"/mcp_server/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pydantic:pydantic-settings:2.14.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pydantic-settings@2.14.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r4xh-jqrq-34v2","dataSource":"https://github.com/advisories/GHSA-r4xh-jqrq-34v2","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/squirrelchat/smol-toml/security/advisories/GHSA-r4xh-jqrq-34v2","https://github.com/squirrelchat/smol-toml/commit/99102aa57fc932f760ea9c15b4cf1c181f952d24","https://github.com/squirrelchat/smol-toml/releases/tag/v1.9.0"],"description":"smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["1.9.0"],"state":"fixed","available":[{"version":"1.9.0","date":"2026-10-06","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"smol-toml","version":"1.6.1"}},"found":{"vulnerabilityID":"GHSA-r4xh-jqrq-34v2","versionConstraint":"<=1.8.0 (semantic)"},"fix":{"suggestedVersion":"1.9.0"}}],"artifact":{"id":"pkg:npm/smol-toml@1.6.1?package-id=fd797d8e4bb12fb5","name":"smol-toml","version":"1.6.1","type":"npm","locations":[{"path":"/ui/pnpm-lock.yaml","accessPath":""}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:smol-toml:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol-toml:smol_toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol_toml:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol_toml:smol_toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol:smol-toml:1.6.1:*:*:*:*:*:*:*","cpe:2.3:a:smol:smol_toml:1.6.1:*:*:*:*:*:*:*"],"purl":"pkg:npm/smol-toml@1.6.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xmj3-9gf7-h52w","dataSource":"https://github.com/advisories/GHSA-xmj3-9gf7-h52w","namespace":"github:language:python","severity":"Low","urls":["https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w","https://github.com/pypa/setuptools/pull/5329","https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af","https://github.com/pypa/setuptools/releases/tag/v84.1.0"],"description":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":1},"vendorMetadata":{}}],"fix":{"versions":["84.1.0"],"state":"fixed","available":[{"version":"84.1.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"setuptools","version":"80.10.2"}},"found":{"vulnerabilityID":"GHSA-xmj3-9gf7-h52w","versionConstraint":">=38.2.2,<84.1.0 (python)"},"fix":{"suggestedVersion":"84.1.0"}}],"artifact":{"id":"pkg:pypi/setuptools@80.10.2?package-id=995d50ef013af393","name":"setuptools","version":"80.10.2","type":"python","locations":[{"path":"/api/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:setuptools:80.10.2:*:*:*:*:*:*:*"],"purl":"pkg:pypi/setuptools@80.10.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xmj3-9gf7-h52w","dataSource":"https://github.com/advisories/GHSA-xmj3-9gf7-h52w","namespace":"github:language:python","severity":"Low","urls":["https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w","https://github.com/pypa/setuptools/pull/5329","https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af","https://github.com/pypa/setuptools/releases/tag/v84.1.0"],"description":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":1},"vendorMetadata":{}}],"fix":{"versions":["84.1.0"],"state":"fixed","available":[{"version":"84.1.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"setuptools","version":"82.0.1"}},"found":{"vulnerabilityID":"GHSA-xmj3-9gf7-h52w","versionConstraint":">=38.2.2,<84.1.0 (python)"},"fix":{"suggestedVersion":"84.1.0"}}],"artifact":{"id":"pkg:pypi/setuptools@82.0.1?package-id=b618b530c0db1100","name":"setuptools","version":"82.0.1","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:setuptools:82.0.1:*:*:*:*:*:*:*"],"purl":"pkg:pypi/setuptools@82.0.1","upstreams":[]}}],"source":{"type":"file","target":"prowler-cloud/prowler"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:08:33.197217959Z"}}