{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ddd434a7f63ff14b", "name": "CVE-2025-27789: @babel/runtime 7.25.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-27789: @babel/runtime 7.25.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups\n\nBabel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression named capturing groups, Babel will generate a polyfill for the `.replace` method that has quadratic complexity on some specific replacement pattern strings (i.e. the second argument passed to `.replace`). Generated code is vulnerable if all the following conditions are true: Using Babel to compile regular expression named capturing groups, usi\n\nPackage: @babel/runtime\nInstalled: 7.25.6\nFixed in: 7.26.10, 8.0.0-alpha.17\nSeverity: MEDIUM\nFix: Upgrade @babel/runtime to 7.26.10, 8.0.0-alpha.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2806eb602175dbf7", "name": "CVE-2025-27152: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-27152: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests\n\naxios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if \u2060baseURL is set, axios sends the request to the specified absolute URL, potentially causing SSRF and credential leakage. This issue impacts both server-side and client-side usage of axios. This issue is fixed in 1.8.2.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.8.2, 0.30.0\nSeverity: HIGH\nFix: Upgrade axios to 1.8.2, 0.30.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-daec2e897814a430", "name": "CVE-2025-58754: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-58754: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios DoS via lack of data size check\n\nAxios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http adapter decodes the entire payload into memory (`Buffer`/`Blob`) and returns a synthetic 200 response. This path ignores `maxContentLength` / `maxBodyLength` (which only protect HTTP responses), so an attacker can supply a very large `data:` URI a\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.12.0, 0.30.2\nSeverity: HIGH\nFix: Upgrade axios to 1.12.0, 0.30.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1e3cbfde6d0beb96", "name": "CVE-2026-25639: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-25639: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.13.5, 0.30.3\nSeverity: HIGH\nFix: Upgrade axios to 1.13.5, 0.30.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bb392b7533a62a5b", "name": "CVE-2026-42033: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42033: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: HTTP Transport Hijacking via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and modify every JSON response before the application sees it, or (b) fully hijack the underlying HTTP transport, gaining access to request credentials, headers, and body. The precondition is prototype pollution from a separate source in the same \n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-41ae795f5bc7ffcc", "name": "CVE-2026-42035: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42035: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Arbitrary HTTP header injection via prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders, append, pipe, on, once, and Symbol.toStringTag, Axios misidentifies any plain object payload as a FormData instance an\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee19036ef6dfc1d4", "name": "CVE-2026-42043: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42043: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: NO_PROXY bypass via crafted URL\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-289f7e823c939ab9", "name": "CVE-2026-42264: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42264: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Prototype pollution allows information disclosure and request manipulation\n\nAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP adapter are read via direct property access without hasOwnProperty guards, making them exploitable as prototype pollution gadgets. When Object.prototype is polluted by another dependency in the same process, axios silently picks up these polluted values on every outbound HTTP request.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.2\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2993699255d8727d", "name": "CVE-2026-44486: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44486: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019 Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f1deb39789d60392", "name": "CVE-2026-44487: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44487: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios\u2019s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-06e1de4b8b12b682", "name": "CVE-2026-44488: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44488: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service due to unenforced request and response size limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usag\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cb1d8ce833b357b7", "name": "CVE-2026-44494: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44494: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into a full Man-in-the-Middle (MITM) attack \u2014 intercepting, reading, and modifying all HTTP traffic including authentication credentials. The HTTP adapter at lib/adapters/http.js:670 reads config.proxy via standard property access, whic\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.16.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ae7c0899b79d576f", "name": "CVE-2026-44495: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44495: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability\n\nAxios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Object.prototype.transformResponse, affected Axios versions may treat that inherited value as request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-p\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.2, 0.31.1\nSeverity: HIGH\nFix: Upgrade axios to 1.15.2, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-04f2eff0c9a28a82", "name": "CVE-2026-44496: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44496: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name\n\nAxios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause expensive regex backtracking while axios reads document.cookie. The practical impact is client-side availability degradation, such as freezing the\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.16.0, 0.32.0\nSeverity: HIGH\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-976ca89ddd1e0721", "name": "CVE-2025-62718: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-62718: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This is\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9a6df3924b9fea3", "name": "CVE-2026-40175: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-40175: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Remote Code Execution via Prototype Pollution escalation\n\nAxios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This vulnerability is fixed in 1.15.0 and 0.3.1.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.0, 0.31.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.0, 0.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8c041a1f947ce9c", "name": "CVE-2026-42034: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42034: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). Oversized streamed uploads are sent fully even when the caller sets strict body limits. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-31aae1876ff5301c", "name": "CVE-2026-42036: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42036: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ea7b113a712f5e5", "name": "CVE-2026-42037: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42037: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the Content-Type header of each multipart part without sanitizing CRLF (\\r\\n) sequences. An attacker who controls the .type property of a Blob/File-like object (e.g., via a user-uploaded file in a Node.js proxy service) can inject arbitrary MIME part headers into the multipart form-data body. This bypa\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbf4327160c37ea5", "name": "CVE-2026-42038: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42038: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure due to `no_proxy` bypass\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching \u2014 it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b473a676ea476326", "name": "CVE-2026-42039: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42039: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This vulnerability is fixed in 1.15.1 and 0.31.1.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0442e664fb2e2e3", "name": "CVE-2026-42041: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42041: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution to silently suppress all HTTP error responses (401, 403, 500, etc.), causing them to be treated as successful responses. This completely bypasses application-level authentication and error handling. The root cause is that validateStatus is the only config property using the mergeDirectKeys\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7414d1fbfeb92852", "name": "CVE-2026-42042: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42042: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: XSRF token bypass leading to information disclosure\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. When this property is set to any truthy non-boolean value (via prototype pollution or misconfiguration), the same-origin check (isURLSameOrigin) is short-circuited, causing XSRF tokens to be sent to all request targets including cross-origin s\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5ed359b2b70ea74", "name": "CVE-2026-42044: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42044: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget\n\nAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution \"Gadget\" attack that allows any Object.prototype pollution in the application's dependency tree to be escalated into surgical, invisible modification of all JSON API responses \u2014 including privilege escalation, balance manipulation, and authorization bypass. The default transformResponse function at lib/defaults/index.js:124 calls JSON.parse(data, \n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.2\nSeverity: MEDIUM\nFix: Upgrade axios to 1.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b002648b6ce25f8c", "name": "CVE-2026-44490: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44490: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure and denial of service due to prototype pollution\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency in the same process (e.g. lodash _.merge / CVE-2018-16487), axios silently picks up the polluted values. (1) lib/utils.js line 406 builds merge()'s accumulator as result = {}, so result[targetKey] (line 414) walks Object.prototype and the polluted bucket's own keys are copied into the mer\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.16.0, 0.32.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.16.0, 0.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7954c2cd2e25b7bb", "name": "GHSA-42h9-826w-cgv3: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-42h9-826w-cgv3: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Axios: Excessive recursion in formDataToJSON can cause denial of service\n\n## Summary\nAxios versions `0.28.0` and later contain uncontrolled recursion in `formDataToJSON`, the helper behind the public `axios.formToJSON()` / named `formToJSON` API and the default request transform used when FormData is sent with an `application/json` content type.\n\nApplications are affected when they pass attacker-controlled `FormData` field names into this functionality. A field name with thousands of nested bracket segments can exhaust the JavaScript call stack and throw `RangeError: \n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49b0a5ff7aa07074", "name": "GHSA-7q8q-rj6j-mhjq: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-7q8q-rj6j-mhjq: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Axios: Nested axios option objects can consume polluted prototype values\n\n## Summary\n\nAxios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted `Object.prototype`.\n\nThe top-level merged config is protected with a null prototype, but nested plain objects such as `auth` and `paramsSerializer` are cloned into ordinary objects. If application code passes placeholders such as `auth: {}` or `paramsSerializer: {}`, inherited `username`, `password`, `encode`, or `serialize` properties can influence outbound re\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05606ca58644a8aa", "name": "GHSA-jqh4-m9w3-8hp9: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-jqh4-m9w3-8hp9: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`\n\n## Summary\n\naxios\u2019 fetch adapter does not enforce `maxBodyLength` for live WHATWG `ReadableStream` request bodies whose size cannot be determined before dispatch. Applications that use `adapter: \"fetch\"` and rely on `maxBodyLength` to cap untrusted upload/proxy streams can send the full stream even when it exceeds the configured limit.\n\nThis affects fetch-adapter usage in edge runtimes where fetch is selected, and in Node.js or browser environments where the fetch adapter is explicitly selected.\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81194278cedce114", "name": "GHSA-mmx7-hfxf-jppx: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-mmx7-hfxf-jppx: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Axios: Prototype pollution gadgets can alter axios request construction\n\n## Summary\n\naxios is vulnerable to read-side prototype-pollution gadgets when `Object.prototype` has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: `axios.get()`, `axios.delete()`, `axios.head()`, and `axios.options()` read inherited `data` before config normalization, causing attacker-controlled body data to be sent on requests that did not explicitly set a body.\n\nAdditional low-level paths affect consumers that \n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.18.0, 0.33.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.18.0, 0.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e71e0f04cb1c5ed7", "name": "GHSA-pmv8-rq9r-6j72: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-pmv8-rq9r-6j72: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Axios: Deep formToJSON Key Recursion Can Cause Denial of Service\n\n## Summary\n\nAxios versions starting with `0.28.0` contain uncontrolled recursion in `formDataToJSON`, which is exposed as `axios.formToJSON()` and used internally when axios serialises `FormData` with `Content-Type: application/json`.\n\nIf an application passes attacker-controlled `FormData` field names to this functionality, a field name with thousands of nested bracket segments can exhaust the JavaScript call stack and cause denial of service for that request or, in applications without appropr\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 0.33.0, 1.18.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.33.0, 1.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38e0114b42b7102e", "name": "CVE-2026-42040: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-42040: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Incorrect null byte handling can lead to data integrity issues\n\nAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the encode() function in lib/helpers/AxiosURLSearchParams.js contains a character mapping (charMap) at line 21 that reverses the safe percent-encoding of null bytes. After encodeURIComponent('\\x00') correctly produces the safe sequence %00, the charMap entry '%00': '\\x00' converts it back to a raw null byte. Primary impact is limited because the standard axios request flow is not affected. This vulnerab\n\nPackage: axios\nInstalled: 1.7.7\nFixed in: 1.15.1, 0.31.1\nSeverity: LOW\nFix: Upgrade axios to 1.15.1, 0.31.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d6260db9273a047", "name": "CVE-2025-25977: canvg 3.0.10 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-25977: canvg 3.0.10 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "canvg: Prototype Pollution Vulneralbility\n\nAn issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.\n\nPackage: canvg\nInstalled: 3.0.10\nFixed in: 4.0.3, 3.0.11\nSeverity: HIGH\nFix: Upgrade canvg to 4.0.3, 3.0.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-afbbeadc39a42c52", "name": "CVE-2024-21538: cross-spawn 7.0.3 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2024-21538: cross-spawn 7.0.3 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "cross-spawn: regular expression denial of service\n\nVersions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.\n\nPackage: cross-spawn\nInstalled: 7.0.3\nFixed in: 7.0.5, 6.0.6\nSeverity: HIGH\nFix: Upgrade cross-spawn to 7.0.5, 6.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-efb9f28bf8aa3b24", "name": "CVE-2025-15599: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-15599: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-site scripting\n\nDOMPurify 3.1.3 through 3.2.6 and 2.5.3 through 2.5.8 contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting missing textarea rawtext element validation in the SAFE_FOR_XML regex. Attackers can include closing rawtext tags like </textarea> in attribute values to break out of rawtext contexts and execute JavaScript when sanitized output is placed inside rawtext elements. The 3.x branch was fixed in 3.2.7; the 2.x branch was never patched.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.2.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.2.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15e6be14caca3b31", "name": "CVE-2025-26791: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-26791: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: Mutation XSS in DOMPurify Due to Improper Template Literal Handling\n\nDOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes leading to mutation cross-site scripting (mXSS).\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.2.4\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.2.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6da4364923a621d6", "name": "CVE-2026-0540: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-0540: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-site scripting vulnerability\n\nDOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, iframe) in the SAFE_FOR_XML regex. Attackers can include payloads like </noscript><img src=x onerror=alert(1)> in attribute values to execute JavaScript when sanitized output is placed inside these unprotected rawtext contexts.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.3.2, 2.5.9\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.3.2, 2.5.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-caa1ee508e67e487", "name": "CVE-2026-41239: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-41239: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "DOMPurify: Vue 2: DOMPurify: Cross-site scripting due to incomplete sanitization of template expressions\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Starting in version 1.0.10 and prior to version 3.4.0, `SAFE_FOR_TEMPLATES` strips `{{...}}` expressions from untrusted HTML. This works in string mode but not with `RETURN_DOM` or `RETURN_DOM_FRAGMENT`, allowing XSS via template-evaluating frameworks like Vue 2. Version 3.4.0 patches the issue.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a350563395c83bc", "name": "CVE-2026-41240: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-41240: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Versions prior to 3.4.0 have an inconsistency between FORBID_TAGS and FORBID_ATTR handling when function-based ADD_TAGS is used. Commit c361baa added an early exit for FORBID_ATTR at line 1214. The same fix was not applied to FORBID_TAGS. At line 1118-1123, when EXTRA_ELEMENT_HANDLING.tagCheck returns true, the short-circuit evaluation skips the FORBID_TAGS check entirely. This allows forbidden elements to survive \n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5209e689730d933c", "name": "CVE-2026-49458: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-49458: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting due to improper sanitization of DOM nodes\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(node, { IN_PLACE: true }) accepted same-origin foreign-realm DOM nodes while follow-on checks used parent-realm constructors, causing instanceof checks for forms, named node maps, document fragments, and elements to fail and skip clobber, template-content, and shadow-DOM sanitization branches so executable markup could survive. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8f0ee535aa92d36c", "name": "CVE-2026-49459: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-49459: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting bypass allows arbitrary script execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.6, DOMPurify.sanitize(root, { IN_PLACE: true }) could preserve event-handler attributes on an attacker-controlled <form> root when a descendant name clobbered properties checked by _isClobbered, because _forceRemove no-opped on the parent-less root and _sanitizeAttributes returned early. This issue is fixed in version 3.4.6.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.6\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43b2f0493a97e16e", "name": "CVE-2026-49978: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-49978: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution\n\nDOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. Prior to 3.4.7, DOMPurify IN_PLACE sanitization could skip shadow contents attached to an element inside <template>.content, allowing attacker-controlled markup such as event handlers, JavaScript URLs, or scripts to survive and execute when an application cloned and inserted the sanitized template. This issue is fixed in version 3.4.7.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b2ebef62549f05c7", "name": "CVE-2026-65898: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-65898: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting via permanent attribute allowlist pollution\n\nDOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.11\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4fae70deb9ae485f", "name": "CVE-2026-65902: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-65902: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Sanitization bypass via hook manipulation\n\nDOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is called without an explicit cfg.ALLOWED_TAGS / cfg.ALLOWED_ATTR array. A hook that mutates these fields permanently widens the default allow-lists for the lifetime of the DOMPurify instance, so all subsequent default-config sanitiz\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.7\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c43e0fe1da2ffee", "name": "CVE-2026-65903: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-65903: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Security bypass allows injection of malicious content\n\nDOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.0\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9cc0275f3498c2d6", "name": "CVE-2026-65912: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-65912: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: URI validation bypass leads to cross-site scripting\n\nDOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.3.2\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b667997500d0cfe9", "name": "CVE-2026-65913: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-65913: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-Site Scripting (XSS) via prototype pollution in USE_PROFILES mode\n\nDOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.3.2\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1bf4a89809030d8d", "name": "CVE-2026-65914: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-65914: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-Site Scripting vulnerability allows arbitrary code execution\n\nDOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.3.2\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-442d672741798a6e", "name": "GHSA-55q2-fjhq-7xh7: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS\n\n### Summary\n\nDuring `IN_PLACE` sanitization, a hook that removes an element can leave that element's detached descendants executable. A descendant image can retain its attacker-provided `onload` handler and fire after `sanitize()` returns, even though the returned root is clean and the image remains disconnected from the document.\n\n### Details\n\nIn DOMPurify 3.4.12, `_sanitizeElements()` in `src/purify.ts:1862-1904` runs the `beforeSanitizeElements` or `uponSanitizeElement` hook and returns immed\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.13\nSeverity: MEDIUM\nFix: Upgrade dompurify to 3.4.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-958b8db8e48ba73c", "name": "CVE-2026-65899: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-65899: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Client-side arbitrary code execution due to improper Trusted Types policy reset\n\nDOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays bound to a previously supplied TRUSTED_TYPES_POLICY. A later caller that requests RETURN_TRUSTED_TYPE output receives a TrustedHTML object created by the old (potentially unsafe) policy rather than a clean default, which can lead to script execution at a Trusted Types sink. Passing TRUSTED_TYPES_POLICY: null on the later call als\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.9\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee4be0d4389c6dd5", "name": "CVE-2026-65901: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-65901: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "dompurify: DOMPurify: Cross-site scripting vulnerability via attacker-controlled nodeName\n\nDOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a07f0d3be241e8d2", "name": "GHSA-c2j3-45gr-mqc4: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.\n\n## Summary\n\nThere is a possible hook-policy inconsistency in DOMPurify 3.4.11 involving `CUSTOM_ELEMENT_HANDLING`.\n\nWhen a custom element is allowed via `CUSTOM_ELEMENT_HANDLING.tagNameCheck`, it appears that the element does not go through `afterSanitizeElements` in the same way as a normal element. As a result, an application that relies on `afterSanitizeElements` as a security policy layer to strip sensitive attributes from all elements may see those attributes removed from normal elements bu\n\nPackage: dompurify\nInstalled: 2.5.6\nFixed in: 3.4.12\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c25efa32588d98d", "name": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.6 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.6 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets\n\n## Summary\n\nWhen an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-476). Any custom authentication header (e.g., `X-API-Key`, `X-Auth-Token`, `Api-Key`, `Token`) is forwarded verbatim to the redirect target.\n\nSince `follow-redirects` is the redirect-handling dependency for **axios** (105K+ stars), this vulnerability affects the entire axios ecosystem.\n\n##\n\nPackage: follow-redirects\nInstalled: 1.15.6\nFixed in: 1.16.0\nSeverity: MEDIUM\nFix: Upgrade follow-redirects to 1.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-255f42c7cfdcd82a", "name": "CVE-2025-7783: form-data 4.0.0 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-7783: form-data 4.0.0 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "form-data: Unsafe random function in form-data\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\n\nPackage: form-data\nInstalled: 4.0.0\nFixed in: 2.5.4, 3.0.4, 4.0.4\nSeverity: CRITICAL\nFix: Upgrade form-data to 2.5.4, 3.0.4, 4.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-75562c1127487e9b", "name": "CVE-2026-12143: form-data 4.0.0 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-12143: form-data 4.0.0 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "form-data: form-data: Form field override via CRLF injection\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta\n\nPackage: form-data\nInstalled: 4.0.0\nFixed in: 2.5.6, 3.0.5, 4.0.6\nSeverity: HIGH\nFix: Upgrade form-data to 2.5.6, 3.0.5, 4.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b760ba355696fdd1", "name": "CVE-2025-68428: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-68428: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jspdf: jsPDF Local File Inclusion/Path Traversal vulnerability\n\njsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `ad\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.0.0\nSeverity: CRITICAL\nFix: Upgrade jspdf to 4.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-94c1a343c0cd2e79", "name": "CVE-2026-31938: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-31938: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jspdf: jsPDF: Cross site scripting via unsanitized output options\n\njsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface. These values are then passed unsanitized (automatically or semi-automatically) to the attack victi\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.2.1\nSeverity: CRITICAL\nFix: Upgrade jspdf to 4.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-945aae91ea6b9799", "name": "CVE-2025-29907: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-29907: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jsPDF Bypass Regular Expression Denial of Service (ReDoS)\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.1, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitised image urls to the addImage method, a user can provide a harmful data-url that results in high CPU utilization and denial of service. Other affected methods are html and addSvgAsImage. The vulnerability was fixed in jsPDF 3.0.1.\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 3.0.1\nSeverity: HIGH\nFix: Upgrade jspdf to 3.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7768f4ad61b217f2", "name": "CVE-2025-57810: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-57810: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jspdf: jsPDF Denial of Service (DoS)\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of service. The vulnerability was fixed in jsPDF 3.0.2.\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 3.0.2\nSeverity: HIGH\nFix: Upgrade jspdf to 3.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8dbaf0a7ec4ec166", "name": "CVE-2026-24133: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-24133: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jsPDF: jsPDF: Denial of Service due to excessive memory allocation from crafted BMP images\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addImage method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful BMP file that results in out of memory errors and denial of service. Harmful BMP files have large width and/or height entries in their headers, which lead to excessive memory allocation. The html method is also affected. The vul\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.1.0\nSeverity: HIGH\nFix: Upgrade jspdf to 4.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4b4da7b6197a49c", "name": "CVE-2026-24737: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-24737: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jsPDF: jsPDF: Arbitrary code execution via unsanitized input in Acroform module\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are AcroformChoiceField.addOption, AcroformChoic\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.1.0\nSeverity: HIGH\nFix: Upgrade jspdf to 4.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-34eb8bb06c3fca96", "name": "CVE-2026-25535: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-25535: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jsPDF: denial of service via malicious GIF dimensions\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the first argument of the `addImage` method results in denial of service. If given the possibility to pass unsanitized image data or URLs to the `addImage` method, a user can provide a harmful GIF file that results in out of memory errors and denial of service. Harmful GIF files have large width and/or height entries in their headers, which lead to excessive memory allocation. Other affected methods are: `html`. T\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.2.0\nSeverity: HIGH\nFix: Upgrade jspdf to 4.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-63bae6f34732257f", "name": "CVE-2026-25755: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-25755: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jsPDF: PDF object injection via unsanitized input in addJS method\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of the argument of the `addJS` method allows an attacker to inject arbitrary PDF objects into the generated document. By crafting a payload that escapes the JavaScript string delimiter, an attacker can execute malicious actions or alter the document structure, impacting any user who opens the generated PDF. The vulnerability has been fixed in jspdf@4.2.0. As a workaround, escape parentheses in user-provided JavaScrip\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.2.0\nSeverity: HIGH\nFix: Upgrade jspdf to 4.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2fff7b58af908b86", "name": "CVE-2026-25940: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-25940: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jsPDF: PDF injection in AcroForm module allows arbitrary JavaScript execution (RadioButton children)\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 4.2.0, user control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following property, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim hovers over the radio option. The vulnerability has been fixed in jsPDF@4.2.0. As a workaround, sanitize use\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.2.0\nSeverity: HIGH\nFix: Upgrade jspdf to 4.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-237dd1da11fd7bb2", "name": "CVE-2026-31898: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-31898: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jspdf: jsPDF: Arbitrary code execution via unsanitized input in createAnnotation method\n\njsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnotation` method allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to the following method, a user can inject arbitrary PDF objects, such as JavaScript actions, which might trigger when the PDF is opened or interacted with the `createAnnotation`: `color` parameter. The vulnerability has been fixed in jsPDF@\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.2.1\nSeverity: HIGH\nFix: Upgrade jspdf to 4.2.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-65812c1d6fcb2449", "name": "CVE-2026-24040: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-24040: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jsPDF: jsPDF: Cross-User Data Leakage via race condition in addJS method\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, the addJS method in the jspdf Node.js build utilizes a shared module-scoped variable (text) to store JavaScript content. When used in a concurrent environment (e.g., a Node.js web server), this variable is shared across all requests. If multiple requests generate PDFs simultaneously, the JavaScript content intended for one user may be overwritten by a subsequent request before the document is generated. This results in Cross-User\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.1.0\nSeverity: MEDIUM\nFix: Upgrade jspdf to 4.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f09e63bdc3f49f19", "name": "CVE-2026-24043: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-24043: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "jsPDF: jsPDF: PDF integrity compromised via arbitrary XML injection in addMetadata function\n\njsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in jsPDF@4.1.0.\n\nPackage: jspdf\nInstalled: 2.5.1\nFixed in: 4.1.0\nSeverity: MEDIUM\nFix: Upgrade jspdf to 4.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-612d08c20fc68ace", "name": "CVE-2026-67213: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-67213: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation\n\nnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.7\nFixed in: 3.3.18, 5.1.6\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.18, 5.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e6add6b98a276ce", "name": "CVE-2026-67214: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-67214: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via negative size input in non-secure module functions\n\nnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.7\nFixed in: 3.3.16, 5.1.16\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.16, 5.1.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8e01d33d895127c6", "name": "CVE-2024-55565: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2024-55565: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "nanoid: nanoid mishandles non-integer values\n\nnanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.\n\nPackage: nanoid\nInstalled: 3.3.7\nFixed in: 5.0.9, 3.3.8\nSeverity: MEDIUM\nFix: Upgrade nanoid to 5.0.9, 3.3.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84c21ed653c9d87c", "name": "CVE-2025-29927: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-29927: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "nextjs: Authorization Bypass in Next.js Middleware\n\nNext.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommend that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed \n\nPackage: next\nInstalled: 14.2.7\nFixed in: 13.5.9, 14.2.25, 15.2.3, 12.3.5\nSeverity: CRITICAL\nFix: Upgrade next to 13.5.9, 14.2.25, 15.2.3, 12.3.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-40aa07e70ff45f59", "name": "CVE-2024-46982: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2024-46982: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js Cache Poisoning\n\nNext.js is a React framework for building full-stack web applications. By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of th\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 13.5.7, 14.2.10\nSeverity: HIGH\nFix: Upgrade next to 13.5.7, 14.2.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f6f565eb7debf0f", "name": "CVE-2024-51479: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2024-51479: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: next: authorization bypass in Next.js\n\nNext.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 14.2.15\nSeverity: HIGH\nFix: Upgrade next to 14.2.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f2e25a5a35ea42b6", "name": "CVE-2026-44573: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44573: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n\n\nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intende\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fdf326cb10bfa2a3", "name": "CVE-2026-44578: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44578: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests\n\nNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-814c49583e928d99", "name": "CVE-2026-64641: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-64641: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Denial of Service via crafted requests to App Router with Server Actions\n\nNext.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process. This issue has been fixed in versions 15.5.21 and 16.2.11.\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f55279016778da31", "name": "CVE-2026-64645: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-64645: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Server-Side Request Forgery vulnerability\n\nNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a\n rewrites() or redirects() rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A redirects(\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2cb3c4015f5103bf", "name": "CVE-2026-64649: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-64649: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions\n\nNext.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df11d8e0528e4b18", "name": "GHSA-5j59-xgg2-r9c4: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-5j59-xgg2-r9c4: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up\n\nIt was discovered that the fix for [CVE-2025-55184](https://github.com/advisories/GHSA-2m3v-v2m8-q956) in React Server Components was incomplete and did not fully mitigate denial-of-service conditions across all payload types.  As a result, certain crafted inputs could still trigger excessive resource consumption. \n\nThis vulnerability affects React versions 19.0.2, 19.1.3, and 19.2.2, as well as frameworks that bundle or depend on these versions, including Next.js 13.x, 14.x, 15.x, and 16.x when\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19\nSeverity: HIGH\nFix: Upgrade next to 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a02f19665fdff23e", "name": "GHSA-8h8q-6873-q5fj: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-8h8q-6873-q5fj: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js Vulnerable to Denial of Service with Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). \n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of \n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72c41966489bcb5a", "name": "GHSA-h25m-26qc-wcjf: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-h25m-26qc-wcjf: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-m\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5\nSeverity: HIGH\nFix: Upgrade next to 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-28736588d9e31201", "name": "GHSA-mwv6-3258-q52c: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-mwv6-3258-q52c: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next Vulnerable to Denial of Service with Server Components\n\nA vulnerability affects certain React packages for versions 19.0.0, 19.0.1, 19.1.0, 19.1.1, 19.1.2, 19.2.0, and 19.2.1 and frameworks that use the affected packages, including Next.js 15.x and 16.x using the App Router. The issue is tracked upstream as [CVE-2025-55184](https://www.cve.org/CVERecord?id=CVE-2025-55184).\n\nA malicious HTTP request can be crafted and sent to any App Router endpoint that, when deserialized, can cause the server process to hang and consume CPU. This can result in denia\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17\nSeverity: HIGH\nFix: Upgrade next to 14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e15ff84415cf517f", "name": "GHSA-q4gf-8mx6-v5v3: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "GHSA-q4gf-8mx6-v5v3: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js has a Denial of Service with Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).\n\nA specially crafted HTTP request can be sent to any App Rout\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.15, 16.2.3\nSeverity: HIGH\nFix: Upgrade next to 15.5.15, 16.2.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b11827c4abdf20c2", "name": "CVE-2024-56332: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2024-56332: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Next.js Vulnerable to Denial of Service (DoS) with Server Actions\n\nNext.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js ser\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 13.5.8, 14.2.21, 15.1.2\nSeverity: MEDIUM\nFix: Upgrade next to 13.5.8, 14.2.21, 15.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-03e7b6e914149dc6", "name": "CVE-2025-55173: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-55173: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "nextjs: Next.js Content Injection Vulnerability for Image Optimization\n\nNext.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization is vulnerable to content injection. The issue allowed attacker-controlled external image sources to trigger file downloads with arbitrary content and filenames under specific configurations. This behavior could be abused for phishing or malicious file delivery. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5.\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 14.2.31, 15.4.5\nSeverity: MEDIUM\nFix: Upgrade next to 14.2.31, 15.4.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8381ddd70572fda0", "name": "CVE-2025-57752: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-57752: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "nextjs: Next.js Affected by Cache Key Confusion for Image Optimization API Routes\n\nNext.js is a React framework for building full-stack web applications. In versions before 14.2.31 and from 15.0.0 to before 15.4.5, Next.js Image Optimization API routes are affected by cache key confusion. When images returned from API routes vary based on request headers (such as Cookie or Authorization), these responses could be incorrectly cached and served to unauthorized users due to a cache key confusion bug. This vulnerability has been fixed in Next.js versions 14.2.31 and 15.4.5. All us\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 14.2.31, 15.4.5\nSeverity: MEDIUM\nFix: Upgrade next to 14.2.31, 15.4.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dcfe080fb42f34be", "name": "CVE-2025-57822: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-57822: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js Improper Middleware Redirect Handling Leads to SSRF\n\nNext.js is a React framework for building full-stack web applications. Prior to versions 14.2.32 and 15.4.7, when next() was used without explicitly passing the request object, it could lead to SSRF in self-hosted applications that incorrectly forwarded user-supplied headers. This vulnerability has been fixed in Next.js versions 14.2.32 and 15.4.7. All users implementing custom middleware logic in self-hosted environments are strongly encouraged to upgrade and verify correct usage of the next() \n\nPackage: next\nInstalled: 14.2.7\nFixed in: 14.2.32, 15.4.7\nSeverity: MEDIUM\nFix: Upgrade next to 14.2.32, 15.4.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45612baaffddb017", "name": "CVE-2025-59471: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-59471: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next: NextJS Denial of Service in Image Optimizer\n\nA denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.10, 16.1.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.10, 16.1.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bfb32ca9cee2ea3", "name": "CVE-2026-27980: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-27980: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage\n\nNext.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including e\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 16.1.7, 15.5.14\nSeverity: MEDIUM\nFix: Upgrade next to 16.1.7, 15.5.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7bdda6eb9c67faba", "name": "CVE-2026-29057: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-29057: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: HTTP request smuggling in rewrites\n\nNext.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, interna\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 16.1.7, 15.5.13\nSeverity: MEDIUM\nFix: Upgrade next to 16.1.7, 15.5.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2732bd70899eb03a", "name": "CVE-2026-44576: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44576: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Cache poisoning vulnerability in React Server Components\n\nNext.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19f0a9a3d0f2a38d", "name": "CVE-2026-44577: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44577: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Denial of Service via Image Optimization API\n\nNext.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f416e8c31ba1651c", "name": "CVE-2026-44580: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44580: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content\n\nNext.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vu\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-459d85845321289c", "name": "CVE-2026-44581: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44581: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses\n\nNext.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed i\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1282922c4ee929b", "name": "CVE-2026-64643: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-64643: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Information disclosure via Server Action ID exposure\n\nNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are ap\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01170a640d4211b5", "name": "CVE-2026-64646: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-64646: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Denial of Service via excessive memory consumption in Server Actions\n\nNext.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11.\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c11b68544e977d8a", "name": "CVE-2026-64647: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-64647: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Information disclosure via server-side request caching\n\nNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This is only an issue when receiving request bodies with a content type charset other than UTF-8\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f06832c717b7db5", "name": "CVE-2026-64648: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-64648: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Information disclosure via server-side fetch cache\n\nNext.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a  server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed t\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36583de8ece331c2", "name": "CVE-2025-32421: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-32421: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Next.js Race Condition to Cache Poisoning\n\nNext.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve `pageProps` data instead of standard HTML. This issue was patched in versions 15.1.6 and 14.2.24 by stripping the `x-now-route-matches` header from incoming requests. Applications hosted on Vercel's platform are not affected by this issue, as the \n\nPackage: next\nInstalled: 14.2.7\nFixed in: 14.2.24, 15.1.6\nSeverity: LOW\nFix: Upgrade next to 14.2.24, 15.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf83deba51e8b9b9", "name": "CVE-2025-48068: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-48068: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Information exposure in Next.js dev server due to lack of origin verification\n\nNext.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 14.2.30 and 15.0.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the App Router enabled. The vulnerability only affects local development environments and requires the user to visit a malicious webpage while npm run dev is active. This issue has been patched in versions 14.2.30 and 15.2.2.\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.2.2, 14.2.30\nSeverity: LOW\nFix: Upgrade next to 15.2.2, 14.2.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a1c6082d0a3b527", "name": "CVE-2026-44572: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44572: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects\n\nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable red\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: LOW\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bcc0392a90b3852", "name": "CVE-2026-44582: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-44582: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "Next.js: Next.js: Cache poisoning allows incorrect response delivery\n\nNext.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nPackage: next\nInstalled: 14.2.7\nFixed in: 15.5.16, 16.2.5\nSeverity: LOW\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-100496e369bcb8d2", "name": "CVE-2026-45623: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-45623: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.12\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-00a4380174cfd4c5", "name": "CVE-2026-73646: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-73646: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "PostCSS takes a CSS file and provides an API to analyze and modify its ...\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.1\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.18\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bff4c8792d954873", "name": "CVE-2026-41305: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f97d7b9762860247", "name": "CVE-2026-69153: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-69153: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.23\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24c12546c89c5503", "name": "CVE-2025-15284: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2025-15284: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper input validation in array parsing\n\nImproper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.14.1\nSeverity: MEDIUM\nFix: Upgrade qs to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b4883bc4957890a", "name": "CVE-2026-8723: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-8723: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service due to improper handling of null/undefined array elements\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95a6293f69fe2b69", "name": "CVE-2026-2391: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json", "shortDescription": {"text": "CVE-2026-2391: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af68a318d859ed79", "name": "CVE-2026-12590: body-parser 1.20.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12590: body-parser 1.20.3 \u2014 package-lock.json"}, "fullDescription": {"text": "body-parser: body-parser: Denial of Service via invalid limit option\n\nImpact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-pars\n\nPackage: body-parser\nInstalled: 1.20.3\nFixed in: 1.20.6, 2.3.0\nSeverity: LOW\nFix: Upgrade body-parser to 1.20.6, 2.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41aeed0cdec09958", "name": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e129f76ffd62afa3", "name": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-53a565b68abde6fa", "name": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e0d93e508ef6102", "name": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-157cac5b75a99569", "name": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: juliangruber brace-expansion index.js expand redos\n\nA vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i\n\nPackage: brace-expansion\nInstalled: 1.1.11\nFixed in: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nSeverity: LOW\nFix: Upgrade brace-expansion to 2.0.2, 1.1.12, 3.0.1, 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99f3b3bda0a99180", "name": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea9425ee46c2e976", "name": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d69773820cfb719", "name": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b8f808453e1a62b", "name": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 5.0.5, 3.0.2, 2.0.3, 1.1.13\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.5, 3.0.2, 2.0.3, 1.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4ac6bdb65b94ea3", "name": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 package-lock.json"}, "fullDescription": {"text": "brace-expansion: juliangruber brace-expansion index.js expand redos\n\nA vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 i\n\nPackage: brace-expansion\nInstalled: 2.0.1\nFixed in: 2.0.2, 1.1.12, 3.0.1, 4.0.1\nSeverity: LOW\nFix: Upgrade brace-expansion to 2.0.2, 1.1.12, 3.0.1, 4.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aac7c58ed5d7a73a", "name": "CVE-2025-12613: cloudinary 1.41.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-12613: cloudinary 1.41.3 \u2014 package-lock.json"}, "fullDescription": {"text": "Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand\n\nVersions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a variety of malicious outcomes, such as bypassing security checks, altering data, or manipulating the application's behavior.\r\r**Note:**\rFollowing our established security policy, we attempted to contact the maintainer regarding this vulnerability, but haven\n\nPackage: cloudinary\nInstalled: 1.41.3\nFixed in: 2.7.0\nSeverity: HIGH\nFix: Upgrade cloudinary to 2.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f32b69251dba4d22", "name": "CVE-2024-47764: cookie 0.4.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-47764: cookie 0.4.1 \u2014 package-lock.json"}, "fullDescription": {"text": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters\n\ncookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.\n\nPackage: cookie\nInstalled: 0.4.1\nFixed in: 0.7.0\nSeverity: LOW\nFix: Upgrade cookie to 0.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2165c24624488c9b", "name": "CVE-2024-47764: cookie 0.6.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-47764: cookie 0.6.0 \u2014 package-lock.json"}, "fullDescription": {"text": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters\n\ncookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.\n\nPackage: cookie\nInstalled: 0.6.0\nFixed in: 0.7.0\nSeverity: LOW\nFix: Upgrade cookie to 0.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-729a87fa6a49863a", "name": "CVE-2025-7783: form-data 3.0.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-7783: form-data 3.0.1 \u2014 package-lock.json"}, "fullDescription": {"text": "form-data: Unsafe random function in form-data\n\nUse of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\n\nPackage: form-data\nInstalled: 3.0.1\nFixed in: 2.5.4, 3.0.4, 4.0.4\nSeverity: CRITICAL\nFix: Upgrade form-data to 2.5.4, 3.0.4, 4.0.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f8d89208fb5ceca6", "name": "CVE-2026-12143: form-data 3.0.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-12143: form-data 3.0.1 \u2014 package-lock.json"}, "fullDescription": {"text": "form-data: form-data: Form field override via CRLF injection\n\nform-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (\") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta\n\nPackage: form-data\nInstalled: 3.0.1\nFixed in: 2.5.6, 3.0.5, 4.0.6\nSeverity: HIGH\nFix: Upgrade form-data to 2.5.6, 3.0.5, 4.0.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-12b0967f1e176d4a", "name": "CVE-2026-48038: joi 17.13.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48038: joi 17.13.3 \u2014 package-lock.json"}, "fullDescription": {"text": "joi: joi: Denial of Service via uncaught RangeError on deeply nested input through recursive link() schemas\n\njoi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structur\n\nPackage: joi\nInstalled: 17.13.3\nFixed in: 18.2.1, 17.13.4\nSeverity: MEDIUM\nFix: Upgrade joi to 18.2.1, 17.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bdb0ff330db7f641", "name": "CVE-2026-4800: lodash 4.17.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-488c54428fc34f0d", "name": "CVE-2025-13465: lodash 4.17.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8832f52283a5d751", "name": "CVE-2026-2950: lodash 4.17.21 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 package-lock.json"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64ecea76e6bc5e09", "name": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5547d992435923f9", "name": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc1422d1987f9a44", "name": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 3.1.2\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4ec88b724d2f418c", "name": "CVE-2026-26996: minimatch 5.1.6 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-26996: minimatch 5.1.6 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service via specially crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) \n\nPackage: minimatch\nInstalled: 5.1.6\nFixed in: 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.1, 9.0.6, 8.0.5, 7.4.7, 6.2.1, 5.1.7, 4.2.4, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c47ca5360d3f0fe7", "name": "CVE-2026-27903: minimatch 5.1.6 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27903: minimatch 5.1.6 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call\n\nPackage: minimatch\nInstalled: 5.1.6\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3bfb8e4cc920548c", "name": "CVE-2026-27904: minimatch 5.1.6 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-27904: minimatch 5.1.6 \u2014 package-lock.json"}, "fullDescription": {"text": "minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions\n\nminimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushe\n\nPackage: minimatch\nInstalled: 5.1.6\nFixed in: 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4\nSeverity: HIGH\nFix: Upgrade minimatch to 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, 3.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ea6d60138d04ea9", "name": "CVE-2025-23061: mongoose 8.5.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-23061: mongoose 8.5.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose search injection vulnerability\n\nMongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.\n\nPackage: mongoose\nInstalled: 8.5.1\nFixed in: 8.9.5, 7.8.4, 6.13.6\nSeverity: CRITICAL\nFix: Upgrade mongoose to 8.9.5, 7.8.4, 6.13.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3550a8c3091bd9f1", "name": "CVE-2024-53900: mongoose 8.5.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-53900: mongoose 8.5.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose search injection vulnerability\n\nMongoose before 8.8.3 can improperly use $where in match, leading to search injection.\n\nPackage: mongoose\nInstalled: 8.5.1\nFixed in: 8.8.3, 7.8.3, 6.13.5, 5.13.23\nSeverity: HIGH\nFix: Upgrade mongoose to 8.8.3, 7.8.3, 6.13.5, 5.13.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32e268397b5495b7", "name": "CVE-2026-42334: mongoose 8.5.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-42334: mongoose 8.5.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection\n\nMongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose\u2019s sanitizeFilter query sanitization mechanism via the $nor operator. When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), \n\nPackage: mongoose\nInstalled: 8.5.1\nFixed in: 6.13.9, 7.8.9, 8.22.1, 9.1.6\nSeverity: HIGH\nFix: Upgrade mongoose to 6.13.9, 7.8.9, 8.22.1, 9.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-199c94f3822a6e9b", "name": "CVE-2026-73562: mongoose 8.5.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-73562: mongoose 8.5.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)\n\nMongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArr\n\nPackage: mongoose\nInstalled: 8.5.1\nFixed in: 6.13.10, 7.8.10, 8.24.1, 9.7.2\nSeverity: MEDIUM\nFix: Upgrade mongoose to 6.13.10, 7.8.10, 8.24.1, 9.7.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8c45f2f6ac38eb9", "name": "CVE-2025-47935: multer 1.4.5-lts.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-47935: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Multer vulnerable to Denial of Service via memory leaks from unclosed streams\n\nMulter is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, req\n\nPackage: multer\nInstalled: 1.4.5-lts.1\nFixed in: 2.0.0\nSeverity: HIGH\nFix: Upgrade multer to 2.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b99065720a93085", "name": "CVE-2025-47944: multer 1.4.5-lts.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-47944: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "fullDescription": {"text": "Multer vulnerable to Denial of Service from maliciously crafted requests\n\nMulter is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.\n\nPackage: multer\nInstalled: 1.4.5-lts.1\nFixed in: 2.0.0\nSeverity: HIGH\nFix: Upgrade multer to 2.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2d349427ec9e3dfe", "name": "CVE-2025-48997: multer 1.4.5-lts.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-48997: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "fullDescription": {"text": "multer: Multer vulnerable to Denial of Service via unhandled exception\n\nMulter is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.\n\nPackage: multer\nInstalled: 1.4.5-lts.1\nFixed in: 2.0.1\nSeverity: HIGH\nFix: Upgrade multer to 2.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-296cf00c23481ea7", "name": "CVE-2025-7338: multer 1.4.5-lts.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-7338: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "fullDescription": {"text": "multer: Multer Denial of Service\n\nMulter is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.\n\nPackage: multer\nInstalled: 1.4.5-lts.1\nFixed in: 2.0.2\nSeverity: HIGH\nFix: Upgrade multer to 2.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72fd4c1ec8519398", "name": "CVE-2026-2359: multer 1.4.5-lts.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2359: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "fullDescription": {"text": "multer: Multer: Denial of Service via dropped file upload connections\n\nMulter is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.\n\nPackage: multer\nInstalled: 1.4.5-lts.1\nFixed in: 2.1.0\nSeverity: HIGH\nFix: Upgrade multer to 2.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0b27984f316f2f3d", "name": "CVE-2026-3304: multer 1.4.5-lts.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-3304: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "fullDescription": {"text": "multer: Multer: Denial of Service via malformed requests\n\nMulter is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.\n\nPackage: multer\nInstalled: 1.4.5-lts.1\nFixed in: 2.1.0\nSeverity: HIGH\nFix: Upgrade multer to 2.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f759e4ee5efe0d18", "name": "CVE-2026-3520: multer 1.4.5-lts.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-3520: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "fullDescription": {"text": "multer: Multer: Denial of Service via malformed requests\n\nMulter is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.\n\nPackage: multer\nInstalled: 1.4.5-lts.1\nFixed in: 2.1.1\nSeverity: HIGH\nFix: Upgrade multer to 2.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee6091c964fabf11", "name": "CVE-2026-5079: multer 1.4.5-lts.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-5079: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "fullDescription": {"text": "multer: Multer: Denial of Service via deeply nested field names in multipart form data\n\nImpact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.\n\nPatches: Users should upgrade to multer 2.2.0 (2.x line) o\n\nPackage: multer\nInstalled: 1.4.5-lts.1\nFixed in: 2.2.0, 3.0.0-alpha.2\nSeverity: HIGH\nFix: Upgrade multer to 2.2.0, 3.0.0-alpha.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-670db14a265d87ba", "name": "CVE-2025-7339: on-headers 1.0.2 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-7339: on-headers 1.0.2 \u2014 package-lock.json"}, "fullDescription": {"text": "on-headers: on-headers vulnerable to http response header manipulation\n\non-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in response headers being inadvertently modified when an array is passed to `response.writeHead()`.\u00a0Users should upgrade to version 1.1.0 to receive a patch.\u00a0Uses are strongly encouraged to upgrade to `1.1.0`, but this issue can be worked around by passing an object to `response.writeHead()` rather than an array.\n\nPackage: on-headers\nInstalled: 1.0.2\nFixed in: 1.1.0\nSeverity: LOW\nFix: Upgrade on-headers to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a429aba5190cbe54", "name": "CVE-2024-52798: path-to-regexp 0.1.10 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2024-52798: path-to-regexp 0.1.10 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x\n\npath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.\n\nPackage: path-to-regexp\nInstalled: 0.1.10\nFixed in: 0.1.12\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 0.1.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-750d55fb7a24b7d3", "name": "CVE-2026-4867: path-to-regexp 0.1.10 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-4867: path-to-regexp 0.1.10 \u2014 package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters\n\nImpact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\n\n\nPackage: path-to-regexp\nInstalled: 0.1.10\nFixed in: 0.1.13\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 0.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47cda05433ffe784", "name": "CVE-2026-33671: picomatch 2.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when combined with overlapping alternatives or nested extglobs, are compiled into regular expressions that can exhibit catastrophic backtracking on non-matching input. Applications are impacted when they allow untrusted users \n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: HIGH\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c46fa4398483f6d4", "name": "CVE-2026-33672: picomatch 2.3.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 package-lock.json"}, "fullDescription": {"text": "picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions\n\nPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to a method injection vulnerability affecting the `POSIX_REGEX_SOURCE` object. Because the object inherits from `Object.prototype`, specially crafted POSIX bracket expressions (e.g., `[[:constructor:]]`) can reference inherited method names. These methods are implicitly converted to strings and injected into the generated regular expression. This leads to incorrect glob matching behavior (int\n\nPackage: picomatch\nInstalled: 2.3.1\nFixed in: 4.0.4, 3.0.2, 2.3.2\nSeverity: MEDIUM\nFix: Upgrade picomatch to 4.0.4, 3.0.2, 2.3.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-901f0ee224c42289", "name": "CVE-2025-15284: qs 6.13.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-15284: qs 6.13.0 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper input validation in array parsing\n\nImproper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.14.1\nSeverity: MEDIUM\nFix: Upgrade qs to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23be245f727de7c2", "name": "CVE-2026-8723: qs 6.13.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-8723: qs 6.13.0 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service due to improper handling of null/undefined array elements\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-186521034ae7a598", "name": "CVE-2026-2391: qs 6.13.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-2391: qs 6.13.0 \u2014 package-lock.json"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fae20d984de25f9", "name": "CVE-2025-12758: validator 13.12.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-12758: validator 13.12.0 \u2014 package-lock.json"}, "fullDescription": {"text": "Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements\n\nVersions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\\uFE0F, \\uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer over\n\nPackage: validator\nInstalled: 13.12.0\nFixed in: 13.15.22\nSeverity: HIGH\nFix: Upgrade validator to 13.15.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d252cc385dbf9d39", "name": "CVE-2025-56200: validator 13.12.0 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2025-56200: validator 13.12.0 \u2014 package-lock.json"}, "fullDescription": {"text": "validator.js has a URL validation bypass vulnerability in its isURL function\n\nA URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.\n\nPackage: validator\nInstalled: 13.12.0\nFixed in: 13.15.20\nSeverity: MEDIUM\nFix: Upgrade validator to 13.15.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3a3527e70129fb18", "name": "DS-0002: Image user should not be 'root' \u2014 Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3c4041c454cda88e", "name": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-483c349c6efb3fdb", "name": "Docker base image is tag-pinned but not digest-pinned: node:16", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:16"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abfa50421ef214ea", "name": "Insecure pattern 'dangerous_innerhtml' in museum-ticket-booking/pages/index.tsx:281", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in museum-ticket-booking/pages/index.tsx:281"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-99c159a213863693", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions-ecosystem/action-create-comment@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-274c70d3d75cd49a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions-ecosystem/action-create-comment@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5e4f2dcfdccc5e1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d36213800efc3de", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 35 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 12 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e047ab7af03962f", "name": "7 env vars used in code but missing from .env.example", "shortDescription": {"text": "7 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CLOUD_API_KEY`, `CLOUD_API_SECRET`, `CLOUD_NAME`, `MONGODB_URI`, `NEXT_PUBLIC_STRIPE_PUBLIC_KEY`, `NODE_ENV`, `STRIPE_SECRET_KEY`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ab2dea26c141c59", "name": "Vulnerable dependency axios 1.7.7: GHSA-35jp-ww65-95wh", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-35jp-ww65-95wh"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-35jp-ww65-95wh (aka CVE-2026-44494).\n\naxios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`\n\nAliases: CVE-2026-44494\nAdvisory: https://osv.dev/vulnerability/GHSA-35jp-ww65-95wh\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f1484645acf991eb", "name": "Vulnerable dependency axios 1.7.7: GHSA-3g43-6gmg-66jw", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-3g43-6gmg-66jw"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3g43-6gmg-66jw (aka CVE-2026-44495).\n\naxios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge\n\nAliases: CVE-2026-44495\nAdvisory: https://osv.dev/vulnerability/GHSA-3g43-6gmg-66jw\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cdfddadf4dc86a30", "name": "Vulnerable dependency axios 1.7.7: GHSA-3p68-rc4w-qgx5", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-3p68-rc4w-qgx5"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3p68-rc4w-qgx5.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fbf711677ef022d1", "name": "Vulnerable dependency axios 1.7.7: GHSA-3w6x-2g7m-8v23", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-3w6x-2g7m-8v23"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3w6x-2g7m-8v23.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3w6x-2g7m-8v23\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-234ca1d7123a9361", "name": "Vulnerable dependency axios 1.7.7: GHSA-42h9-826w-cgv3", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-42h9-826w-cgv3"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-42h9-826w-cgv3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-42h9-826w-cgv3\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-862af6ad5bc5ac59", "name": "Vulnerable dependency axios 1.7.7: GHSA-43fc-jf86-j433", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-43fc-jf86-j433"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-43fc-jf86-j433.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-43fc-jf86-j433\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4ae7e7aeb448012", "name": "Vulnerable dependency axios 1.7.7: GHSA-445q-vr5w-6q77", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-445q-vr5w-6q77"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-445q-vr5w-6q77.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-445q-vr5w-6q77\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-499e6807926d00e9", "name": "Vulnerable dependency axios 1.7.7: GHSA-4hjh-wcwx-xvwj", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-4hjh-wcwx-xvwj"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-4hjh-wcwx-xvwj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4hjh-wcwx-xvwj\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-880c613b3b06b70a", "name": "Vulnerable dependency axios 1.7.7: GHSA-5c9x-8gcm-mpgx", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-5c9x-8gcm-mpgx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-5c9x-8gcm-mpgx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5c9x-8gcm-mpgx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06e501d9aa510f63", "name": "Vulnerable dependency axios 1.7.7: GHSA-62hf-57xw-28j9", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-62hf-57xw-28j9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-62hf-57xw-28j9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-62hf-57xw-28j9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3fe031371aec80fe", "name": "Vulnerable dependency axios 1.7.7: GHSA-6chq-wfr3-2hj9", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-6chq-wfr3-2hj9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-6chq-wfr3-2hj9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-092ae923802e52c1", "name": "Vulnerable dependency axios 1.7.7: GHSA-777c-7fjr-54vf", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-777c-7fjr-54vf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-777c-7fjr-54vf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-777c-7fjr-54vf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-adc26cbe2a015391", "name": "Vulnerable dependency axios 1.7.7: GHSA-7q8q-rj6j-mhjq", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-7q8q-rj6j-mhjq"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-7q8q-rj6j-mhjq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-174889bf874ea7f5", "name": "Vulnerable dependency axios 1.7.7: GHSA-898c-q2cr-xwhg", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-898c-q2cr-xwhg"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-898c-q2cr-xwhg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b14f2d5ebc5e21a4", "name": "Vulnerable dependency axios 1.7.7: GHSA-fvcv-3m26-pcqx", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-fvcv-3m26-pcqx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-fvcv-3m26-pcqx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fvcv-3m26-pcqx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-143bbd9bb7ba5a79", "name": "Vulnerable dependency axios 1.7.7: GHSA-hfxv-24rg-xrqf", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-hfxv-24rg-xrqf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-hfxv-24rg-xrqf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hfxv-24rg-xrqf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13b957a3ff211575", "name": "Vulnerable dependency axios 1.7.7: GHSA-j5f8-grm9-p9fc", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-j5f8-grm9-p9fc"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-j5f8-grm9-p9fc.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j5f8-grm9-p9fc\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3beacb8364f4dfa7", "name": "Vulnerable dependency axios 1.7.7: GHSA-jqh4-m9w3-8hp9", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-jqh4-m9w3-8hp9"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-jqh4-m9w3-8hp9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jqh4-m9w3-8hp9\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c458501f29e709e", "name": "Vulnerable dependency axios 1.7.7: GHSA-jr5f-v2jv-69x6", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-jr5f-v2jv-69x6"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-jr5f-v2jv-69x6.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jr5f-v2jv-69x6\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-48067168bed29539", "name": "Vulnerable dependency axios 1.7.7: GHSA-m7pr-hjqh-92cm", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-m7pr-hjqh-92cm"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-m7pr-hjqh-92cm.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m7pr-hjqh-92cm\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81fd9531c9c336cb", "name": "Vulnerable dependency axios 1.7.7: GHSA-mmx7-hfxf-jppx", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-mmx7-hfxf-jppx"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-mmx7-hfxf-jppx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-323f684d2ad095ce", "name": "Vulnerable dependency axios 1.7.7: GHSA-p92q-9vqr-4j8v", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-p92q-9vqr-4j8v"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-p92q-9vqr-4j8v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p92q-9vqr-4j8v\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9e3fee505a8f636", "name": "Vulnerable dependency axios 1.7.7: GHSA-pf86-5x62-jrwf", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-pf86-5x62-jrwf"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-pf86-5x62-jrwf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pf86-5x62-jrwf\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-88672bf6624cb900", "name": "Vulnerable dependency axios 1.7.7: GHSA-pmv8-rq9r-6j72", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-pmv8-rq9r-6j72"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-pmv8-rq9r-6j72.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmv8-rq9r-6j72\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7bfbc1ca878aea4", "name": "Vulnerable dependency axios 1.7.7: GHSA-pmwg-cvhr-8vh7", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-pmwg-cvhr-8vh7"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-pmwg-cvhr-8vh7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pmwg-cvhr-8vh7\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-84ca25c48fc112fd", "name": "Vulnerable dependency axios 1.7.7: GHSA-q8qp-cvcw-x6jj", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-q8qp-cvcw-x6jj"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-q8qp-cvcw-x6jj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q8qp-cvcw-x6jj\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7084251378c2e1e", "name": "Vulnerable dependency axios 1.7.7: GHSA-vf2m-468p-8v99", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-vf2m-468p-8v99"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-vf2m-468p-8v99.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vf2m-468p-8v99\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be182af332d1fcf6", "name": "Vulnerable dependency axios 1.7.7: GHSA-w9j2-pvgh-6h63", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-w9j2-pvgh-6h63"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-w9j2-pvgh-6h63.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w9j2-pvgh-6h63\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0da1c6fd4186c3fb", "name": "Vulnerable dependency axios 1.7.7: GHSA-xhjh-pmcv-23jw", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-xhjh-pmcv-23jw"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-xhjh-pmcv-23jw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xhjh-pmcv-23jw\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06975a17c370589c", "name": "Vulnerable dependency axios 1.7.7: GHSA-xx6v-rp6x-q39c", "shortDescription": {"text": "Vulnerable dependency axios 1.7.7: GHSA-xx6v-rp6x-q39c"}, "fullDescription": {"text": "OSV.dev reports `axios` at version `1.7.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-xx6v-rp6x-q39c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xx6v-rp6x-q39c\nFix: upgrade `axios` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5dcc3a91d1cff1e2", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-67pg-wm7f-q7fj", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-67pg-wm7f-q7fj"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-67pg-wm7f-q7fj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-67pg-wm7f-q7fj\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea4a12e6279eb6c4", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-7x6v-j9x4-qf24", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-7x6v-j9x4-qf24"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-7x6v-j9x4-qf24.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7x6v-j9x4-qf24\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-da1d91e13500853c", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-8mvj-3j78-4qmw", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-8mvj-3j78-4qmw"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-8mvj-3j78-4qmw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8mvj-3j78-4qmw\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3170a41428a17954", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-95fx-jjr5-f39c", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-95fx-jjr5-f39c"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-95fx-jjr5-f39c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-95fx-jjr5-f39c\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e34109792eddb5b", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-9vjf-qc39-jprp", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-9vjf-qc39-jprp"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-9vjf-qc39-jprp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9vjf-qc39-jprp\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-990e10ca5174530c", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-cjw8-79x6-5cj4", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-cjw8-79x6-5cj4"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-cjw8-79x6-5cj4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cjw8-79x6-5cj4\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96fb5cf3a797192b", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-f8cm-6447-x5h2", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-f8cm-6447-x5h2"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-f8cm-6447-x5h2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f8cm-6447-x5h2\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a1e795b7750522bd", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-p5xg-68wr-hm3m", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-p5xg-68wr-hm3m"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-p5xg-68wr-hm3m.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p5xg-68wr-hm3m\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8c10475db41931a", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-pqxr-3g65-p328", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-pqxr-3g65-p328"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-pqxr-3g65-p328.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pqxr-3g65-p328\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0fd4a5b5101af76f", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-vm32-vv63-w422", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-vm32-vv63-w422"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-vm32-vv63-w422.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vm32-vv63-w422\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7041d040cfe46ede", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-w532-jxjh-hjhj", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-w532-jxjh-hjhj"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-w532-jxjh-hjhj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w532-jxjh-hjhj\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6689f14fee4e5d7b", "name": "Vulnerable dependency jspdf 2.5.1: GHSA-wfv2-pwc8-crg5", "shortDescription": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-wfv2-pwc8-crg5"}, "fullDescription": {"text": "OSV.dev reports `jspdf` at version `2.5.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-wfv2-pwc8-crg5.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wfv2-pwc8-crg5\nFix: upgrade `jspdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79499490a1814de5", "name": "Vulnerable dependency next 14.2.7: GHSA-36qx-fr4f-26g5", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-36qx-fr4f-26g5"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573).\n\nNext.js has a Middleware / Proxy bypass in Pages Router applications using i18n\n\nAliases: CVE-2026-44573\nAdvisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e659c0349ef5b6a1", "name": "Vulnerable dependency next 14.2.7: GHSA-3g8h-86w9-wvmq", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-3g8h-86w9-wvmq"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3g8h-86w9-wvmq.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5bfbfe936c7c3974", "name": "Vulnerable dependency next 14.2.7: GHSA-3h52-269p-cp9r", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-3h52-269p-cp9r"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3h52-269p-cp9r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3h52-269p-cp9r\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ea0da35c1c32e12", "name": "Vulnerable dependency next 14.2.7: GHSA-3x4c-7xq6-9pq8", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-3x4c-7xq6-9pq8"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3x4c-7xq6-9pq8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25806d1fdbc8c3da", "name": "Vulnerable dependency next 14.2.7: GHSA-4342-x723-ch2f", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-4342-x723-ch2f"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-4342-x723-ch2f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4342-x723-ch2f\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e41d7671dd71133e", "name": "Vulnerable dependency next 14.2.7: GHSA-4633-3j49-mh5q", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-4633-3j49-mh5q"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-4633-3j49-mh5q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b82512f6776a314b", "name": "Vulnerable dependency next 14.2.7: GHSA-4c39-4ccg-62r3", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-4c39-4ccg-62r3"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-4c39-4ccg-62r3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f0fa381a79028d1", "name": "Vulnerable dependency next 14.2.7: GHSA-5j59-xgg2-r9c4", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-5j59-xgg2-r9c4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-5j59-xgg2-r9c4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5j59-xgg2-r9c4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64aa783e7d204f7d", "name": "Vulnerable dependency next 14.2.7: GHSA-68g3-v927-f742", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-68g3-v927-f742"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-68g3-v927-f742.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a17ec46d85bed992", "name": "Vulnerable dependency next 14.2.7: GHSA-7gfc-8cq8-jh5f", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-7gfc-8cq8-jh5f"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-7gfc-8cq8-jh5f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7gfc-8cq8-jh5f\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5fda7da0b26ca391", "name": "Vulnerable dependency next 14.2.7: GHSA-7m27-7ghc-44w9", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-7m27-7ghc-44w9"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-7m27-7ghc-44w9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7m27-7ghc-44w9\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afd82f8c74578b34", "name": "Vulnerable dependency next 14.2.7: GHSA-89xv-2m56-2m9x", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-89xv-2m56-2m9x"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-89xv-2m56-2m9x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f85ac5fd8e906839", "name": "Vulnerable dependency next 14.2.7: GHSA-8h8q-6873-q5fj", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-8h8q-6873-q5fj"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-8h8q-6873-q5fj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7eb54547926609f3", "name": "Vulnerable dependency next 14.2.7: GHSA-955p-x3mx-jcvp", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-955p-x3mx-jcvp"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-955p-x3mx-jcvp.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99e67fe00ec1ebb2", "name": "Vulnerable dependency next 14.2.7: GHSA-9g9p-9gw9-jx7f", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-9g9p-9gw9-jx7f"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-9g9p-9gw9-jx7f.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9g9p-9gw9-jx7f\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-686173d2b51b9625", "name": "Vulnerable dependency next 14.2.7: GHSA-c4j6-fc7j-m34r", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-c4j6-fc7j-m34r"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-c4j6-fc7j-m34r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-602d8c6f7780407f", "name": "Vulnerable dependency next 14.2.7: GHSA-f82v-jwr5-mffw", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-f82v-jwr5-mffw"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-f82v-jwr5-mffw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f82v-jwr5-mffw\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09c8e11b0531df00", "name": "Vulnerable dependency next 14.2.7: GHSA-ffhc-5mcf-pf4q", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-ffhc-5mcf-pf4q"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-ffhc-5mcf-pf4q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15681468bc4f8c12", "name": "Vulnerable dependency next 14.2.7: GHSA-g5qg-72qw-gw5v", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-g5qg-72qw-gw5v"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-g5qg-72qw-gw5v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g5qg-72qw-gw5v\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca83744770683ea4", "name": "Vulnerable dependency next 14.2.7: GHSA-ggv3-7p47-pfv8", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-ggv3-7p47-pfv8"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-ggv3-7p47-pfv8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb09b24120f2da21", "name": "Vulnerable dependency next 14.2.7: GHSA-gp8f-8m3g-qvj9", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-gp8f-8m3g-qvj9"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-gp8f-8m3g-qvj9.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gp8f-8m3g-qvj9\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9179a49dcfdaa902", "name": "Vulnerable dependency next 14.2.7: GHSA-gx5p-jg67-6x7h", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-gx5p-jg67-6x7h"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-gx5p-jg67-6x7h.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34620eb222b5c75f", "name": "Vulnerable dependency next 14.2.7: GHSA-h25m-26qc-wcjf", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-h25m-26qc-wcjf"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-h25m-26qc-wcjf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h25m-26qc-wcjf\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a432f53ffccf93f1", "name": "Vulnerable dependency next 14.2.7: GHSA-h64f-5h5j-jqjh", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-h64f-5h5j-jqjh"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-h64f-5h5j-jqjh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23ae7df97d2ef517", "name": "Vulnerable dependency next 14.2.7: GHSA-m99w-x7hq-7vfj", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-m99w-x7hq-7vfj"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-m99w-x7hq-7vfj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ef673202c88bc1b8", "name": "Vulnerable dependency next 14.2.7: GHSA-mwv6-3258-q52c", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-mwv6-3258-q52c"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-mwv6-3258-q52c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mwv6-3258-q52c\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6dd5fa220d1938d0", "name": "Vulnerable dependency next 14.2.7: GHSA-p9j2-gv94-2wf4", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-p9j2-gv94-2wf4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-p9j2-gv94-2wf4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1edf84942d84a1b9", "name": "Vulnerable dependency next 14.2.7: GHSA-q4gf-8mx6-v5v3", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-q4gf-8mx6-v5v3"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-q4gf-8mx6-v5v3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34bcecfd16b16d54", "name": "Vulnerable dependency next 14.2.7: GHSA-qpjv-v59x-3qc4", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-qpjv-v59x-3qc4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-qpjv-v59x-3qc4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qpjv-v59x-3qc4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3336f359ec3598eb", "name": "Vulnerable dependency next 14.2.7: GHSA-vfv6-92ff-j949", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-vfv6-92ff-j949"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-vfv6-92ff-j949.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64a6f28ef34d0498", "name": "Vulnerable dependency next 14.2.7: GHSA-wfc6-r584-vfw7", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-wfc6-r584-vfw7"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-wfc6-r584-vfw7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f91ae3dfaaa7120", "name": "Vulnerable dependency next 14.2.7: GHSA-xv57-4mr9-wg8v", "shortDescription": {"text": "Vulnerable dependency next 14.2.7: GHSA-xv57-4mr9-wg8v"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-xv57-4mr9-wg8v.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xv57-4mr9-wg8v\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5dae308a82eb655c", "name": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.31` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623).\n\nPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments\n\nAliases: CVE-2026-45623\nAdvisory: https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-50406d01446af25a", "name": "Vulnerable dependency postcss 8.4.31: GHSA-fxqj-rqcc-2cmp", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-fxqj-rqcc-2cmp"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.31` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-fxqj-rqcc-2cmp (aka CVE-2026-69153).\n\nPostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\n\nAliases: CVE-2026-69153\nAdvisory: https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5ddea41805bb281", "name": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.31` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305).\n\nPostCSS has XSS via Unescaped </style> in its CSS Stringify Output\n\nAliases: CVE-2026-41305\nAdvisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f0e961cac6cbe00", "name": "Vulnerable dependency postcss 8.4.31: GHSA-r28c-9q8g-f849", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-r28c-9q8g-f849"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.31` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-r28c-9q8g-f849 (aka CVE-2026-73646).\n\nPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure\n\nAliases: CVE-2026-73646\nAdvisory: https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a1f693323807853d", "name": "Vulnerable dependency postcss 8.4.44: GHSA-6g55-p6wh-862q", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.44: GHSA-6g55-p6wh-862q"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.44` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623).\n\nPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments\n\nAliases: CVE-2026-45623\nAdvisory: https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-53ca214e94638dd3", "name": "Vulnerable dependency postcss 8.4.44: GHSA-fxqj-rqcc-2cmp", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.44: GHSA-fxqj-rqcc-2cmp"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.44` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-fxqj-rqcc-2cmp (aka CVE-2026-69153).\n\nPostCSS: incomplete fix of GHSA-6g55-p6wh-862q \u2014 attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset\n\nAliases: CVE-2026-69153\nAdvisory: https://osv.dev/vulnerability/GHSA-fxqj-rqcc-2cmp\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b2d0bbd1b40532e4", "name": "Vulnerable dependency postcss 8.4.44: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.44: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.44` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-qx2v-qp2m-jg93 (aka CVE-2026-41305).\n\nPostCSS has XSS via Unescaped </style> in its CSS Stringify Output\n\nAliases: CVE-2026-41305\nAdvisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1e15d3773462289e", "name": "Vulnerable dependency postcss 8.4.44: GHSA-r28c-9q8g-f849", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.44: GHSA-r28c-9q8g-f849"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.44` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-r28c-9q8g-f849 (aka CVE-2026-73646).\n\nPostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure\n\nAliases: CVE-2026-73646\nAdvisory: https://osv.dev/vulnerability/GHSA-r28c-9q8g-f849\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5d7f7f426c629fc7", "name": "Vulnerable dependency cloudinary 1.41.3: GHSA-g4mf-96x5-5m2c", "shortDescription": {"text": "Vulnerable dependency cloudinary 1.41.3: GHSA-g4mf-96x5-5m2c"}, "fullDescription": {"text": "OSV.dev reports `cloudinary` at version `1.41.3` (resolved in `package-lock.json`) is affected by GHSA-g4mf-96x5-5m2c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g4mf-96x5-5m2c\nFix: upgrade `cloudinary` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b57be7daa8fa3d7", "name": "Vulnerable dependency joi 17.13.3: GHSA-q7cg-457f-vx79", "shortDescription": {"text": "Vulnerable dependency joi 17.13.3: GHSA-q7cg-457f-vx79"}, "fullDescription": {"text": "OSV.dev reports `joi` at version `17.13.3` (resolved in `package-lock.json`) is affected by GHSA-q7cg-457f-vx79.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q7cg-457f-vx79\nFix: upgrade `joi` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-867bb8245288a5ea", "name": "Vulnerable dependency mongoose 8.5.1: GHSA-664h-wqgq-64gw", "shortDescription": {"text": "Vulnerable dependency mongoose 8.5.1: GHSA-664h-wqgq-64gw"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `8.5.1` (resolved in `package-lock.json`) is affected by GHSA-664h-wqgq-64gw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-664h-wqgq-64gw\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f465b808f16b0c5f", "name": "Vulnerable dependency mongoose 8.5.1: GHSA-m7xq-9374-9rvx", "shortDescription": {"text": "Vulnerable dependency mongoose 8.5.1: GHSA-m7xq-9374-9rvx"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `8.5.1` (resolved in `package-lock.json`) is affected by GHSA-m7xq-9374-9rvx.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m7xq-9374-9rvx\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6abe1f61aeae15c", "name": "Vulnerable dependency mongoose 8.5.1: GHSA-vg7j-7cwx-8wgw", "shortDescription": {"text": "Vulnerable dependency mongoose 8.5.1: GHSA-vg7j-7cwx-8wgw"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `8.5.1` (resolved in `package-lock.json`) is affected by GHSA-vg7j-7cwx-8wgw.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vg7j-7cwx-8wgw\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8562a2ac4f4db1bc", "name": "Vulnerable dependency mongoose 8.5.1: GHSA-wpg9-53fq-2r8h", "shortDescription": {"text": "Vulnerable dependency mongoose 8.5.1: GHSA-wpg9-53fq-2r8h"}, "fullDescription": {"text": "OSV.dev reports `mongoose` at version `8.5.1` (resolved in `package-lock.json`) is affected by GHSA-wpg9-53fq-2r8h.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wpg9-53fq-2r8h\nFix: upgrade `mongoose` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-102869b19796ed70", "name": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-44fp-w29j-9vj5", "shortDescription": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-44fp-w29j-9vj5"}, "fullDescription": {"text": "OSV.dev reports `multer` at version `1.4.5-lts.1` (declared in `package.json`) is affected by GHSA-44fp-w29j-9vj5.\nNote: `1.4.5-lts.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-44fp-w29j-9vj5\nFix: upgrade `multer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-2294d1b2b24d7c7d", "name": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-4pg4-qvpc-4q3h", "shortDescription": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-4pg4-qvpc-4q3h"}, "fullDescription": {"text": "OSV.dev reports `multer` at version `1.4.5-lts.1` (declared in `package.json`) is affected by GHSA-4pg4-qvpc-4q3h.\nNote: `1.4.5-lts.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4pg4-qvpc-4q3h\nFix: upgrade `multer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-61e311c3723dcfb0", "name": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-5528-5vmv-3xc2", "shortDescription": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-5528-5vmv-3xc2"}, "fullDescription": {"text": "OSV.dev reports `multer` at version `1.4.5-lts.1` (declared in `package.json`) is affected by GHSA-5528-5vmv-3xc2.\nNote: `1.4.5-lts.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5528-5vmv-3xc2\nFix: upgrade `multer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-c02e8def6d9d9844", "name": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-72gw-mp4g-v24j", "shortDescription": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-72gw-mp4g-v24j"}, "fullDescription": {"text": "OSV.dev reports `multer` at version `1.4.5-lts.1` (declared in `package.json`) is affected by GHSA-72gw-mp4g-v24j.\nNote: `1.4.5-lts.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-72gw-mp4g-v24j\nFix: upgrade `multer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-a15a8515f2cc7a45", "name": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-fjgf-rc76-4x9p", "shortDescription": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-fjgf-rc76-4x9p"}, "fullDescription": {"text": "OSV.dev reports `multer` at version `1.4.5-lts.1` (declared in `package.json`) is affected by GHSA-fjgf-rc76-4x9p.\nNote: `1.4.5-lts.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fjgf-rc76-4x9p\nFix: upgrade `multer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-deab947f89fd5fb9", "name": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-g5hg-p3ph-g8qg", "shortDescription": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-g5hg-p3ph-g8qg"}, "fullDescription": {"text": "OSV.dev reports `multer` at version `1.4.5-lts.1` (declared in `package.json`) is affected by GHSA-g5hg-p3ph-g8qg.\nNote: `1.4.5-lts.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g5hg-p3ph-g8qg\nFix: upgrade `multer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-26ce219cad8c2ba0", "name": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-v52c-386h-88mc", "shortDescription": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-v52c-386h-88mc"}, "fullDescription": {"text": "OSV.dev reports `multer` at version `1.4.5-lts.1` (declared in `package.json`) is affected by GHSA-v52c-386h-88mc.\nNote: `1.4.5-lts.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v52c-386h-88mc\nFix: upgrade `multer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-631c58b7e5f8b225", "name": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-xf7r-hgr6-v32p", "shortDescription": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-xf7r-hgr6-v32p"}, "fullDescription": {"text": "OSV.dev reports `multer` at version `1.4.5-lts.1` (declared in `package.json`) is affected by GHSA-xf7r-hgr6-v32p.\nNote: `1.4.5-lts.1` is the declared floor of a range \u2014 the installed version may be newer.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xf7r-hgr6-v32p\nFix: upgrade `multer` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-d3cd43bfa226ba01", "name": "Vulnerable dependency @babel/runtime 7.25.6: GHSA-968p-4wvh-cqc8", "shortDescription": {"text": "Vulnerable dependency @babel/runtime 7.25.6: GHSA-968p-4wvh-cqc8"}, "fullDescription": {"text": "OSV.dev reports `@babel/runtime` at version `7.25.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-968p-4wvh-cqc8.\nNote: `@babel/runtime` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-968p-4wvh-cqc8\nFix: upgrade `@babel/runtime` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cfb50e08f6114ceb", "name": "Vulnerable dependency brace-expansion 2.0.1: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-7a9669c8f0f794de", "name": "Vulnerable dependency brace-expansion 2.0.1: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Zero-step sequence causes process hang and memory exhaustion\n\nAliases: CVE-2026-33750\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f7215d9e671edcf3", "name": "Vulnerable dependency brace-expansion 2.0.1: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-7d71b8c76509b931", "name": "Vulnerable dependency brace-expansion 2.0.1: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9c044b47fbb103a9", "name": "Vulnerable dependency brace-expansion 2.0.1: GHSA-v6h2-p8h4-qcjw", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-v6h2-p8h4-qcjw"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.0.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-v6h2-p8h4-qcjw (aka CVE-2025-5889).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion Regular Expression Denial of Service vulnerability\n\nAliases: CVE-2025-5889\nAdvisory: https://osv.dev/vulnerability/GHSA-v6h2-p8h4-qcjw\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-462613a727801d11", "name": "Vulnerable dependency minimatch 9.0.3: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.3` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-8c303e3e916143cd", "name": "Vulnerable dependency minimatch 9.0.3: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.3` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0eb66f1e3da6651b", "name": "Vulnerable dependency minimatch 9.0.3: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.3` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-0245596c39484152", "name": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6", "shortDescription": {"text": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6"}, "fullDescription": {"text": "OSV.dev reports `ajv` at version `6.12.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-2g4f-4pwh-qvx6 (aka CVE-2025-69873).\nNote: `ajv` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\najv has ReDoS when using `$data` option\n\nAliases: CVE-2025-69873\nAdvisory: https://osv.dev/vulnerability/GHSA-2g4f-4pwh-qvx6\nFix: upgrade `ajv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c62e5b3a457b7ddf", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d9a572bc49686ddc", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-f886-m6hf-6m8v", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-f886-m6hf-6m8v"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-f886-m6hf-6m8v (aka CVE-2026-33750).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Zero-step sequence causes process hang and memory exhaustion\n\nAliases: CVE-2026-33750\nAdvisory: https://osv.dev/vulnerability/GHSA-f886-m6hf-6m8v\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-41faa13d2e0a8986", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-475f14e8c3f316a0", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-fe74c88c3455ba08", "name": "Vulnerable dependency brace-expansion 1.1.11: GHSA-v6h2-p8h4-qcjw", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-v6h2-p8h4-qcjw"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-v6h2-p8h4-qcjw (aka CVE-2025-5889).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion Regular Expression Denial of Service vulnerability\n\nAliases: CVE-2025-5889\nAdvisory: https://osv.dev/vulnerability/GHSA-v6h2-p8h4-qcjw\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-ae90ab8c6a339eaf", "name": "Vulnerable dependency canvg 3.0.10: GHSA-v2mw-5mch-w8c5", "shortDescription": {"text": "Vulnerable dependency canvg 3.0.10: GHSA-v2mw-5mch-w8c5"}, "fullDescription": {"text": "OSV.dev reports `canvg` at version `3.0.10` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-v2mw-5mch-w8c5.\nNote: `canvg` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `canvg` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v2mw-5mch-w8c5\nFix: upgrade `canvg` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9916f43b43a497b6", "name": "Vulnerable dependency cross-spawn 7.0.3: GHSA-3xgq-45jj-v275", "shortDescription": {"text": "Vulnerable dependency cross-spawn 7.0.3: GHSA-3xgq-45jj-v275"}, "fullDescription": {"text": "OSV.dev reports `cross-spawn` at version `7.0.3` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3xgq-45jj-v275.\nNote: `cross-spawn` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3xgq-45jj-v275\nFix: upgrade `cross-spawn` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-446ab6cd048b63bb", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-39q2-94rc-95cp", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-39q2-94rc-95cp"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-39q2-94rc-95cp (aka CVE-2026-65903).\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nDOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation\n\nAliases: CVE-2026-65903\nAdvisory: https://osv.dev/vulnerability/GHSA-39q2-94rc-95cp\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6a57f684746a1453", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-55q2-fjhq-7xh7", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-55q2-fjhq-7xh7"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-55q2-fjhq-7xh7.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-55q2-fjhq-7xh7\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ccb472257001cc65", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-76mc-f452-cxcm", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-76mc-f452-cxcm"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-76mc-f452-cxcm.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-76mc-f452-cxcm\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1637897f0699a9fa", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-c2j3-45gr-mqc4", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-c2j3-45gr-mqc4"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-c2j3-45gr-mqc4.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c2j3-45gr-mqc4\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-24b9fd4648a7eed5", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-cj63-jhhr-wcxv", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-cj63-jhhr-wcxv"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-cj63-jhhr-wcxv.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cj63-jhhr-wcxv\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9bedfaa3aade164f", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-cjmm-f4jc-qw8r", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-cjmm-f4jc-qw8r"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-cjmm-f4jc-qw8r.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cjmm-f4jc-qw8r\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f5220835b30f7c34", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-cmwh-pvxp-8882", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-cmwh-pvxp-8882"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-cmwh-pvxp-8882.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cmwh-pvxp-8882\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-57fc1ec3506df6c5", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-crv5-9vww-q3g8", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-crv5-9vww-q3g8"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-crv5-9vww-q3g8.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-crv5-9vww-q3g8\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-80fe265cad7c7ed4", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-h7mw-gpvr-xq4m", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-h7mw-gpvr-xq4m"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-h7mw-gpvr-xq4m.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h7mw-gpvr-xq4m\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f8db39f1211223fa", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-h8r8-wccr-v5f2", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-h8r8-wccr-v5f2"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-h8r8-wccr-v5f2.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h8r8-wccr-v5f2\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c2665411f1dbcdea", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-hpcv-96wg-7vj8", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-hpcv-96wg-7vj8"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-hpcv-96wg-7vj8.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hpcv-96wg-7vj8\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e953df4b7d167ece", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-r47g-fvhr-h676", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-r47g-fvhr-h676"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-r47g-fvhr-h676.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r47g-fvhr-h676\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7d48b27025086033", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-rp9w-3fw7-7cwq", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-rp9w-3fw7-7cwq"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-rp9w-3fw7-7cwq.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rp9w-3fw7-7cwq\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-38aeb7aa9b614dfa", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-v2wj-7wpq-c8vv", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-v2wj-7wpq-c8vv"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-v2wj-7wpq-c8vv.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v2wj-7wpq-c8vv\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-057d5558d3c6a509", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-v8jm-5vwx-cfxm", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-v8jm-5vwx-cfxm"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-v8jm-5vwx-cfxm.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v8jm-5vwx-cfxm\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9948ce7c3914e4a0", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-vhxf-7vqr-mrjg", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-vhxf-7vqr-mrjg"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-vhxf-7vqr-mrjg.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vhxf-7vqr-mrjg\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2a5bdcfbb74b7f18", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-vxr8-fq34-vvx9", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-vxr8-fq34-vvx9"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-vxr8-fq34-vvx9.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vxr8-fq34-vvx9\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0a0f606297ba5d57", "name": "Vulnerable dependency dompurify 2.5.6: GHSA-x4vx-rjvf-j5p4", "shortDescription": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-x4vx-rjvf-j5p4"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `2.5.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-x4vx-rjvf-j5p4.\nNote: `dompurify` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\nNote: `dompurify` is an optional dependency \u2014 installs may legitimately omit it.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x4vx-rjvf-j5p4\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ab7b110465947bc6", "name": "Vulnerable dependency flatted 3.3.1: GHSA-25h7-pfq9-p65f", "shortDescription": {"text": "Vulnerable dependency flatted 3.3.1: GHSA-25h7-pfq9-p65f"}, "fullDescription": {"text": "OSV.dev reports `flatted` at version `3.3.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-25h7-pfq9-p65f (aka CVE-2026-32141).\nNote: `flatted` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nflatted vulnerable to unbounded recursion DoS in parse() revive phase\n\nAliases: CVE-2026-32141\nAdvisory: https://osv.dev/vulnerability/GHSA-25h7-pfq9-p65f\nFix: upgrade `flatted` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-e18211797a41d2ef", "name": "Vulnerable dependency flatted 3.3.1: GHSA-rf6f-7fwh-wjgh", "shortDescription": {"text": "Vulnerable dependency flatted 3.3.1: GHSA-rf6f-7fwh-wjgh"}, "fullDescription": {"text": "OSV.dev reports `flatted` at version `3.3.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-rf6f-7fwh-wjgh.\nNote: `flatted` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rf6f-7fwh-wjgh\nFix: upgrade `flatted` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-07889a4d5fea46db", "name": "Vulnerable dependency follow-redirects 1.15.6: GHSA-r4q5-vmmm-2653", "shortDescription": {"text": "Vulnerable dependency follow-redirects 1.15.6: GHSA-r4q5-vmmm-2653"}, "fullDescription": {"text": "OSV.dev reports `follow-redirects` at version `1.15.6` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-r4q5-vmmm-2653.\nNote: `follow-redirects` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r4q5-vmmm-2653\nFix: upgrade `follow-redirects` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7cbfb3bff42a5275", "name": "Vulnerable dependency form-data 4.0.0: GHSA-fjxv-7rqg-78g4", "shortDescription": {"text": "Vulnerable dependency form-data 4.0.0: GHSA-fjxv-7rqg-78g4"}, "fullDescription": {"text": "OSV.dev reports `form-data` at version `4.0.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-fjxv-7rqg-78g4.\nNote: `form-data` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fjxv-7rqg-78g4\nFix: upgrade `form-data` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-39614e04d1cc86f5", "name": "Vulnerable dependency form-data 4.0.0: GHSA-hmw2-7cc7-3qxx", "shortDescription": {"text": "Vulnerable dependency form-data 4.0.0: GHSA-hmw2-7cc7-3qxx"}, "fullDescription": {"text": "OSV.dev reports `form-data` at version `4.0.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-hmw2-7cc7-3qxx.\nNote: `form-data` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hmw2-7cc7-3qxx\nFix: upgrade `form-data` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-07a3009dc937f2ad", "name": "Vulnerable dependency glob 10.3.10: GHSA-5j98-mcp5-4vw2", "shortDescription": {"text": "Vulnerable dependency glob 10.3.10: GHSA-5j98-mcp5-4vw2"}, "fullDescription": {"text": "OSV.dev reports `glob` at version `10.3.10` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-5j98-mcp5-4vw2.\nNote: `glob` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5j98-mcp5-4vw2\nFix: upgrade `glob` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-243d6ee3f8b07510", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-db78169e4f0fccc6", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a5ae394a1078acbc", "name": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `9.0.5` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-6bfa9514f45d7c73", "name": "Vulnerable dependency js-yaml 4.1.0: GHSA-52cp-r559-cp3m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.0: GHSA-52cp-r559-cp3m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-52cp-r559-cp3m.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-52cp-r559-cp3m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6484477d11d32ccd", "name": "Vulnerable dependency js-yaml 4.1.0: GHSA-5p4m-2wfm-xmqj", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.0: GHSA-5p4m-2wfm-xmqj"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-5p4m-2wfm-xmqj.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5p4m-2wfm-xmqj\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5f7effafe3df9db1", "name": "Vulnerable dependency js-yaml 4.1.0: GHSA-h67p-54hq-rp68", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.0: GHSA-h67p-54hq-rp68"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-h67p-54hq-rp68.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h67p-54hq-rp68\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-055ee3b1c2364af4", "name": "Vulnerable dependency js-yaml 4.1.0: GHSA-mh29-5h37-fv8m", "shortDescription": {"text": "Vulnerable dependency js-yaml 4.1.0: GHSA-mh29-5h37-fv8m"}, "fullDescription": {"text": "OSV.dev reports `js-yaml` at version `4.1.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-mh29-5h37-fv8m.\nNote: `js-yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mh29-5h37-fv8m\nFix: upgrade `js-yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9d68766d336b2a98", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-23c5-xmqv-rm74 (aka CVE-2026-27904).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions\n\nAliases: CVE-2026-27904\nAdvisory: https://osv.dev/vulnerability/GHSA-23c5-xmqv-rm74\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-ce7214b45913031d", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3ppc-4f35-3m26 (aka CVE-2026-26996).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern\n\nAliases: CVE-2026-26996\nAdvisory: https://osv.dev/vulnerability/GHSA-3ppc-4f35-3m26\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-72bbbc80d0729d1c", "name": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj", "shortDescription": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "fullDescription": {"text": "OSV.dev reports `minimatch` at version `3.1.2` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-7r86-cg39-jmmj (aka CVE-2026-27903).\nNote: `minimatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments\n\nAliases: CVE-2026-27903\nAdvisory: https://osv.dev/vulnerability/GHSA-7r86-cg39-jmmj\nFix: upgrade `minimatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d9cf632591f2e42c", "name": "Vulnerable dependency nanoid 3.3.7: GHSA-28wg-ghj8-5hjv", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.7: GHSA-28wg-ghj8-5hjv"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-28wg-ghj8-5hjv (aka CVE-2026-67214).\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnanoid: non-secure generators can loop indefinitely with negative size\n\nAliases: CVE-2026-67214\nAdvisory: https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9761099573d9fbe0", "name": "Vulnerable dependency nanoid 3.3.7: GHSA-2v37-7h3g-55p8", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.7: GHSA-2v37-7h3g-55p8"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-2v37-7h3g-55p8 (aka CVE-2026-67213).\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnanoid: custom generators can loop indefinitely when size is zero\n\nAliases: CVE-2026-67213\nAdvisory: https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-373007abd0c4aeea", "name": "Vulnerable dependency nanoid 3.3.7: GHSA-mwcw-c2x4-8c55", "shortDescription": {"text": "Vulnerable dependency nanoid 3.3.7: GHSA-mwcw-c2x4-8c55"}, "fullDescription": {"text": "OSV.dev reports `nanoid` at version `3.3.7` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-mwcw-c2x4-8c55.\nNote: `nanoid` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mwcw-c2x4-8c55\nFix: upgrade `nanoid` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8beeab578b56d588", "name": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p", "shortDescription": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `2.3.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-3v7f-55p6-f55p.\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3v7f-55p6-f55p\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-bb78282c0db1956c", "name": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj", "shortDescription": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj"}, "fullDescription": {"text": "OSV.dev reports `picomatch` at version `2.3.1` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-c2c7-rcm5-vvqj.\nNote: `picomatch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c2c7-rcm5-vvqj\nFix: upgrade `picomatch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-df04a6615e09ab21", "name": "Vulnerable dependency qs 6.13.0: GHSA-6rw7-vpxm-498p", "shortDescription": {"text": "Vulnerable dependency qs 6.13.0: GHSA-6rw7-vpxm-498p"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.13.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-6rw7-vpxm-498p.\nNote: `qs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6rw7-vpxm-498p\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-04c294f334662903", "name": "Vulnerable dependency qs 6.13.0: GHSA-q8mj-m7cp-5q26", "shortDescription": {"text": "Vulnerable dependency qs 6.13.0: GHSA-q8mj-m7cp-5q26"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.13.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-q8mj-m7cp-5q26.\nNote: `qs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q8mj-m7cp-5q26\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a346e898db1e09e7", "name": "Vulnerable dependency qs 6.13.0: GHSA-w7fw-mjwx-w883", "shortDescription": {"text": "Vulnerable dependency qs 6.13.0: GHSA-w7fw-mjwx-w883"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.13.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-w7fw-mjwx-w883.\nNote: `qs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w7fw-mjwx-w883\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-451d64ec952d89b2", "name": "Vulnerable dependency yaml 2.5.0: GHSA-48c2-rrv3-qjmp", "shortDescription": {"text": "Vulnerable dependency yaml 2.5.0: GHSA-48c2-rrv3-qjmp"}, "fullDescription": {"text": "OSV.dev reports `yaml` at version `2.5.0` (resolved in `museum-ticket-booking/package-lock.json`) is affected by GHSA-48c2-rrv3-qjmp.\nNote: `yaml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-48c2-rrv3-qjmp\nFix: upgrade `yaml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-181d156d0375b7a4", "name": "Dependency @stripe/react-stripe-js is two or more major versions behind", "shortDescription": {"text": "Dependency @stripe/react-stripe-js is two or more major versions behind"}, "fullDescription": {"text": "`@stripe/react-stripe-js` is pinned at `2.8.0` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `6.8.2` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@stripe/react-stripe-js` to `6.8.2`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-96f27d3d1f3d77ff", "name": "Dependency @stripe/stripe-js is two or more major versions behind", "shortDescription": {"text": "Dependency @stripe/stripe-js is two or more major versions behind"}, "fullDescription": {"text": "`@stripe/stripe-js` is pinned at `4.4.0` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `9.14.0` \u2014 5 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@stripe/stripe-js` to `9.14.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ec568823001aa1c3", "name": "Dependency cloudinary is a major version behind", "shortDescription": {"text": "Dependency cloudinary is a major version behind"}, "fullDescription": {"text": "`cloudinary` is pinned at `1.41.3` in `package.json` while the latest release on the npm registry is `2.11.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `cloudinary` to `2.11.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-f37ffe69d5d80b32", "name": "Dependency dotenv is a major version behind", "shortDescription": {"text": "Dependency dotenv is a major version behind"}, "fullDescription": {"text": "`dotenv` is pinned at `16.4.5` in `package.json` while the latest release on the npm registry is `17.4.2` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `dotenv` to `17.4.2`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-87654ff002627905", "name": "Dependency ejs is two or more major versions behind", "shortDescription": {"text": "Dependency ejs is two or more major versions behind"}, "fullDescription": {"text": "`ejs` is pinned at `3.1.10` in `package.json` while the latest release on the npm registry is `6.0.1` \u2014 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ejs` to `6.0.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a736687f245203a6", "name": "Dependency express is a major version behind", "shortDescription": {"text": "Dependency express is a major version behind"}, "fullDescription": {"text": "`express` is pinned at `4.19.2` in `package.json` while the latest release on the npm registry is `5.2.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `express` to `5.2.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-53caf8b8056ebdc0", "name": "Dependency joi is a major version behind", "shortDescription": {"text": "Dependency joi is a major version behind"}, "fullDescription": {"text": "`joi` is pinned at `17.13.3` in `package.json` while the latest release on the npm registry is `18.2.5` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `joi` to `18.2.5`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-8195bc4eb8c3a74a", "name": "Dependency jspdf-autotable is two or more major versions behind", "shortDescription": {"text": "Dependency jspdf-autotable is two or more major versions behind"}, "fullDescription": {"text": "`jspdf-autotable` is pinned at `3.8.3` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `5.0.8` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `jspdf-autotable` to `5.0.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7424ac90f13f2389", "name": "Dependency jspdf is two or more major versions behind", "shortDescription": {"text": "Dependency jspdf is two or more major versions behind"}, "fullDescription": {"text": "`jspdf` is pinned at `2.5.1` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `4.2.1` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `jspdf` to `4.2.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-324de97815c2f50a", "name": "Dependency lucide-react is a major version behind", "shortDescription": {"text": "Dependency lucide-react is a major version behind"}, "fullDescription": {"text": "`lucide-react` is pinned at `0.438.0` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `1.37.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `lucide-react` to `1.37.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-2f580680c4c6b928", "name": "Dependency mongodb is a major version behind", "shortDescription": {"text": "Dependency mongodb is a major version behind"}, "fullDescription": {"text": "`mongodb` is pinned at `6.8.0` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `7.6.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `mongodb` to `7.6.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-d851b24da2bb7be0", "name": "Dependency mongoose is a major version behind", "shortDescription": {"text": "Dependency mongoose is a major version behind"}, "fullDescription": {"text": "`mongoose` is pinned at `8.5.1` in `package.json` while the latest release on the npm registry is `9.9.4` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `mongoose` to `9.9.4`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-d7eb18d8d2c46689", "name": "Dependency multer is a major version behind", "shortDescription": {"text": "Dependency multer is a major version behind"}, "fullDescription": {"text": "`multer` is pinned at `1.4.5-lts.1` in `package.json` while the latest release on the npm registry is `2.3.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `multer` to `2.3.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-3034689d42b37767", "name": "Dependency next is two or more major versions behind", "shortDescription": {"text": "Dependency next is two or more major versions behind"}, "fullDescription": {"text": "`next` is pinned at `14.2.7` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `16.3.3` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `next` to `16.3.3`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8ff7b4172bb532a6", "name": "Dependency passport-local-mongoose is a major version behind", "shortDescription": {"text": "Dependency passport-local-mongoose is a major version behind"}, "fullDescription": {"text": "`passport-local-mongoose` is pinned at `8.0.0` in `package.json` while the latest release on the npm registry is `9.1.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `passport-local-mongoose` to `9.1.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-425140af48ce7862", "name": "Dependency react-calendar is a major version behind", "shortDescription": {"text": "Dependency react-calendar is a major version behind"}, "fullDescription": {"text": "`react-calendar` is pinned at `5.0.0` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `6.0.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-calendar` to `6.0.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-28f38d10489a3e53", "name": "Dependency react-datepicker is two or more major versions behind", "shortDescription": {"text": "Dependency react-datepicker is two or more major versions behind"}, "fullDescription": {"text": "`react-datepicker` is pinned at `7.3.0` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `9.1.0` \u2014 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-datepicker` to `9.1.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6896e30b6d34a783", "name": "Dependency react-dom is a major version behind", "shortDescription": {"text": "Dependency react-dom is a major version behind"}, "fullDescription": {"text": "`react-dom` is pinned at `18` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `19.2.8` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-dom` to `19.2.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-da91b4915daddc39", "name": "Dependency react-time-picker is a major version behind", "shortDescription": {"text": "Dependency react-time-picker is a major version behind"}, "fullDescription": {"text": "`react-time-picker` is pinned at `7.0.0` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `8.1.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react-time-picker` to `8.1.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-5d22782fc4a4600b", "name": "Dependency react is a major version behind", "shortDescription": {"text": "Dependency react is a major version behind"}, "fullDescription": {"text": "`react` is pinned at `18` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `19.2.8` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `react` to `19.2.8`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-862aeb27d80d3ba9", "name": "Dependency stripe is two or more major versions behind", "shortDescription": {"text": "Dependency stripe is two or more major versions behind"}, "fullDescription": {"text": "`stripe` is pinned at `16.9.0` in `museum-ticket-booking/package.json` while the latest release on the npm registry is `22.6.0` \u2014 6 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `stripe` to `22.6.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7f2f781df81936ce", "name": "6 backend endpoints not called by scanned frontend", "shortDescription": {"text": "6 backend endpoints not called by scanned frontend"}, "fullDescription": {"text": "No scanned frontend call matched these backend routes. Sample: USE /listings, USE /listings/:id/reviews, GET /privacy, GET /new, GET /:id/edit, DELETE /:reviewId. This is fine when endpoints serve external clients (mobile apps, SDKs, third-party integrations, server-side webhooks). Otherwise document consumers or remove dead routes."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30820"}, "properties": {"repository": "anki2003ta/Museum", "repoUrl": "https://github.com/anki2003ta/Museum", "branch": "main"}, "results": [{"ruleId": "scanner-ddd434a7f63ff14b", "level": "warning", "message": {"text": "CVE-2025-27789: @babel/runtime 7.25.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "ebd0107f72eb7b34", "scanner": "scanner-primary", "fingerprint": "ddd434a7f63ff14b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27789"]}}, {"ruleId": "scanner-2806eb602175dbf7", "level": "error", "message": {"text": "CVE-2025-27152: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "181091175daefaaa", "scanner": "scanner-primary", "fingerprint": "2806eb602175dbf7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-27152"]}}, {"ruleId": "scanner-daec2e897814a430", "level": "error", "message": {"text": "CVE-2025-58754: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "98b4ab58a73e3893", "scanner": "scanner-primary", "fingerprint": "daec2e897814a430", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-58754"]}}, {"ruleId": "scanner-1e3cbfde6d0beb96", "level": "error", "message": {"text": "CVE-2026-25639: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "85961f164f10641b", "scanner": "scanner-primary", "fingerprint": "1e3cbfde6d0beb96", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25639"]}}, {"ruleId": "scanner-bb392b7533a62a5b", "level": "error", "message": {"text": "CVE-2026-42033: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "ef034dc7202564e7", "scanner": "scanner-primary", "fingerprint": "bb392b7533a62a5b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42033"]}}, {"ruleId": "scanner-41ae795f5bc7ffcc", "level": "error", "message": {"text": "CVE-2026-42035: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "4d5e29c0d82396fe", "scanner": "scanner-primary", "fingerprint": "41ae795f5bc7ffcc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42035"]}}, {"ruleId": "scanner-ee19036ef6dfc1d4", "level": "error", "message": {"text": "CVE-2026-42043: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "f40be2c5c2c21e15", "scanner": "scanner-primary", "fingerprint": "ee19036ef6dfc1d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42043"]}}, {"ruleId": "scanner-289f7e823c939ab9", "level": "error", "message": {"text": "CVE-2026-42264: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "6a01fff67394039b", "scanner": "scanner-primary", "fingerprint": "289f7e823c939ab9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42264"]}}, {"ruleId": "scanner-2993699255d8727d", "level": "error", "message": {"text": "CVE-2026-44486: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "9390dbefd269a22a", "scanner": "scanner-primary", "fingerprint": "2993699255d8727d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44486"]}}, {"ruleId": "scanner-f1deb39789d60392", "level": "error", "message": {"text": "CVE-2026-44487: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "0895177cbea7bcdd", "scanner": "scanner-primary", "fingerprint": "f1deb39789d60392", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44487"]}}, {"ruleId": "scanner-06e1de4b8b12b682", "level": "error", "message": {"text": "CVE-2026-44488: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "de88414e24f24300", "scanner": "scanner-primary", "fingerprint": "06e1de4b8b12b682", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44488"]}}, {"ruleId": "scanner-cb1d8ce833b357b7", "level": "error", "message": {"text": "CVE-2026-44494: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "9de1ed109f2e8d9a", "scanner": "scanner-primary", "fingerprint": "cb1d8ce833b357b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44494"]}}, {"ruleId": "scanner-ae7c0899b79d576f", "level": "error", "message": {"text": "CVE-2026-44495: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "794d7f1f8d438452", "scanner": "scanner-primary", "fingerprint": "ae7c0899b79d576f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44495"]}}, {"ruleId": "scanner-04f2eff0c9a28a82", "level": "error", "message": {"text": "CVE-2026-44496: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "00290d351ea10c86", "scanner": "scanner-primary", "fingerprint": "04f2eff0c9a28a82", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44496"]}}, {"ruleId": "scanner-976ca89ddd1e0721", "level": "warning", "message": {"text": "CVE-2025-62718: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "b7b680f43ff3b80c", "scanner": "scanner-primary", "fingerprint": "976ca89ddd1e0721", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-62718"]}}, {"ruleId": "scanner-c9a6df3924b9fea3", "level": "warning", "message": {"text": "CVE-2026-40175: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "74696ed6cb67ba60", "scanner": "scanner-primary", "fingerprint": "c9a6df3924b9fea3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40175"]}}, {"ruleId": "scanner-f8c041a1f947ce9c", "level": "warning", "message": {"text": "CVE-2026-42034: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "f254f64e1d1f9be0", "scanner": "scanner-primary", "fingerprint": "f8c041a1f947ce9c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42034"]}}, {"ruleId": "scanner-31aae1876ff5301c", "level": "warning", "message": {"text": "CVE-2026-42036: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "d500419cb95c2b52", "scanner": "scanner-primary", "fingerprint": "31aae1876ff5301c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42036"]}}, {"ruleId": "scanner-2ea7b113a712f5e5", "level": "warning", "message": {"text": "CVE-2026-42037: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "2ad9581f0611c712", "scanner": "scanner-primary", "fingerprint": "2ea7b113a712f5e5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42037"]}}, {"ruleId": "scanner-cbf4327160c37ea5", "level": "warning", "message": {"text": "CVE-2026-42038: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "6d8f2890fcf1fcf6", "scanner": "scanner-primary", "fingerprint": "cbf4327160c37ea5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42038"]}}, {"ruleId": "scanner-b473a676ea476326", "level": "warning", "message": {"text": "CVE-2026-42039: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "56625d288043f805", "scanner": "scanner-primary", "fingerprint": "b473a676ea476326", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42039"]}}, {"ruleId": "scanner-f0442e664fb2e2e3", "level": "warning", "message": {"text": "CVE-2026-42041: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "b64ebf70177ce122", "scanner": "scanner-primary", "fingerprint": "f0442e664fb2e2e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42041"]}}, {"ruleId": "scanner-7414d1fbfeb92852", "level": "warning", "message": {"text": "CVE-2026-42042: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "3ee188fab3f3c603", "scanner": "scanner-primary", "fingerprint": "7414d1fbfeb92852", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42042"]}}, {"ruleId": "scanner-d5ed359b2b70ea74", "level": "warning", "message": {"text": "CVE-2026-42044: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "bb62f79c3484fb26", "scanner": "scanner-primary", "fingerprint": "d5ed359b2b70ea74", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42044"]}}, {"ruleId": "scanner-b002648b6ce25f8c", "level": "warning", "message": {"text": "CVE-2026-44490: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "fce6f5c23f3f2207", "scanner": "scanner-primary", "fingerprint": "b002648b6ce25f8c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44490"]}}, {"ruleId": "scanner-7954c2cd2e25b7bb", "level": "warning", "message": {"text": "GHSA-42h9-826w-cgv3: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "d72f8f338ff30aac", "scanner": "scanner-primary", "fingerprint": "7954c2cd2e25b7bb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-42h9-826w-cgv3"]}}, {"ruleId": "scanner-49b0a5ff7aa07074", "level": "warning", "message": {"text": "GHSA-7q8q-rj6j-mhjq: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "aceb807da75f9c45", "scanner": "scanner-primary", "fingerprint": "49b0a5ff7aa07074", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-7q8q-rj6j-mhjq"]}}, {"ruleId": "scanner-05606ca58644a8aa", "level": "warning", "message": {"text": "GHSA-jqh4-m9w3-8hp9: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "af5678e3f309bd94", "scanner": "scanner-primary", "fingerprint": "05606ca58644a8aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-jqh4-m9w3-8hp9"]}}, {"ruleId": "scanner-81194278cedce114", "level": "warning", "message": {"text": "GHSA-mmx7-hfxf-jppx: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "6c31dc3c61e7b743", "scanner": "scanner-primary", "fingerprint": "81194278cedce114", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-mmx7-hfxf-jppx"]}}, {"ruleId": "scanner-e71e0f04cb1c5ed7", "level": "warning", "message": {"text": "GHSA-pmv8-rq9r-6j72: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "70d21c57c4d45439", "scanner": "scanner-primary", "fingerprint": "e71e0f04cb1c5ed7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-pmv8-rq9r-6j72"]}}, {"ruleId": "scanner-38e0114b42b7102e", "level": "note", "message": {"text": "CVE-2026-42040: axios 1.7.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "fccb1fe16ffe6aba", "scanner": "scanner-primary", "fingerprint": "38e0114b42b7102e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42040"]}}, {"ruleId": "scanner-2d6260db9273a047", "level": "error", "message": {"text": "CVE-2025-25977: canvg 3.0.10 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "3383248eb76fd540", "scanner": "scanner-primary", "fingerprint": "2d6260db9273a047", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-25977"]}}, {"ruleId": "scanner-afbbeadc39a42c52", "level": "error", "message": {"text": "CVE-2024-21538: cross-spawn 7.0.3 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "946c5f5c95143690", "scanner": "scanner-primary", "fingerprint": "afbbeadc39a42c52", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-21538"]}}, {"ruleId": "scanner-efb9f28bf8aa3b24", "level": "warning", "message": {"text": "CVE-2025-15599: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "287206e6414e54f1", "scanner": "scanner-primary", "fingerprint": "efb9f28bf8aa3b24", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15599"]}}, {"ruleId": "scanner-15e6be14caca3b31", "level": "warning", "message": {"text": "CVE-2025-26791: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "99839e2037db21cc", "scanner": "scanner-primary", "fingerprint": "15e6be14caca3b31", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-26791"]}}, {"ruleId": "scanner-6da4364923a621d6", "level": "warning", "message": {"text": "CVE-2026-0540: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "8c54246d104c85f9", "scanner": "scanner-primary", "fingerprint": "6da4364923a621d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-0540"]}}, {"ruleId": "scanner-caa1ee508e67e487", "level": "warning", "message": {"text": "CVE-2026-41239: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "f1157d5148e86a3b", "scanner": "scanner-primary", "fingerprint": "caa1ee508e67e487", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41239"]}}, {"ruleId": "scanner-4a350563395c83bc", "level": "warning", "message": {"text": "CVE-2026-41240: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "bed45f483cddb5fe", "scanner": "scanner-primary", "fingerprint": "4a350563395c83bc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41240"]}}, {"ruleId": "scanner-5209e689730d933c", "level": "warning", "message": {"text": "CVE-2026-49458: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "b7a60bb82b5eb4e7", "scanner": "scanner-primary", "fingerprint": "5209e689730d933c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49458"]}}, {"ruleId": "scanner-8f0ee535aa92d36c", "level": "warning", "message": {"text": "CVE-2026-49459: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "7d16381966c1529f", "scanner": "scanner-primary", "fingerprint": "8f0ee535aa92d36c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49459"]}}, {"ruleId": "scanner-43b2f0493a97e16e", "level": "warning", "message": {"text": "CVE-2026-49978: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "9269568fd8f316d9", "scanner": "scanner-primary", "fingerprint": "43b2f0493a97e16e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49978"]}}, {"ruleId": "scanner-b2ebef62549f05c7", "level": "warning", "message": {"text": "CVE-2026-65898: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "a406878e0f9747ba", "scanner": "scanner-primary", "fingerprint": "b2ebef62549f05c7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65898"]}}, {"ruleId": "scanner-4fae70deb9ae485f", "level": "warning", "message": {"text": "CVE-2026-65902: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "0e2026f672129dd8", "scanner": "scanner-primary", "fingerprint": "4fae70deb9ae485f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65902"]}}, {"ruleId": "scanner-1c43e0fe1da2ffee", "level": "warning", "message": {"text": "CVE-2026-65903: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "9a5396b83b2251db", "scanner": "scanner-primary", "fingerprint": "1c43e0fe1da2ffee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65903"]}}, {"ruleId": "scanner-9cc0275f3498c2d6", "level": "warning", "message": {"text": "CVE-2026-65912: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "92bc76d546926686", "scanner": "scanner-primary", "fingerprint": "9cc0275f3498c2d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65912"]}}, {"ruleId": "scanner-b667997500d0cfe9", "level": "warning", "message": {"text": "CVE-2026-65913: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "acf635024f50eceb", "scanner": "scanner-primary", "fingerprint": "b667997500d0cfe9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65913"]}}, {"ruleId": "scanner-1bf4a89809030d8d", "level": "warning", "message": {"text": "CVE-2026-65914: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "a6aa18138e5f5757", "scanner": "scanner-primary", "fingerprint": "1bf4a89809030d8d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65914"]}}, {"ruleId": "scanner-442d672741798a6e", "level": "warning", "message": {"text": "GHSA-55q2-fjhq-7xh7: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "f513405aa5eafee4", "scanner": "scanner-primary", "fingerprint": "442d672741798a6e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-55q2-fjhq-7xh7"]}}, {"ruleId": "scanner-958b8db8e48ba73c", "level": "note", "message": {"text": "CVE-2026-65899: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "bbf102fb1f8cfd98", "scanner": "scanner-primary", "fingerprint": "958b8db8e48ba73c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65899"]}}, {"ruleId": "scanner-ee4be0d4389c6dd5", "level": "note", "message": {"text": "CVE-2026-65901: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "981fd375657b9530", "scanner": "scanner-primary", "fingerprint": "ee4be0d4389c6dd5", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-65901"]}}, {"ruleId": "scanner-a07f0d3be241e8d2", "level": "note", "message": {"text": "GHSA-c2j3-45gr-mqc4: dompurify 2.5.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "4d45365daa67a0ca", "scanner": "scanner-primary", "fingerprint": "a07f0d3be241e8d2", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-c2j3-45gr-mqc4"]}}, {"ruleId": "scanner-9c25efa32588d98d", "level": "warning", "message": {"text": "GHSA-r4q5-vmmm-2653: follow-redirects 1.15.6 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "d8683628fe1f9c43", "scanner": "scanner-primary", "fingerprint": "9c25efa32588d98d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-r4q5-vmmm-2653"]}}, {"ruleId": "scanner-255f42c7cfdcd82a", "level": "error", "message": {"text": "CVE-2025-7783: form-data 4.0.0 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "77e5080912d425ea", "scanner": "scanner-primary", "fingerprint": "255f42c7cfdcd82a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7783"]}}, {"ruleId": "scanner-75562c1127487e9b", "level": "error", "message": {"text": "CVE-2026-12143: form-data 4.0.0 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "6f4a4af64cab55c3", "scanner": "scanner-primary", "fingerprint": "75562c1127487e9b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12143"]}}, {"ruleId": "scanner-b760ba355696fdd1", "level": "error", "message": {"text": "CVE-2025-68428: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "432a3800aa1719a3", "scanner": "scanner-primary", "fingerprint": "b760ba355696fdd1", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-68428"]}}, {"ruleId": "scanner-94c1a343c0cd2e79", "level": "error", "message": {"text": "CVE-2026-31938: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "6933afb93b012011", "scanner": "scanner-primary", "fingerprint": "94c1a343c0cd2e79", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31938"]}}, {"ruleId": "scanner-945aae91ea6b9799", "level": "error", "message": {"text": "CVE-2025-29907: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "a7c90e441d07f262", "scanner": "scanner-primary", "fingerprint": "945aae91ea6b9799", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-29907"]}}, {"ruleId": "scanner-7768f4ad61b217f2", "level": "error", "message": {"text": "CVE-2025-57810: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "288945d6dd1952c5", "scanner": "scanner-primary", "fingerprint": "7768f4ad61b217f2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-57810"]}}, {"ruleId": "scanner-8dbaf0a7ec4ec166", "level": "error", "message": {"text": "CVE-2026-24133: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "f02c7a7e98d7ec04", "scanner": "scanner-primary", "fingerprint": "8dbaf0a7ec4ec166", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24133"]}}, {"ruleId": "scanner-e4b4da7b6197a49c", "level": "error", "message": {"text": "CVE-2026-24737: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "9eb00c6d96405b77", "scanner": "scanner-primary", "fingerprint": "e4b4da7b6197a49c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24737"]}}, {"ruleId": "scanner-34eb8bb06c3fca96", "level": "error", "message": {"text": "CVE-2026-25535: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "75af674279bf6f7e", "scanner": "scanner-primary", "fingerprint": "34eb8bb06c3fca96", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25535"]}}, {"ruleId": "scanner-63bae6f34732257f", "level": "error", "message": {"text": "CVE-2026-25755: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "998b9c6e7c3fbb58", "scanner": "scanner-primary", "fingerprint": "63bae6f34732257f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25755"]}}, {"ruleId": "scanner-2fff7b58af908b86", "level": "error", "message": {"text": "CVE-2026-25940: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "1248ca3096d71724", "scanner": "scanner-primary", "fingerprint": "2fff7b58af908b86", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25940"]}}, {"ruleId": "scanner-237dd1da11fd7bb2", "level": "error", "message": {"text": "CVE-2026-31898: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "e69fc2d472cd7078", "scanner": "scanner-primary", "fingerprint": "237dd1da11fd7bb2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31898"]}}, {"ruleId": "scanner-65812c1d6fcb2449", "level": "warning", "message": {"text": "CVE-2026-24040: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "82daf282e7a7dcd2", "scanner": "scanner-primary", "fingerprint": "65812c1d6fcb2449", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24040"]}}, {"ruleId": "scanner-f09e63bdc3f49f19", "level": "warning", "message": {"text": "CVE-2026-24043: jspdf 2.5.1 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "a4f6914f7b2ae987", "scanner": "scanner-primary", "fingerprint": "f09e63bdc3f49f19", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24043"]}}, {"ruleId": "scanner-612d08c20fc68ace", "level": "error", "message": {"text": "CVE-2026-67213: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "a3fd6c4e2f9ae484", "scanner": "scanner-primary", "fingerprint": "612d08c20fc68ace", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67213"]}}, {"ruleId": "scanner-0e6add6b98a276ce", "level": "error", "message": {"text": "CVE-2026-67214: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "9550d762de3047ca", "scanner": "scanner-primary", "fingerprint": "0e6add6b98a276ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67214"]}}, {"ruleId": "scanner-8e01d33d895127c6", "level": "warning", "message": {"text": "CVE-2024-55565: nanoid 3.3.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "26c8823d5e33db27", "scanner": "scanner-primary", "fingerprint": "8e01d33d895127c6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-55565"]}}, {"ruleId": "scanner-84c21ed653c9d87c", "level": "error", "message": {"text": "CVE-2025-29927: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "ee5191e82ebac22a", "scanner": "scanner-primary", "fingerprint": "84c21ed653c9d87c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-29927"]}}, {"ruleId": "scanner-40aa07e70ff45f59", "level": "error", "message": {"text": "CVE-2024-46982: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "f12166605ed152eb", "scanner": "scanner-primary", "fingerprint": "40aa07e70ff45f59", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-46982"]}}, {"ruleId": "scanner-4f6f565eb7debf0f", "level": "error", "message": {"text": "CVE-2024-51479: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "c0707ae293ce859e", "scanner": "scanner-primary", "fingerprint": "4f6f565eb7debf0f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-51479"]}}, {"ruleId": "scanner-f2e25a5a35ea42b6", "level": "error", "message": {"text": "CVE-2026-44573: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "476d9f7c65995bb5", "scanner": "scanner-primary", "fingerprint": "f2e25a5a35ea42b6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44573"]}}, {"ruleId": "scanner-fdf326cb10bfa2a3", "level": "error", "message": {"text": "CVE-2026-44578: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "b8eee8708a8eb1c2", "scanner": "scanner-primary", "fingerprint": "fdf326cb10bfa2a3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44578"]}}, {"ruleId": "scanner-814c49583e928d99", "level": "error", "message": {"text": "CVE-2026-64641: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "77298f7cdd674a02", "scanner": "scanner-primary", "fingerprint": "814c49583e928d99", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64641"]}}, {"ruleId": "scanner-f55279016778da31", "level": "error", "message": {"text": "CVE-2026-64645: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "dc16e009e7a3a561", "scanner": "scanner-primary", "fingerprint": "f55279016778da31", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64645"]}}, {"ruleId": "scanner-2cb3c4015f5103bf", "level": "error", "message": {"text": "CVE-2026-64649: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "e45c732955e324a6", "scanner": "scanner-primary", "fingerprint": "2cb3c4015f5103bf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64649"]}}, {"ruleId": "scanner-df11d8e0528e4b18", "level": "error", "message": {"text": "GHSA-5j59-xgg2-r9c4: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "a001067e95947a6a", "scanner": "scanner-primary", "fingerprint": "df11d8e0528e4b18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-5j59-xgg2-r9c4"]}}, {"ruleId": "scanner-a02f19665fdff23e", "level": "error", "message": {"text": "GHSA-8h8q-6873-q5fj: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "b39171ba9d63e442", "scanner": "scanner-primary", "fingerprint": "a02f19665fdff23e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8h8q-6873-q5fj"]}}, {"ruleId": "scanner-72c41966489bcb5a", "level": "error", "message": {"text": "GHSA-h25m-26qc-wcjf: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "c2ee8c8fae8f9a43", "scanner": "scanner-primary", "fingerprint": "72c41966489bcb5a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-h25m-26qc-wcjf"]}}, {"ruleId": "scanner-28736588d9e31201", "level": "error", "message": {"text": "GHSA-mwv6-3258-q52c: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "634c629a52a81df2", "scanner": "scanner-primary", "fingerprint": "28736588d9e31201", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-mwv6-3258-q52c"]}}, {"ruleId": "scanner-e15ff84415cf517f", "level": "error", "message": {"text": "GHSA-q4gf-8mx6-v5v3: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "d19d20abc7b87526", "scanner": "scanner-primary", "fingerprint": "e15ff84415cf517f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-q4gf-8mx6-v5v3"]}}, {"ruleId": "scanner-b11827c4abdf20c2", "level": "warning", "message": {"text": "CVE-2024-56332: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "b42a655bfbd34663", "scanner": "scanner-primary", "fingerprint": "b11827c4abdf20c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-56332"]}}, {"ruleId": "scanner-03e7b6e914149dc6", "level": "warning", "message": {"text": "CVE-2025-55173: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "dcf530f6a4368be4", "scanner": "scanner-primary", "fingerprint": "03e7b6e914149dc6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-55173"]}}, {"ruleId": "scanner-8381ddd70572fda0", "level": "warning", "message": {"text": "CVE-2025-57752: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "2111a58787e462b5", "scanner": "scanner-primary", "fingerprint": "8381ddd70572fda0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-57752"]}}, {"ruleId": "scanner-dcfe080fb42f34be", "level": "warning", "message": {"text": "CVE-2025-57822: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "4d7b3c8569c703a5", "scanner": "scanner-primary", "fingerprint": "dcfe080fb42f34be", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-57822"]}}, {"ruleId": "scanner-45612baaffddb017", "level": "warning", "message": {"text": "CVE-2025-59471: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "58041d8b23d1b1c5", "scanner": "scanner-primary", "fingerprint": "45612baaffddb017", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-59471"]}}, {"ruleId": "scanner-8bfb32ca9cee2ea3", "level": "warning", "message": {"text": "CVE-2026-27980: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "1865acf9b46f45ae", "scanner": "scanner-primary", "fingerprint": "8bfb32ca9cee2ea3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27980"]}}, {"ruleId": "scanner-7bdda6eb9c67faba", "level": "warning", "message": {"text": "CVE-2026-29057: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "46c3d14590903a8c", "scanner": "scanner-primary", "fingerprint": "7bdda6eb9c67faba", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29057"]}}, {"ruleId": "scanner-2732bd70899eb03a", "level": "warning", "message": {"text": "CVE-2026-44576: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "b3957974d11317da", "scanner": "scanner-primary", "fingerprint": "2732bd70899eb03a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44576"]}}, {"ruleId": "scanner-19f0a9a3d0f2a38d", "level": "warning", "message": {"text": "CVE-2026-44577: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "936ad40181f7e6d1", "scanner": "scanner-primary", "fingerprint": "19f0a9a3d0f2a38d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44577"]}}, {"ruleId": "scanner-f416e8c31ba1651c", "level": "warning", "message": {"text": "CVE-2026-44580: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "3a76861afef18e03", "scanner": "scanner-primary", "fingerprint": "f416e8c31ba1651c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44580"]}}, {"ruleId": "scanner-459d85845321289c", "level": "warning", "message": {"text": "CVE-2026-44581: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "966c95ecac96969a", "scanner": "scanner-primary", "fingerprint": "459d85845321289c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44581"]}}, {"ruleId": "scanner-d1282922c4ee929b", "level": "warning", "message": {"text": "CVE-2026-64643: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "8f25d45c0bdf8741", "scanner": "scanner-primary", "fingerprint": "d1282922c4ee929b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64643"]}}, {"ruleId": "scanner-01170a640d4211b5", "level": "warning", "message": {"text": "CVE-2026-64646: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "d04ad89743b2d7ed", "scanner": "scanner-primary", "fingerprint": "01170a640d4211b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64646"]}}, {"ruleId": "scanner-c11b68544e977d8a", "level": "warning", "message": {"text": "CVE-2026-64647: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "bf2d30aa38de39fa", "scanner": "scanner-primary", "fingerprint": "c11b68544e977d8a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64647"]}}, {"ruleId": "scanner-5f06832c717b7db5", "level": "warning", "message": {"text": "CVE-2026-64648: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "3a4cd955e2631318", "scanner": "scanner-primary", "fingerprint": "5f06832c717b7db5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64648"]}}, {"ruleId": "scanner-36583de8ece331c2", "level": "note", "message": {"text": "CVE-2025-32421: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "41de10caa5cd0de0", "scanner": "scanner-primary", "fingerprint": "36583de8ece331c2", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-32421"]}}, {"ruleId": "scanner-cf83deba51e8b9b9", "level": "note", "message": {"text": "CVE-2025-48068: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "74a83dc44dbe27c8", "scanner": "scanner-primary", "fingerprint": "cf83deba51e8b9b9", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-48068"]}}, {"ruleId": "scanner-5a1c6082d0a3b527", "level": "note", "message": {"text": "CVE-2026-44572: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "2d3858b4f7fe7385", "scanner": "scanner-primary", "fingerprint": "5a1c6082d0a3b527", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44572"]}}, {"ruleId": "scanner-6bcc0392a90b3852", "level": "note", "message": {"text": "CVE-2026-44582: next 14.2.7 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "597da3d13fe33cb4", "scanner": "scanner-primary", "fingerprint": "6bcc0392a90b3852", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44582"]}}, {"ruleId": "scanner-100496e369bcb8d2", "level": "error", "message": {"text": "CVE-2026-45623: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "9851d4789d96778a", "scanner": "scanner-primary", "fingerprint": "100496e369bcb8d2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45623"]}}, {"ruleId": "scanner-00a4380174cfd4c5", "level": "error", "message": {"text": "CVE-2026-73646: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "3d6a6b0f9a5ce8f3", "scanner": "scanner-primary", "fingerprint": "00a4380174cfd4c5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73646"]}}, {"ruleId": "scanner-bff4c8792d954873", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "4761cf69532875de", "scanner": "scanner-primary", "fingerprint": "bff4c8792d954873", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-f97d7b9762860247", "level": "warning", "message": {"text": "CVE-2026-69153: postcss 8.4.31 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "d17ba54bcabe1cab", "scanner": "scanner-primary", "fingerprint": "f97d7b9762860247", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69153"]}}, {"ruleId": "scanner-24c12546c89c5503", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "ea22e074241f2612", "scanner": "scanner-primary", "fingerprint": "24c12546c89c5503", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-9b4883bc4957890a", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "afaa20d586802103", "scanner": "scanner-primary", "fingerprint": "9b4883bc4957890a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-95a6293f69fe2b69", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.13.0 \u2014 museum-ticket-booking/package-lock.json"}, "properties": {"repobilityId": "75210704c30e426d", "scanner": "scanner-primary", "fingerprint": "95a6293f69fe2b69", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-af68a318d859ed79", "level": "note", "message": {"text": "CVE-2026-12590: body-parser 1.20.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "2cc3cf9d6ecedcda", "scanner": "scanner-primary", "fingerprint": "af68a318d859ed79", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12590"]}}, {"ruleId": "scanner-41aeed0cdec09958", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "8775b18ee2ab6ac7", "scanner": "scanner-primary", "fingerprint": "41aeed0cdec09958", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-e129f76ffd62afa3", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "54f567a7570eb6ed", "scanner": "scanner-primary", "fingerprint": "e129f76ffd62afa3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-53a565b68abde6fa", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "205d24bcd77a4394", "scanner": "scanner-primary", "fingerprint": "53a565b68abde6fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-0e0d93e508ef6102", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "177d9c72ba8538b6", "scanner": "scanner-primary", "fingerprint": "0e0d93e508ef6102", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-157cac5b75a99569", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 1.1.11 \u2014 package-lock.json"}, "properties": {"repobilityId": "dfb57c2bdc24714a", "scanner": "scanner-primary", "fingerprint": "157cac5b75a99569", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-99f3b3bda0a99180", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 2.0.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "8775b18ee2ab6ac7", "scanner": "scanner-primary", "fingerprint": "99f3b3bda0a99180", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-ea9425ee46c2e976", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 2.0.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "54f567a7570eb6ed", "scanner": "scanner-primary", "fingerprint": "ea9425ee46c2e976", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-3d69773820cfb719", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 2.0.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "205d24bcd77a4394", "scanner": "scanner-primary", "fingerprint": "3d69773820cfb719", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-1b8f808453e1a62b", "level": "warning", "message": {"text": "CVE-2026-33750: brace-expansion 2.0.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "177d9c72ba8538b6", "scanner": "scanner-primary", "fingerprint": "1b8f808453e1a62b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33750"]}}, {"ruleId": "scanner-f4ac6bdb65b94ea3", "level": "note", "message": {"text": "CVE-2025-5889: brace-expansion 2.0.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "dfb57c2bdc24714a", "scanner": "scanner-primary", "fingerprint": "f4ac6bdb65b94ea3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-5889"]}}, {"ruleId": "scanner-aac7c58ed5d7a73a", "level": "error", "message": {"text": "CVE-2025-12613: cloudinary 1.41.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "cda0644501f7ab75", "scanner": "scanner-primary", "fingerprint": "aac7c58ed5d7a73a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-12613"]}}, {"ruleId": "scanner-f32b69251dba4d22", "level": "note", "message": {"text": "CVE-2024-47764: cookie 0.4.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "c52b4f3bc8f1a0d7", "scanner": "scanner-primary", "fingerprint": "f32b69251dba4d22", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-47764"]}}, {"ruleId": "scanner-2165c24624488c9b", "level": "note", "message": {"text": "CVE-2024-47764: cookie 0.6.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "c52b4f3bc8f1a0d7", "scanner": "scanner-primary", "fingerprint": "2165c24624488c9b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-47764"]}}, {"ruleId": "scanner-729a87fa6a49863a", "level": "error", "message": {"text": "CVE-2025-7783: form-data 3.0.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "d2df4b39e56ba77a", "scanner": "scanner-primary", "fingerprint": "729a87fa6a49863a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7783"]}}, {"ruleId": "scanner-f8d89208fb5ceca6", "level": "error", "message": {"text": "CVE-2026-12143: form-data 3.0.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "283ecf327c9979f0", "scanner": "scanner-primary", "fingerprint": "f8d89208fb5ceca6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-12143"]}}, {"ruleId": "scanner-12b0967f1e176d4a", "level": "warning", "message": {"text": "CVE-2026-48038: joi 17.13.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "dfa712ab8912b90d", "scanner": "scanner-primary", "fingerprint": "12b0967f1e176d4a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48038"]}}, {"ruleId": "scanner-bdb0ff330db7f641", "level": "error", "message": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "9e31ffbbadb525da", "scanner": "scanner-primary", "fingerprint": "bdb0ff330db7f641", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-488c54428fc34f0d", "level": "warning", "message": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "9a4008c6507da8c3", "scanner": "scanner-primary", "fingerprint": "488c54428fc34f0d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-8832f52283a5d751", "level": "warning", "message": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 package-lock.json"}, "properties": {"repobilityId": "e5ea47dec8a5f16f", "scanner": "scanner-primary", "fingerprint": "8832f52283a5d751", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-64ecea76e6bc5e09", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "94bff1e4bae0d172", "scanner": "scanner-primary", "fingerprint": "64ecea76e6bc5e09", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-5547d992435923f9", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "49768a082ae8a15a", "scanner": "scanner-primary", "fingerprint": "5547d992435923f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-fc1422d1987f9a44", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 3.1.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "ad1a2b4ec39282c6", "scanner": "scanner-primary", "fingerprint": "fc1422d1987f9a44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-4ec88b724d2f418c", "level": "error", "message": {"text": "CVE-2026-26996: minimatch 5.1.6 \u2014 package-lock.json"}, "properties": {"repobilityId": "94bff1e4bae0d172", "scanner": "scanner-primary", "fingerprint": "4ec88b724d2f418c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-26996"]}}, {"ruleId": "scanner-c47ca5360d3f0fe7", "level": "error", "message": {"text": "CVE-2026-27903: minimatch 5.1.6 \u2014 package-lock.json"}, "properties": {"repobilityId": "49768a082ae8a15a", "scanner": "scanner-primary", "fingerprint": "c47ca5360d3f0fe7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27903"]}}, {"ruleId": "scanner-3bfb8e4cc920548c", "level": "error", "message": {"text": "CVE-2026-27904: minimatch 5.1.6 \u2014 package-lock.json"}, "properties": {"repobilityId": "ad1a2b4ec39282c6", "scanner": "scanner-primary", "fingerprint": "3bfb8e4cc920548c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27904"]}}, {"ruleId": "scanner-8ea6d60138d04ea9", "level": "error", "message": {"text": "CVE-2025-23061: mongoose 8.5.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "d2da8bbfddfb53b2", "scanner": "scanner-primary", "fingerprint": "8ea6d60138d04ea9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-23061"]}}, {"ruleId": "scanner-3550a8c3091bd9f1", "level": "error", "message": {"text": "CVE-2024-53900: mongoose 8.5.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "f916bc4c6547e5a2", "scanner": "scanner-primary", "fingerprint": "3550a8c3091bd9f1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-53900"]}}, {"ruleId": "scanner-32e268397b5495b7", "level": "error", "message": {"text": "CVE-2026-42334: mongoose 8.5.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "36fee9a6ca31c44d", "scanner": "scanner-primary", "fingerprint": "32e268397b5495b7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42334"]}}, {"ruleId": "scanner-199c94f3822a6e9b", "level": "warning", "message": {"text": "CVE-2026-73562: mongoose 8.5.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "85a23e4fb34f1352", "scanner": "scanner-primary", "fingerprint": "199c94f3822a6e9b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73562"]}}, {"ruleId": "scanner-c8c45f2f6ac38eb9", "level": "error", "message": {"text": "CVE-2025-47935: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "d636e2d8e5784e57", "scanner": "scanner-primary", "fingerprint": "c8c45f2f6ac38eb9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-47935"]}}, {"ruleId": "scanner-9b99065720a93085", "level": "error", "message": {"text": "CVE-2025-47944: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "353e8f51e163fad9", "scanner": "scanner-primary", "fingerprint": "9b99065720a93085", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-47944"]}}, {"ruleId": "scanner-2d349427ec9e3dfe", "level": "error", "message": {"text": "CVE-2025-48997: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "6a970d6cb06f5f30", "scanner": "scanner-primary", "fingerprint": "2d349427ec9e3dfe", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-48997"]}}, {"ruleId": "scanner-296cf00c23481ea7", "level": "error", "message": {"text": "CVE-2025-7338: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "0c04973fbf6795d6", "scanner": "scanner-primary", "fingerprint": "296cf00c23481ea7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7338"]}}, {"ruleId": "scanner-72fd4c1ec8519398", "level": "error", "message": {"text": "CVE-2026-2359: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "8de69f303761e96d", "scanner": "scanner-primary", "fingerprint": "72fd4c1ec8519398", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2359"]}}, {"ruleId": "scanner-0b27984f316f2f3d", "level": "error", "message": {"text": "CVE-2026-3304: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "ebcc90fe3fdf62b1", "scanner": "scanner-primary", "fingerprint": "0b27984f316f2f3d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-3304"]}}, {"ruleId": "scanner-f759e4ee5efe0d18", "level": "error", "message": {"text": "CVE-2026-3520: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "6fd87dea7ee74b2f", "scanner": "scanner-primary", "fingerprint": "f759e4ee5efe0d18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-3520"]}}, {"ruleId": "scanner-ee6091c964fabf11", "level": "error", "message": {"text": "CVE-2026-5079: multer 1.4.5-lts.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "fa646c7cffe8a63d", "scanner": "scanner-primary", "fingerprint": "ee6091c964fabf11", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-5079"]}}, {"ruleId": "scanner-670db14a265d87ba", "level": "note", "message": {"text": "CVE-2025-7339: on-headers 1.0.2 \u2014 package-lock.json"}, "properties": {"repobilityId": "4ded66707133081f", "scanner": "scanner-primary", "fingerprint": "670db14a265d87ba", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-7339"]}}, {"ruleId": "scanner-a429aba5190cbe54", "level": "error", "message": {"text": "CVE-2024-52798: path-to-regexp 0.1.10 \u2014 package-lock.json"}, "properties": {"repobilityId": "dc21a4cf74fae820", "scanner": "scanner-primary", "fingerprint": "a429aba5190cbe54", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-52798"]}}, {"ruleId": "scanner-750d55fb7a24b7d3", "level": "error", "message": {"text": "CVE-2026-4867: path-to-regexp 0.1.10 \u2014 package-lock.json"}, "properties": {"repobilityId": "14d7fcb7dded9249", "scanner": "scanner-primary", "fingerprint": "750d55fb7a24b7d3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4867"]}}, {"ruleId": "scanner-47cda05433ffe784", "level": "error", "message": {"text": "CVE-2026-33671: picomatch 2.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "4b0be15d9960fbab", "scanner": "scanner-primary", "fingerprint": "47cda05433ffe784", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33671"]}}, {"ruleId": "scanner-c46fa4398483f6d4", "level": "warning", "message": {"text": "CVE-2026-33672: picomatch 2.3.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "2083d545c96f670b", "scanner": "scanner-primary", "fingerprint": "c46fa4398483f6d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33672"]}}, {"ruleId": "scanner-901f0ee224c42289", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.13.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "212dfaee90ca0f43", "scanner": "scanner-primary", "fingerprint": "901f0ee224c42289", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-23be245f727de7c2", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.13.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "9874f96ea2c6eb3f", "scanner": "scanner-primary", "fingerprint": "23be245f727de7c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-186521034ae7a598", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.13.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "5828ea7bea940935", "scanner": "scanner-primary", "fingerprint": "186521034ae7a598", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-8fae20d984de25f9", "level": "error", "message": {"text": "CVE-2025-12758: validator 13.12.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "0049f1301efd268e", "scanner": "scanner-primary", "fingerprint": "8fae20d984de25f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-12758"]}}, {"ruleId": "scanner-d252cc385dbf9d39", "level": "warning", "message": {"text": "CVE-2025-56200: validator 13.12.0 \u2014 package-lock.json"}, "properties": {"repobilityId": "63cd97ce2b88ce26", "scanner": "scanner-primary", "fingerprint": "d252cc385dbf9d39", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-56200"]}}, {"ruleId": "scanner-3a3527e70129fb18", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 Dockerfile"}, "properties": {"repobilityId": "691787f6b20605df", "scanner": "scanner-primary", "fingerprint": "3a3527e70129fb18", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3c4041c454cda88e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 Dockerfile"}, "properties": {"repobilityId": "da995bb2cfa21f65", "scanner": "scanner-primary", "fingerprint": "3c4041c454cda88e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-483c349c6efb3fdb", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:16"}, "properties": {"repobilityId": "9e8debabbe6499c4", "scanner": "scanner-primary", "fingerprint": "483c349c6efb3fdb", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-abfa50421ef214ea", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in museum-ticket-booking/pages/index.tsx:281"}, "properties": {"repobilityId": "76e603b2b5005d57", "scanner": "scanner-primary", "fingerprint": "abfa50421ef214ea", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/pages/index.tsx"}, "region": {"startLine": 281}}}]}, {"ruleId": "scanner-99c159a213863693", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "775bb50c42e9ce83", "scanner": "scanner-primary", "fingerprint": "99c159a213863693", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/greet-issue.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-274c70d3d75cd49a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97720f6673140205", "scanner": "scanner-primary", "fingerprint": "274c70d3d75cd49a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/issue-open-close.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-e5e4f2dcfdccc5e1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fa9139eb6f4d57a3", "scanner": "scanner-primary", "fingerprint": "e5e4f2dcfdccc5e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-merge.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-1d36213800efc3de", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "27bd1baf251308cf", "scanner": "scanner-primary", "fingerprint": "1d36213800efc3de", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/auto-label.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "79011fe4b323a444", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b6fcfcf057e9ec90", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "90bcd0c416061520", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "1491ec0b9a6c6f19", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "606518914f20f6d4", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-8e047ab7af03962f", "level": "note", "message": {"text": "7 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5a0455f6498c27ad", "scanner": "scanner-primary", "fingerprint": "8e047ab7af03962f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-6ab2dea26c141c59", "level": "error", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-35jp-ww65-95wh"}, "properties": {"repobilityId": "28123ddf636dbd11", "scanner": "scanner-primary", "fingerprint": "6ab2dea26c141c59", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-35jp-ww65-95wh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1484645acf991eb", "level": "error", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-3g43-6gmg-66jw"}, "properties": {"repobilityId": "a87e8580bfd0aa53", "scanner": "scanner-primary", "fingerprint": "f1484645acf991eb", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3g43-6gmg-66jw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cdfddadf4dc86a30", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-3p68-rc4w-qgx5"}, "properties": {"repobilityId": "8e37142d46fc63cb", "scanner": "scanner-primary", "fingerprint": "cdfddadf4dc86a30", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3p68-rc4w-qgx5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbf711677ef022d1", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-3w6x-2g7m-8v23"}, "properties": {"repobilityId": "00bb06428496b945", "scanner": "scanner-primary", "fingerprint": "fbf711677ef022d1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3w6x-2g7m-8v23"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-234ca1d7123a9361", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-42h9-826w-cgv3"}, "properties": {"repobilityId": "067602bf0212b76c", "scanner": "scanner-primary", "fingerprint": "234ca1d7123a9361", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-42h9-826w-cgv3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-862af6ad5bc5ac59", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-43fc-jf86-j433"}, "properties": {"repobilityId": "36560174af6f1eff", "scanner": "scanner-primary", "fingerprint": "862af6ad5bc5ac59", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-43fc-jf86-j433"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4ae7e7aeb448012", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-445q-vr5w-6q77"}, "properties": {"repobilityId": "84270955154aa736", "scanner": "scanner-primary", "fingerprint": "f4ae7e7aeb448012", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-445q-vr5w-6q77"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-499e6807926d00e9", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-4hjh-wcwx-xvwj"}, "properties": {"repobilityId": "cf1183709dadcf24", "scanner": "scanner-primary", "fingerprint": "499e6807926d00e9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4hjh-wcwx-xvwj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-880c613b3b06b70a", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-5c9x-8gcm-mpgx"}, "properties": {"repobilityId": "49cb3f78fc61f92a", "scanner": "scanner-primary", "fingerprint": "880c613b3b06b70a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5c9x-8gcm-mpgx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06e501d9aa510f63", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-62hf-57xw-28j9"}, "properties": {"repobilityId": "30b491da4618240a", "scanner": "scanner-primary", "fingerprint": "06e501d9aa510f63", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-62hf-57xw-28j9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3fe031371aec80fe", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-6chq-wfr3-2hj9"}, "properties": {"repobilityId": "a7911070e4034674", "scanner": "scanner-primary", "fingerprint": "3fe031371aec80fe", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6chq-wfr3-2hj9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-092ae923802e52c1", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-777c-7fjr-54vf"}, "properties": {"repobilityId": "78c5cbaf193a4f7c", "scanner": "scanner-primary", "fingerprint": "092ae923802e52c1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-777c-7fjr-54vf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-adc26cbe2a015391", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-7q8q-rj6j-mhjq"}, "properties": {"repobilityId": "f04f6bd1f2faf74f", "scanner": "scanner-primary", "fingerprint": "adc26cbe2a015391", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7q8q-rj6j-mhjq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-174889bf874ea7f5", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-898c-q2cr-xwhg"}, "properties": {"repobilityId": "ff1792bb8170accc", "scanner": "scanner-primary", "fingerprint": "174889bf874ea7f5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-898c-q2cr-xwhg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b14f2d5ebc5e21a4", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-fvcv-3m26-pcqx"}, "properties": {"repobilityId": "bcdd043ac569df9d", "scanner": "scanner-primary", "fingerprint": "b14f2d5ebc5e21a4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fvcv-3m26-pcqx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-143bbd9bb7ba5a79", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-hfxv-24rg-xrqf"}, "properties": {"repobilityId": "e5ef3b6aadc4f87b", "scanner": "scanner-primary", "fingerprint": "143bbd9bb7ba5a79", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-hfxv-24rg-xrqf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13b957a3ff211575", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-j5f8-grm9-p9fc"}, "properties": {"repobilityId": "e773456de56d32e1", "scanner": "scanner-primary", "fingerprint": "13b957a3ff211575", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-j5f8-grm9-p9fc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3beacb8364f4dfa7", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-jqh4-m9w3-8hp9"}, "properties": {"repobilityId": "c5b88660cc81e1a0", "scanner": "scanner-primary", "fingerprint": "3beacb8364f4dfa7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jqh4-m9w3-8hp9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c458501f29e709e", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-jr5f-v2jv-69x6"}, "properties": {"repobilityId": "1355556f861ce5fe", "scanner": "scanner-primary", "fingerprint": "1c458501f29e709e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-jr5f-v2jv-69x6"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48067168bed29539", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-m7pr-hjqh-92cm"}, "properties": {"repobilityId": "6d97452388f60c88", "scanner": "scanner-primary", "fingerprint": "48067168bed29539", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m7pr-hjqh-92cm"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81fd9531c9c336cb", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-mmx7-hfxf-jppx"}, "properties": {"repobilityId": "e842213c9705bcc9", "scanner": "scanner-primary", "fingerprint": "81fd9531c9c336cb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mmx7-hfxf-jppx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-323f684d2ad095ce", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-p92q-9vqr-4j8v"}, "properties": {"repobilityId": "8a98d295cd27079e", "scanner": "scanner-primary", "fingerprint": "323f684d2ad095ce", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p92q-9vqr-4j8v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9e3fee505a8f636", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-pf86-5x62-jrwf"}, "properties": {"repobilityId": "048f9a8c8235c31c", "scanner": "scanner-primary", "fingerprint": "c9e3fee505a8f636", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pf86-5x62-jrwf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-88672bf6624cb900", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-pmv8-rq9r-6j72"}, "properties": {"repobilityId": "855f861e537c7dd1", "scanner": "scanner-primary", "fingerprint": "88672bf6624cb900", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pmv8-rq9r-6j72"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e7bfbc1ca878aea4", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-pmwg-cvhr-8vh7"}, "properties": {"repobilityId": "7906e01797387e32", "scanner": "scanner-primary", "fingerprint": "e7bfbc1ca878aea4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pmwg-cvhr-8vh7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-84ca25c48fc112fd", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-q8qp-cvcw-x6jj"}, "properties": {"repobilityId": "d19df5f551ce9bca", "scanner": "scanner-primary", "fingerprint": "84ca25c48fc112fd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q8qp-cvcw-x6jj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7084251378c2e1e", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-vf2m-468p-8v99"}, "properties": {"repobilityId": "b3b227ae0ded40be", "scanner": "scanner-primary", "fingerprint": "d7084251378c2e1e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vf2m-468p-8v99"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be182af332d1fcf6", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-w9j2-pvgh-6h63"}, "properties": {"repobilityId": "d9e80ebe21f0dc38", "scanner": "scanner-primary", "fingerprint": "be182af332d1fcf6", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w9j2-pvgh-6h63"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0da1c6fd4186c3fb", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-xhjh-pmcv-23jw"}, "properties": {"repobilityId": "ff00a10ffb46b232", "scanner": "scanner-primary", "fingerprint": "0da1c6fd4186c3fb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xhjh-pmcv-23jw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-06975a17c370589c", "level": "warning", "message": {"text": "Vulnerable dependency axios 1.7.7: GHSA-xx6v-rp6x-q39c"}, "properties": {"repobilityId": "7b7ed46bb38f6e62", "scanner": "scanner-primary", "fingerprint": "06975a17c370589c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xx6v-rp6x-q39c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5dcc3a91d1cff1e2", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-67pg-wm7f-q7fj"}, "properties": {"repobilityId": "42c37af4daf1f22e", "scanner": "scanner-primary", "fingerprint": "5dcc3a91d1cff1e2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-67pg-wm7f-q7fj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea4a12e6279eb6c4", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-7x6v-j9x4-qf24"}, "properties": {"repobilityId": "af761fd25f6d8567", "scanner": "scanner-primary", "fingerprint": "ea4a12e6279eb6c4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7x6v-j9x4-qf24"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da1d91e13500853c", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-8mvj-3j78-4qmw"}, "properties": {"repobilityId": "c4af03d94014b58b", "scanner": "scanner-primary", "fingerprint": "da1d91e13500853c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8mvj-3j78-4qmw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3170a41428a17954", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-95fx-jjr5-f39c"}, "properties": {"repobilityId": "6a768e0a48d5ecc5", "scanner": "scanner-primary", "fingerprint": "3170a41428a17954", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-95fx-jjr5-f39c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e34109792eddb5b", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-9vjf-qc39-jprp"}, "properties": {"repobilityId": "c13841d93a9633b1", "scanner": "scanner-primary", "fingerprint": "6e34109792eddb5b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9vjf-qc39-jprp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-990e10ca5174530c", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-cjw8-79x6-5cj4"}, "properties": {"repobilityId": "e703f055f800d99f", "scanner": "scanner-primary", "fingerprint": "990e10ca5174530c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cjw8-79x6-5cj4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96fb5cf3a797192b", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-f8cm-6447-x5h2"}, "properties": {"repobilityId": "6e76c93b179c3b65", "scanner": "scanner-primary", "fingerprint": "96fb5cf3a797192b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f8cm-6447-x5h2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1e795b7750522bd", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-p5xg-68wr-hm3m"}, "properties": {"repobilityId": "2c3f6ef724e183f9", "scanner": "scanner-primary", "fingerprint": "a1e795b7750522bd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p5xg-68wr-hm3m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a8c10475db41931a", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-pqxr-3g65-p328"}, "properties": {"repobilityId": "3452be1b11b5fcf0", "scanner": "scanner-primary", "fingerprint": "a8c10475db41931a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pqxr-3g65-p328"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0fd4a5b5101af76f", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-vm32-vv63-w422"}, "properties": {"repobilityId": "8e87f5b827981c3d", "scanner": "scanner-primary", "fingerprint": "0fd4a5b5101af76f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vm32-vv63-w422"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7041d040cfe46ede", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-w532-jxjh-hjhj"}, "properties": {"repobilityId": "e9263cffea987772", "scanner": "scanner-primary", "fingerprint": "7041d040cfe46ede", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-w532-jxjh-hjhj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6689f14fee4e5d7b", "level": "warning", "message": {"text": "Vulnerable dependency jspdf 2.5.1: GHSA-wfv2-pwc8-crg5"}, "properties": {"repobilityId": "20bbb3cbcde4a50b", "scanner": "scanner-primary", "fingerprint": "6689f14fee4e5d7b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wfv2-pwc8-crg5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79499490a1814de5", "level": "error", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-36qx-fr4f-26g5"}, "properties": {"repobilityId": "6b6fa6d47bf38b7f", "scanner": "scanner-primary", "fingerprint": "79499490a1814de5", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-36qx-fr4f-26g5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e659c0349ef5b6a1", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-3g8h-86w9-wvmq"}, "properties": {"repobilityId": "b69abb788498fd7e", "scanner": "scanner-primary", "fingerprint": "e659c0349ef5b6a1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3g8h-86w9-wvmq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5bfbfe936c7c3974", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-3h52-269p-cp9r"}, "properties": {"repobilityId": "1b46cf17dfab438c", "scanner": "scanner-primary", "fingerprint": "5bfbfe936c7c3974", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3h52-269p-cp9r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ea0da35c1c32e12", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-3x4c-7xq6-9pq8"}, "properties": {"repobilityId": "e15a10bdf3566905", "scanner": "scanner-primary", "fingerprint": "9ea0da35c1c32e12", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3x4c-7xq6-9pq8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-25806d1fdbc8c3da", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-4342-x723-ch2f"}, "properties": {"repobilityId": "23c4dc11304c75e7", "scanner": "scanner-primary", "fingerprint": "25806d1fdbc8c3da", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4342-x723-ch2f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e41d7671dd71133e", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-4633-3j49-mh5q"}, "properties": {"repobilityId": "adcace42c69067b6", "scanner": "scanner-primary", "fingerprint": "e41d7671dd71133e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4633-3j49-mh5q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b82512f6776a314b", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-4c39-4ccg-62r3"}, "properties": {"repobilityId": "caf2bb29468a0a15", "scanner": "scanner-primary", "fingerprint": "b82512f6776a314b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4c39-4ccg-62r3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f0fa381a79028d1", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-5j59-xgg2-r9c4"}, "properties": {"repobilityId": "deba5bae42170caf", "scanner": "scanner-primary", "fingerprint": "4f0fa381a79028d1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5j59-xgg2-r9c4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64aa783e7d204f7d", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-68g3-v927-f742"}, "properties": {"repobilityId": "4a1a396481d9643a", "scanner": "scanner-primary", "fingerprint": "64aa783e7d204f7d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-68g3-v927-f742"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a17ec46d85bed992", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-7gfc-8cq8-jh5f"}, "properties": {"repobilityId": "507f2f5e4f9ccd1e", "scanner": "scanner-primary", "fingerprint": "a17ec46d85bed992", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7gfc-8cq8-jh5f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5fda7da0b26ca391", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-7m27-7ghc-44w9"}, "properties": {"repobilityId": "74c43a8a780a38e1", "scanner": "scanner-primary", "fingerprint": "5fda7da0b26ca391", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-7m27-7ghc-44w9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-afd82f8c74578b34", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-89xv-2m56-2m9x"}, "properties": {"repobilityId": "9861d12d56e3750c", "scanner": "scanner-primary", "fingerprint": "afd82f8c74578b34", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-89xv-2m56-2m9x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f85ac5fd8e906839", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-8h8q-6873-q5fj"}, "properties": {"repobilityId": "513f5d3baebe082e", "scanner": "scanner-primary", "fingerprint": "f85ac5fd8e906839", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8h8q-6873-q5fj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7eb54547926609f3", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-955p-x3mx-jcvp"}, "properties": {"repobilityId": "e7721b23270f43de", "scanner": "scanner-primary", "fingerprint": "7eb54547926609f3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-955p-x3mx-jcvp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-99e67fe00ec1ebb2", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-9g9p-9gw9-jx7f"}, "properties": {"repobilityId": "d9734d58ca23ed67", "scanner": "scanner-primary", "fingerprint": "99e67fe00ec1ebb2", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9g9p-9gw9-jx7f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-686173d2b51b9625", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-c4j6-fc7j-m34r"}, "properties": {"repobilityId": "d5f6b9cbff061ed5", "scanner": "scanner-primary", "fingerprint": "686173d2b51b9625", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-c4j6-fc7j-m34r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-602d8c6f7780407f", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-f82v-jwr5-mffw"}, "properties": {"repobilityId": "4fc8d4f04c531f33", "scanner": "scanner-primary", "fingerprint": "602d8c6f7780407f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f82v-jwr5-mffw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09c8e11b0531df00", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-ffhc-5mcf-pf4q"}, "properties": {"repobilityId": "eb502fe41891dc07", "scanner": "scanner-primary", "fingerprint": "09c8e11b0531df00", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ffhc-5mcf-pf4q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15681468bc4f8c12", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-g5qg-72qw-gw5v"}, "properties": {"repobilityId": "3f5a0be721a4c044", "scanner": "scanner-primary", "fingerprint": "15681468bc4f8c12", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-g5qg-72qw-gw5v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca83744770683ea4", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-ggv3-7p47-pfv8"}, "properties": {"repobilityId": "de1a63b52921c276", "scanner": "scanner-primary", "fingerprint": "ca83744770683ea4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ggv3-7p47-pfv8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb09b24120f2da21", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-gp8f-8m3g-qvj9"}, "properties": {"repobilityId": "43755b1f40cf000d", "scanner": "scanner-primary", "fingerprint": "fb09b24120f2da21", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gp8f-8m3g-qvj9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9179a49dcfdaa902", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-gx5p-jg67-6x7h"}, "properties": {"repobilityId": "e053e8d681531037", "scanner": "scanner-primary", "fingerprint": "9179a49dcfdaa902", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gx5p-jg67-6x7h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34620eb222b5c75f", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-h25m-26qc-wcjf"}, "properties": {"repobilityId": "9aa6f298376b2a18", "scanner": "scanner-primary", "fingerprint": "34620eb222b5c75f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h25m-26qc-wcjf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a432f53ffccf93f1", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-h64f-5h5j-jqjh"}, "properties": {"repobilityId": "2a3b41b1b779edfb", "scanner": "scanner-primary", "fingerprint": "a432f53ffccf93f1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h64f-5h5j-jqjh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23ae7df97d2ef517", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-m99w-x7hq-7vfj"}, "properties": {"repobilityId": "e1c010d60f21aac8", "scanner": "scanner-primary", "fingerprint": "23ae7df97d2ef517", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m99w-x7hq-7vfj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ef673202c88bc1b8", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-mwv6-3258-q52c"}, "properties": {"repobilityId": "7d2ebdd5d8772993", "scanner": "scanner-primary", "fingerprint": "ef673202c88bc1b8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mwv6-3258-q52c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6dd5fa220d1938d0", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-p9j2-gv94-2wf4"}, "properties": {"repobilityId": "912d86cca553a61f", "scanner": "scanner-primary", "fingerprint": "6dd5fa220d1938d0", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p9j2-gv94-2wf4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1edf84942d84a1b9", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-q4gf-8mx6-v5v3"}, "properties": {"repobilityId": "9e684abe1f877b25", "scanner": "scanner-primary", "fingerprint": "1edf84942d84a1b9", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q4gf-8mx6-v5v3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34bcecfd16b16d54", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-qpjv-v59x-3qc4"}, "properties": {"repobilityId": "f8c830081031b16c", "scanner": "scanner-primary", "fingerprint": "34bcecfd16b16d54", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qpjv-v59x-3qc4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3336f359ec3598eb", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-vfv6-92ff-j949"}, "properties": {"repobilityId": "2753e063e9c52523", "scanner": "scanner-primary", "fingerprint": "3336f359ec3598eb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vfv6-92ff-j949"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64a6f28ef34d0498", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-wfc6-r584-vfw7"}, "properties": {"repobilityId": "d1abbb2793047680", "scanner": "scanner-primary", "fingerprint": "64a6f28ef34d0498", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wfc6-r584-vfw7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f91ae3dfaaa7120", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.7: GHSA-xv57-4mr9-wg8v"}, "properties": {"repobilityId": "b1bd4e11d21738b1", "scanner": "scanner-primary", "fingerprint": "2f91ae3dfaaa7120", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-xv57-4mr9-wg8v"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5dae308a82eb655c", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q"}, "properties": {"repobilityId": "86c312e6e8a1e925", "scanner": "scanner-primary", "fingerprint": "5dae308a82eb655c", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6g55-p6wh-862q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50406d01446af25a", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-fxqj-rqcc-2cmp"}, "properties": {"repobilityId": "5ec60ff3023c2808", "scanner": "scanner-primary", "fingerprint": "50406d01446af25a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-fxqj-rqcc-2cmp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c5ddea41805bb281", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": "00a7666aebb4f6a3", "scanner": "scanner-primary", "fingerprint": "c5ddea41805bb281", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qx2v-qp2m-jg93"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f0e961cac6cbe00", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-r28c-9q8g-f849"}, "properties": {"repobilityId": "446d039efd325657", "scanner": "scanner-primary", "fingerprint": "6f0e961cac6cbe00", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-r28c-9q8g-f849"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1f693323807853d", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.4.44: GHSA-6g55-p6wh-862q"}, "properties": {"repobilityId": "061ed3ae245c7fd0", "scanner": "scanner-primary", "fingerprint": "a1f693323807853d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6g55-p6wh-862q", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53ca214e94638dd3", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.44: GHSA-fxqj-rqcc-2cmp"}, "properties": {"repobilityId": "7223d5c009a398e3", "scanner": "scanner-primary", "fingerprint": "53ca214e94638dd3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fxqj-rqcc-2cmp", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b2d0bbd1b40532e4", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.44: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": "8ac6371287899db3", "scanner": "scanner-primary", "fingerprint": "b2d0bbd1b40532e4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qx2v-qp2m-jg93", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e15d3773462289e", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.4.44: GHSA-r28c-9q8g-f849"}, "properties": {"repobilityId": "cfc6caed4a83fbe7", "scanner": "scanner-primary", "fingerprint": "1e15d3773462289e", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r28c-9q8g-f849", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d7f7f426c629fc7", "level": "warning", "message": {"text": "Vulnerable dependency cloudinary 1.41.3: GHSA-g4mf-96x5-5m2c"}, "properties": {"repobilityId": "a52a2ebca7f5eb90", "scanner": "scanner-primary", "fingerprint": "5d7f7f426c629fc7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-g4mf-96x5-5m2c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9b57be7daa8fa3d7", "level": "warning", "message": {"text": "Vulnerable dependency joi 17.13.3: GHSA-q7cg-457f-vx79"}, "properties": {"repobilityId": "e672373e67c0bf8c", "scanner": "scanner-primary", "fingerprint": "9b57be7daa8fa3d7", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q7cg-457f-vx79"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-867bb8245288a5ea", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 8.5.1: GHSA-664h-wqgq-64gw"}, "properties": {"repobilityId": "9d6a3b32120a8425", "scanner": "scanner-primary", "fingerprint": "867bb8245288a5ea", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-664h-wqgq-64gw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f465b808f16b0c5f", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 8.5.1: GHSA-m7xq-9374-9rvx"}, "properties": {"repobilityId": "1c06599461337344", "scanner": "scanner-primary", "fingerprint": "f465b808f16b0c5f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m7xq-9374-9rvx"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f6abe1f61aeae15c", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 8.5.1: GHSA-vg7j-7cwx-8wgw"}, "properties": {"repobilityId": "1024018d55ada533", "scanner": "scanner-primary", "fingerprint": "f6abe1f61aeae15c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vg7j-7cwx-8wgw"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8562a2ac4f4db1bc", "level": "warning", "message": {"text": "Vulnerable dependency mongoose 8.5.1: GHSA-wpg9-53fq-2r8h"}, "properties": {"repobilityId": "47f4c237924a56e6", "scanner": "scanner-primary", "fingerprint": "8562a2ac4f4db1bc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wpg9-53fq-2r8h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-102869b19796ed70", "level": "warning", "message": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-44fp-w29j-9vj5"}, "properties": {"repobilityId": "cb6063ccfe22d612", "scanner": "scanner-primary", "fingerprint": "102869b19796ed70", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-44fp-w29j-9vj5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2294d1b2b24d7c7d", "level": "warning", "message": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-4pg4-qvpc-4q3h"}, "properties": {"repobilityId": "2ad85512014c4727", "scanner": "scanner-primary", "fingerprint": "2294d1b2b24d7c7d", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-4pg4-qvpc-4q3h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-61e311c3723dcfb0", "level": "warning", "message": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-5528-5vmv-3xc2"}, "properties": {"repobilityId": "e0178f48b529e923", "scanner": "scanner-primary", "fingerprint": "61e311c3723dcfb0", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-5528-5vmv-3xc2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c02e8def6d9d9844", "level": "warning", "message": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-72gw-mp4g-v24j"}, "properties": {"repobilityId": "ca17dc93d603be9c", "scanner": "scanner-primary", "fingerprint": "c02e8def6d9d9844", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-72gw-mp4g-v24j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a15a8515f2cc7a45", "level": "warning", "message": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-fjgf-rc76-4x9p"}, "properties": {"repobilityId": "86af18df69814970", "scanner": "scanner-primary", "fingerprint": "a15a8515f2cc7a45", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-fjgf-rc76-4x9p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-deab947f89fd5fb9", "level": "warning", "message": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-g5hg-p3ph-g8qg"}, "properties": {"repobilityId": "74eb88a93c9f67b7", "scanner": "scanner-primary", "fingerprint": "deab947f89fd5fb9", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-g5hg-p3ph-g8qg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26ce219cad8c2ba0", "level": "warning", "message": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-v52c-386h-88mc"}, "properties": {"repobilityId": "b05535d4df4e6940", "scanner": "scanner-primary", "fingerprint": "26ce219cad8c2ba0", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-v52c-386h-88mc"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-631c58b7e5f8b225", "level": "warning", "message": {"text": "Vulnerable dependency multer 1.4.5-lts.1: GHSA-xf7r-hgr6-v32p"}, "properties": {"repobilityId": "f3d0c820b1eec5fd", "scanner": "scanner-primary", "fingerprint": "631c58b7e5f8b225", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-xf7r-hgr6-v32p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3cd43bfa226ba01", "level": "warning", "message": {"text": "Vulnerable dependency @babel/runtime 7.25.6: GHSA-968p-4wvh-cqc8"}, "properties": {"repobilityId": "8be054cbcbcf640e", "scanner": "scanner-primary", "fingerprint": "d3cd43bfa226ba01", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-968p-4wvh-cqc8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cfb50e08f6114ceb", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "22f0123c5cf791ae", "scanner": "scanner-primary", "fingerprint": "cfb50e08f6114ceb", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a9669c8f0f794de", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "b01e54e60bd05504", "scanner": "scanner-primary", "fingerprint": "7a9669c8f0f794de", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7215d9e671edcf3", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "f092046896fd6350", "scanner": "scanner-primary", "fingerprint": "f7215d9e671edcf3", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d71b8c76509b931", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "089511f011f02a06", "scanner": "scanner-primary", "fingerprint": "7d71b8c76509b931", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9c044b47fbb103a9", "level": "note", "message": {"text": "Vulnerable dependency brace-expansion 2.0.1: GHSA-v6h2-p8h4-qcjw"}, "properties": {"repobilityId": "1dee303bae70af79", "scanner": "scanner-primary", "fingerprint": "9c044b47fbb103a9", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6h2-p8h4-qcjw", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-462613a727801d11", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "22f2f3902bce82f5", "scanner": "scanner-primary", "fingerprint": "462613a727801d11", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c303e3e916143cd", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "efc06e04c1e82404", "scanner": "scanner-primary", "fingerprint": "8c303e3e916143cd", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0eb66f1e3da6651b", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.3: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "d3b810a57a2dc7b8", "scanner": "scanner-primary", "fingerprint": "0eb66f1e3da6651b", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0245596c39484152", "level": "warning", "message": {"text": "Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6"}, "properties": {"repobilityId": "cf8ef5d83527dc1c", "scanner": "scanner-primary", "fingerprint": "0245596c39484152", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2g4f-4pwh-qvx6", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c62e5b3a457b7ddf", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "550046966683e89f", "scanner": "scanner-primary", "fingerprint": "c62e5b3a457b7ddf", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9a572bc49686ddc", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-f886-m6hf-6m8v"}, "properties": {"repobilityId": "169ddfc35cb958a3", "scanner": "scanner-primary", "fingerprint": "d9a572bc49686ddc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f886-m6hf-6m8v", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41faa13d2e0a8986", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "24a37fa2292eaf2e", "scanner": "scanner-primary", "fingerprint": "41faa13d2e0a8986", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-475f14e8c3f316a0", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "99d9dd5db915852f", "scanner": "scanner-primary", "fingerprint": "475f14e8c3f316a0", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe74c88c3455ba08", "level": "note", "message": {"text": "Vulnerable dependency brace-expansion 1.1.11: GHSA-v6h2-p8h4-qcjw"}, "properties": {"repobilityId": "23b502b342521550", "scanner": "scanner-primary", "fingerprint": "fe74c88c3455ba08", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v6h2-p8h4-qcjw", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae90ab8c6a339eaf", "level": "warning", "message": {"text": "Vulnerable dependency canvg 3.0.10: GHSA-v2mw-5mch-w8c5"}, "properties": {"repobilityId": "b749cc3449ae9ce0", "scanner": "scanner-primary", "fingerprint": "ae90ab8c6a339eaf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2mw-5mch-w8c5", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9916f43b43a497b6", "level": "warning", "message": {"text": "Vulnerable dependency cross-spawn 7.0.3: GHSA-3xgq-45jj-v275"}, "properties": {"repobilityId": "ffc94a870a5dec07", "scanner": "scanner-primary", "fingerprint": "9916f43b43a497b6", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3xgq-45jj-v275", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-446ab6cd048b63bb", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-39q2-94rc-95cp"}, "properties": {"repobilityId": "7acf5e6e5b53e5bb", "scanner": "scanner-primary", "fingerprint": "446ab6cd048b63bb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-39q2-94rc-95cp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a57f684746a1453", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-55q2-fjhq-7xh7"}, "properties": {"repobilityId": "8089a5eb16da9aa2", "scanner": "scanner-primary", "fingerprint": "6a57f684746a1453", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-55q2-fjhq-7xh7", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ccb472257001cc65", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-76mc-f452-cxcm"}, "properties": {"repobilityId": "539ad7d9ce82f198", "scanner": "scanner-primary", "fingerprint": "ccb472257001cc65", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-76mc-f452-cxcm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1637897f0699a9fa", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-c2j3-45gr-mqc4"}, "properties": {"repobilityId": "ff580b57d274959c", "scanner": "scanner-primary", "fingerprint": "1637897f0699a9fa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2j3-45gr-mqc4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-24b9fd4648a7eed5", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-cj63-jhhr-wcxv"}, "properties": {"repobilityId": "e96700bb816dd85f", "scanner": "scanner-primary", "fingerprint": "24b9fd4648a7eed5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cj63-jhhr-wcxv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bedfaa3aade164f", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-cjmm-f4jc-qw8r"}, "properties": {"repobilityId": "d8b5afe0e78c8b5d", "scanner": "scanner-primary", "fingerprint": "9bedfaa3aade164f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cjmm-f4jc-qw8r", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f5220835b30f7c34", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-cmwh-pvxp-8882"}, "properties": {"repobilityId": "b2714ce4ecb46073", "scanner": "scanner-primary", "fingerprint": "f5220835b30f7c34", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cmwh-pvxp-8882", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-57fc1ec3506df6c5", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-crv5-9vww-q3g8"}, "properties": {"repobilityId": "b5c729373448040c", "scanner": "scanner-primary", "fingerprint": "57fc1ec3506df6c5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-crv5-9vww-q3g8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80fe265cad7c7ed4", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-h7mw-gpvr-xq4m"}, "properties": {"repobilityId": "71598b1ad9155216", "scanner": "scanner-primary", "fingerprint": "80fe265cad7c7ed4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h7mw-gpvr-xq4m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8db39f1211223fa", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-h8r8-wccr-v5f2"}, "properties": {"repobilityId": "f8e5fd53c2114e63", "scanner": "scanner-primary", "fingerprint": "f8db39f1211223fa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h8r8-wccr-v5f2", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c2665411f1dbcdea", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-hpcv-96wg-7vj8"}, "properties": {"repobilityId": "774100cac2a526f8", "scanner": "scanner-primary", "fingerprint": "c2665411f1dbcdea", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hpcv-96wg-7vj8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e953df4b7d167ece", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-r47g-fvhr-h676"}, "properties": {"repobilityId": "c1c198708b9beda8", "scanner": "scanner-primary", "fingerprint": "e953df4b7d167ece", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r47g-fvhr-h676", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7d48b27025086033", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-rp9w-3fw7-7cwq"}, "properties": {"repobilityId": "8663404694797c9f", "scanner": "scanner-primary", "fingerprint": "7d48b27025086033", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rp9w-3fw7-7cwq", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-38aeb7aa9b614dfa", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-v2wj-7wpq-c8vv"}, "properties": {"repobilityId": "35f3b3f494a3d999", "scanner": "scanner-primary", "fingerprint": "38aeb7aa9b614dfa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v2wj-7wpq-c8vv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-057d5558d3c6a509", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-v8jm-5vwx-cfxm"}, "properties": {"repobilityId": "0d8fa65f901ef84a", "scanner": "scanner-primary", "fingerprint": "057d5558d3c6a509", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v8jm-5vwx-cfxm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9948ce7c3914e4a0", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-vhxf-7vqr-mrjg"}, "properties": {"repobilityId": "010680c4f91e16cb", "scanner": "scanner-primary", "fingerprint": "9948ce7c3914e4a0", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vhxf-7vqr-mrjg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a5bdcfbb74b7f18", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-vxr8-fq34-vvx9"}, "properties": {"repobilityId": "04fd43e091412acf", "scanner": "scanner-primary", "fingerprint": "2a5bdcfbb74b7f18", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vxr8-fq34-vvx9", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a0f606297ba5d57", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 2.5.6: GHSA-x4vx-rjvf-j5p4"}, "properties": {"repobilityId": "ba0e23d58ca2a3b2", "scanner": "scanner-primary", "fingerprint": "0a0f606297ba5d57", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-x4vx-rjvf-j5p4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab7b110465947bc6", "level": "error", "message": {"text": "Vulnerable dependency flatted 3.3.1: GHSA-25h7-pfq9-p65f"}, "properties": {"repobilityId": "e0e32e4b3dd53cc7", "scanner": "scanner-primary", "fingerprint": "ab7b110465947bc6", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-25h7-pfq9-p65f", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e18211797a41d2ef", "level": "warning", "message": {"text": "Vulnerable dependency flatted 3.3.1: GHSA-rf6f-7fwh-wjgh"}, "properties": {"repobilityId": "1481f559a885709b", "scanner": "scanner-primary", "fingerprint": "e18211797a41d2ef", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rf6f-7fwh-wjgh", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-07889a4d5fea46db", "level": "warning", "message": {"text": "Vulnerable dependency follow-redirects 1.15.6: GHSA-r4q5-vmmm-2653"}, "properties": {"repobilityId": "adb5401d90af4619", "scanner": "scanner-primary", "fingerprint": "07889a4d5fea46db", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r4q5-vmmm-2653", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7cbfb3bff42a5275", "level": "warning", "message": {"text": "Vulnerable dependency form-data 4.0.0: GHSA-fjxv-7rqg-78g4"}, "properties": {"repobilityId": "7307811b60017fe3", "scanner": "scanner-primary", "fingerprint": "7cbfb3bff42a5275", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fjxv-7rqg-78g4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-39614e04d1cc86f5", "level": "warning", "message": {"text": "Vulnerable dependency form-data 4.0.0: GHSA-hmw2-7cc7-3qxx"}, "properties": {"repobilityId": "9c3a6da92cbc1d67", "scanner": "scanner-primary", "fingerprint": "39614e04d1cc86f5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hmw2-7cc7-3qxx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-07a3009dc937f2ad", "level": "warning", "message": {"text": "Vulnerable dependency glob 10.3.10: GHSA-5j98-mcp5-4vw2"}, "properties": {"repobilityId": "bfa38a61d660cecd", "scanner": "scanner-primary", "fingerprint": "07a3009dc937f2ad", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5j98-mcp5-4vw2", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-243d6ee3f8b07510", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "3879836d3d26f667", "scanner": "scanner-primary", "fingerprint": "243d6ee3f8b07510", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db78169e4f0fccc6", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "3dc5c8f5e4159f29", "scanner": "scanner-primary", "fingerprint": "db78169e4f0fccc6", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5ae394a1078acbc", "level": "error", "message": {"text": "Vulnerable dependency minimatch 9.0.5: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "76439b7ceb6791cb", "scanner": "scanner-primary", "fingerprint": "a5ae394a1078acbc", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6bfa9514f45d7c73", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.0: GHSA-52cp-r559-cp3m"}, "properties": {"repobilityId": "2295971a92c54b9e", "scanner": "scanner-primary", "fingerprint": "6bfa9514f45d7c73", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52cp-r559-cp3m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6484477d11d32ccd", "level": "error", "message": {"text": "Vulnerable dependency js-yaml 4.1.0: GHSA-5p4m-2wfm-xmqj"}, "properties": {"repobilityId": "fde71304366222c8", "scanner": "scanner-primary", "fingerprint": "6484477d11d32ccd", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5p4m-2wfm-xmqj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f7effafe3df9db1", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.0: GHSA-h67p-54hq-rp68"}, "properties": {"repobilityId": "950027314cda83d8", "scanner": "scanner-primary", "fingerprint": "5f7effafe3df9db1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h67p-54hq-rp68", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-055ee3b1c2364af4", "level": "warning", "message": {"text": "Vulnerable dependency js-yaml 4.1.0: GHSA-mh29-5h37-fv8m"}, "properties": {"repobilityId": "3860211bb978525c", "scanner": "scanner-primary", "fingerprint": "055ee3b1c2364af4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh29-5h37-fv8m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d68766d336b2a98", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-23c5-xmqv-rm74"}, "properties": {"repobilityId": "9f7f5897e94c3644", "scanner": "scanner-primary", "fingerprint": "9d68766d336b2a98", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23c5-xmqv-rm74", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ce7214b45913031d", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-3ppc-4f35-3m26"}, "properties": {"repobilityId": "1f348c9c38426ebf", "scanner": "scanner-primary", "fingerprint": "ce7214b45913031d", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3ppc-4f35-3m26", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-72bbbc80d0729d1c", "level": "error", "message": {"text": "Vulnerable dependency minimatch 3.1.2: GHSA-7r86-cg39-jmmj"}, "properties": {"repobilityId": "20c31d31e282c8df", "scanner": "scanner-primary", "fingerprint": "72bbbc80d0729d1c", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7r86-cg39-jmmj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9cf632591f2e42c", "level": "error", "message": {"text": "Vulnerable dependency nanoid 3.3.7: GHSA-28wg-ghj8-5hjv"}, "properties": {"repobilityId": "095c15c29def8b3b", "scanner": "scanner-primary", "fingerprint": "d9cf632591f2e42c", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-28wg-ghj8-5hjv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9761099573d9fbe0", "level": "error", "message": {"text": "Vulnerable dependency nanoid 3.3.7: GHSA-2v37-7h3g-55p8"}, "properties": {"repobilityId": "37f12b564dbe7c8e", "scanner": "scanner-primary", "fingerprint": "9761099573d9fbe0", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2v37-7h3g-55p8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-373007abd0c4aeea", "level": "warning", "message": {"text": "Vulnerable dependency nanoid 3.3.7: GHSA-mwcw-c2x4-8c55"}, "properties": {"repobilityId": "77890121e5a56ae0", "scanner": "scanner-primary", "fingerprint": "373007abd0c4aeea", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mwcw-c2x4-8c55", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8beeab578b56d588", "level": "warning", "message": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-3v7f-55p6-f55p"}, "properties": {"repobilityId": "a2746cb9d8be4794", "scanner": "scanner-primary", "fingerprint": "8beeab578b56d588", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3v7f-55p6-f55p", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bb78282c0db1956c", "level": "warning", "message": {"text": "Vulnerable dependency picomatch 2.3.1: GHSA-c2c7-rcm5-vvqj"}, "properties": {"repobilityId": "676e59b75389f27b", "scanner": "scanner-primary", "fingerprint": "bb78282c0db1956c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-c2c7-rcm5-vvqj", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-df04a6615e09ab21", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.13.0: GHSA-6rw7-vpxm-498p"}, "properties": {"repobilityId": "0dd9b90f07bba0b4", "scanner": "scanner-primary", "fingerprint": "df04a6615e09ab21", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6rw7-vpxm-498p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04c294f334662903", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.13.0: GHSA-q8mj-m7cp-5q26"}, "properties": {"repobilityId": "f8ba2a937b98ad7c", "scanner": "scanner-primary", "fingerprint": "04c294f334662903", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q8mj-m7cp-5q26", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a346e898db1e09e7", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.13.0: GHSA-w7fw-mjwx-w883"}, "properties": {"repobilityId": "433ca950e054c5aa", "scanner": "scanner-primary", "fingerprint": "a346e898db1e09e7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w7fw-mjwx-w883", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-451d64ec952d89b2", "level": "warning", "message": {"text": "Vulnerable dependency yaml 2.5.0: GHSA-48c2-rrv3-qjmp"}, "properties": {"repobilityId": "f8b7e0bf60ed23ad", "scanner": "scanner-primary", "fingerprint": "451d64ec952d89b2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-48c2-rrv3-qjmp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-181d156d0375b7a4", "level": "warning", "message": {"text": "Dependency @stripe/react-stripe-js is two or more major versions behind"}, "properties": {"repobilityId": "8f2d5a63b3b0b4e8", "scanner": "scanner-primary", "fingerprint": "181d156d0375b7a4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-96f27d3d1f3d77ff", "level": "warning", "message": {"text": "Dependency @stripe/stripe-js is two or more major versions behind"}, "properties": {"repobilityId": "8a2510d476a46d4b", "scanner": "scanner-primary", "fingerprint": "96f27d3d1f3d77ff", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec568823001aa1c3", "level": "note", "message": {"text": "Dependency cloudinary is a major version behind"}, "properties": {"repobilityId": "d7d0a3b390bd32b1", "scanner": "scanner-primary", "fingerprint": "ec568823001aa1c3", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f37ffe69d5d80b32", "level": "note", "message": {"text": "Dependency dotenv is a major version behind"}, "properties": {"repobilityId": "117b19ed70c9a1d6", "scanner": "scanner-primary", "fingerprint": "f37ffe69d5d80b32", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87654ff002627905", "level": "warning", "message": {"text": "Dependency ejs is two or more major versions behind"}, "properties": {"repobilityId": "cbe44c48056ee3fa", "scanner": "scanner-primary", "fingerprint": "87654ff002627905", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a736687f245203a6", "level": "note", "message": {"text": "Dependency express is a major version behind"}, "properties": {"repobilityId": "9d1a16c84a268997", "scanner": "scanner-primary", "fingerprint": "a736687f245203a6", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53caf8b8056ebdc0", "level": "note", "message": {"text": "Dependency joi is a major version behind"}, "properties": {"repobilityId": "3a01768956390732", "scanner": "scanner-primary", "fingerprint": "53caf8b8056ebdc0", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8195bc4eb8c3a74a", "level": "warning", "message": {"text": "Dependency jspdf-autotable is two or more major versions behind"}, "properties": {"repobilityId": "19d48420b774e928", "scanner": "scanner-primary", "fingerprint": "8195bc4eb8c3a74a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7424ac90f13f2389", "level": "warning", "message": {"text": "Dependency jspdf is two or more major versions behind"}, "properties": {"repobilityId": "cafc4c5eb3be68b2", "scanner": "scanner-primary", "fingerprint": "7424ac90f13f2389", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-324de97815c2f50a", "level": "note", "message": {"text": "Dependency lucide-react is a major version behind"}, "properties": {"repobilityId": "4c42c9e8d254fa8e", "scanner": "scanner-primary", "fingerprint": "324de97815c2f50a", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f580680c4c6b928", "level": "note", "message": {"text": "Dependency mongodb is a major version behind"}, "properties": {"repobilityId": "43c618f419ec1959", "scanner": "scanner-primary", "fingerprint": "2f580680c4c6b928", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d851b24da2bb7be0", "level": "note", "message": {"text": "Dependency mongoose is a major version behind"}, "properties": {"repobilityId": "9f614bf34a935728", "scanner": "scanner-primary", "fingerprint": "d851b24da2bb7be0", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7eb18d8d2c46689", "level": "note", "message": {"text": "Dependency multer is a major version behind"}, "properties": {"repobilityId": "753607cafbf36002", "scanner": "scanner-primary", "fingerprint": "d7eb18d8d2c46689", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3034689d42b37767", "level": "warning", "message": {"text": "Dependency next is two or more major versions behind"}, "properties": {"repobilityId": "cf1cb3e660a60dbd", "scanner": "scanner-primary", "fingerprint": "3034689d42b37767", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ff7b4172bb532a6", "level": "note", "message": {"text": "Dependency passport-local-mongoose is a major version behind"}, "properties": {"repobilityId": "71f5958572313505", "scanner": "scanner-primary", "fingerprint": "8ff7b4172bb532a6", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-425140af48ce7862", "level": "note", "message": {"text": "Dependency react-calendar is a major version behind"}, "properties": {"repobilityId": "de2f0dc1a32eafce", "scanner": "scanner-primary", "fingerprint": "425140af48ce7862", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28f38d10489a3e53", "level": "warning", "message": {"text": "Dependency react-datepicker is two or more major versions behind"}, "properties": {"repobilityId": "fda44a93c1a84e27", "scanner": "scanner-primary", "fingerprint": "28f38d10489a3e53", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6896e30b6d34a783", "level": "note", "message": {"text": "Dependency react-dom is a major version behind"}, "properties": {"repobilityId": "39a864a8e1cd1a9d", "scanner": "scanner-primary", "fingerprint": "6896e30b6d34a783", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-da91b4915daddc39", "level": "note", "message": {"text": "Dependency react-time-picker is a major version behind"}, "properties": {"repobilityId": "b361427a0e21af07", "scanner": "scanner-primary", "fingerprint": "da91b4915daddc39", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d22782fc4a4600b", "level": "note", "message": {"text": "Dependency react is a major version behind"}, "properties": {"repobilityId": "8b72431ad51ccd5c", "scanner": "scanner-primary", "fingerprint": "5d22782fc4a4600b", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-862aeb27d80d3ba9", "level": "warning", "message": {"text": "Dependency stripe is two or more major versions behind"}, "properties": {"repobilityId": "fd8f42218669e9d8", "scanner": "scanner-primary", "fingerprint": "862aeb27d80d3ba9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "museum-ticket-booking/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f2f781df81936ce", "level": "note", "message": {"text": "6 backend endpoints not called by scanned frontend"}, "properties": {"repobilityId": "3c8e96670c5e1f9f", "scanner": "scanner-primary", "fingerprint": "7f2f781df81936ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}