Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Ntkhang03/Goat-Bot-V2

https://github.com/Ntkhang03/Goat-Bot-V2 · scanned 2026-09-21 11:42 UTC (1 month ago)

346 raw signals (0 security + 346 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 month ago · v1 · 346 actionable findings from 1 signal source. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
80.1
/100
Security checks
80
0 findings
System graph
80
80.0% cov · 346 findings
Critical
6
click to filter
Agents
10
1 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: source: scanner × excluding tests × Reset all
Severity: Critical 6 High 89 Medium 205 Low 39 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 346 Crowd 0 Layer: Frontend 2 Security 175 Quality 12 Dependencies 156 Api 1
Scan summary Repository scanned at 80.1/100 with 80.0% coverage. It contains 1057 nodes across 21 cross-layer flows, written primarily in mixed languages. Engine surfaced 346 findings — concentrated in security (175), dependencies (156), quality (12). Risk profile is high: 6 critical, 89 high, 205 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 339 of 346 actionable findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Trivy conf 1.00 CVE-2023-3696: mongoose 6.10.5 — package-lock.json
Mongoose Prototype Pollution vulnerability Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Package: mongoose Installed: 6.10.5 Fixed in: 7.3.3, 6.11.3, 5.13.20 Severity: CRITICAL Fix: Upgrade mongoose to 7.3.3, 6.11.3, 5.13.20
VulnCve 2023 3696 1 TP · 0 FP
critical System graph security Trivy conf 1.00 CVE-2025-23061: mongoose 6.10.5 — package-lock.json
Mongoose search injection vulnerability Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900. Package: mongoose Installed: 6.10.5 Fixed in: 8.9.5, 7.8.4, 6.13.6…
VulnCve 2025 23061
critical System graph security Trivy conf 1.00 CVE-2025-7783: form-data 2.3.3 — package-lock.json
form-data: Unsafe random function in form-data Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3. Package:…
VulnCve 2025 7783
critical System graph security Trivy conf 1.00 CVE-2025-7783: form-data 4.0.0 — package-lock.json
form-data: Unsafe random function in form-data Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3. Package:…
VulnCve 2025 7783
critical System graph security Trivy conf 1.00 CVE-2026-59873: tar 6.1.13 — package-lock.json
tar: node-tar: Denial of Service via crafted gzip bomb node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, a…
VulnCve 2026 59873
critical System graph security Trivy conf 1.00 CVE-2026-69240: sequelize 6.31.0 — package-lock.json
sequelize: Sequelize: SQL Injection via improper handling of Oracle date functions Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with…
VulnCve 2026 69240
high System graph security Trivy conf 1.00 CVE-2022-25883: semver 6.3.0 — package-lock.json
nodejs-semver: Regular expression denial of service Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range. Package: semver Installed: 6.3.0 Fixed in: 7.5.2, 6.3.1, 5.7.…
VulnCve 2022 25883
high System graph security Trivy conf 1.00 CVE-2022-25883: semver 7.5.0 — package-lock.json
nodejs-semver: Regular expression denial of service Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range. Package: semver Installed: 7.5.0 Fixed in: 7.5.2, 6.3.1, 5.7.…
VulnCve 2022 25883
high System graph security Trivy conf 1.00 CVE-2022-25967: eta 1.12.3 — package-lock.json
eta: Remote Code Execution by overwriting template engine configuration variables Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is…
VulnCve 2022 25967
high System graph security Trivy conf 1.00 CVE-2023-23630: eta 1.12.3 — package-lock.json
XSS Attack with Express API Eta is an embedded JS templating engine that works inside Node, Deno, and the browser. XSS attack - anyone using the Express API is impacted. The problem has been resolved. Users should upgrade to version 2.0.0. As a workaround, don't pass user supplied things directly …
VulnCve 2023 23630
high System graph security Trivy conf 1.00 CVE-2023-26132: dottie 2.0.3 — package-lock.json
Versions of the package dottie before 2.0.4 are vulnerable to Prototyp ... Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the current variable in the /dottie.js file. Package: dottie Installed: 2.0.3 Fixed i…
VulnCve 2023 26132
high System graph security Trivy conf 1.00 CVE-2024-29415: ip 2.0.0 — package-lock.json
node-ip: Incomplete fix for CVE-2023-42282 The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because…
VulnCve 2024 29415
high System graph security Trivy conf 1.00 CVE-2024-37890: ws 3.3.3 — package-lock.json
nodejs-ws: denial of service when handling a request with many HTTP headers ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e…
VulnCve 2024 37890
high System graph security Trivy conf 1.00 CVE-2024-37890: ws 7.5.9 — package-lock.json
nodejs-ws: denial of service when handling a request with many HTTP headers ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e…
VulnCve 2024 37890
high System graph security Trivy conf 1.00 CVE-2024-37890: ws 8.11.0 — package-lock.json
nodejs-ws: denial of service when handling a request with many HTTP headers ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e…
VulnCve 2024 37890
high System graph security Trivy conf 1.00 CVE-2024-39338: axios 1.4.0 — package-lock.json
axios: axios: Server-Side Request Forgery axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. Package: axios Installed: 1.4.0 Fixed in: 1.7.4 Severity: HIGH Fix: Upgrade axios to 1.7.4
VulnCve 2024 39338
high System graph security Trivy conf 1.00 CVE-2024-45296: path-to-regexp 0.1.7 — package-lock.json
path-to-regexp: Backtracking regular expressions cause ReDoS path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching run…
VulnCve 2024 45296
high System graph security Trivy conf 1.00 CVE-2024-45590: body-parser 1.20.1 — package-lock.json
body-parser: Denial of Service Vulnerability in body-parser body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of request…
VulnCve 2024 45590
high System graph security Trivy conf 1.00 CVE-2024-52798: path-to-regexp 0.1.7 — package-lock.json
path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to bac…
VulnCve 2024 52798
high System graph security Trivy conf 1.00 CVE-2024-53900: mongoose 6.10.5 — package-lock.json
Mongoose search injection vulnerability Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Package: mongoose Installed: 6.10.5 Fixed in: 8.8.3, 7.8.3, 6.13.5, 5.13.23 Severity: HIGH Fix: Upgrade mongoose to 8.8.3, 7.8.3, 6.13.5, 5.13.23
VulnCve 2024 53900
high System graph security Trivy conf 1.00 CVE-2025-12758: validator 13.9.0 — package-lock.json
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode vari…
VulnCve 2025 12758
high System graph security Trivy conf 1.00 CVE-2025-12816: node-forge 1.3.1 — package-lock.json
node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yi…
VulnCve 2025 12816
high System graph security Trivy conf 1.00 CVE-2025-14874: nodemailer 6.9.1 — package-lock.json
nodemailer: Nodemailer: Denial of service via crafted email address header A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser. Package: nodemailer Installed: 6.9.1 Fixed in: …
VulnCve 2025 14874
high System graph security Trivy conf 1.00 CVE-2025-27152: axios 1.4.0 — package-lock.json
axios: Possible SSRF and Credential Leakage via Absolute URL in axios Requests axios is a promise based HTTP client for the browser and node.js. The issue occurs when passing absolute URLs rather than protocol-relative URLs to axios. Even if ⁠baseURL is set, axios sends the request to the specifie…
VulnCve 2025 27152
high System graph security Trivy conf 1.00 CVE-2025-58754: axios 1.4.0 — package-lock.json
axios: Axios DoS via lack of data size check Axios is a promise based HTTP client for the browser and Node.js. When Axios starting in version 0.28.0 and prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL with the `data:` scheme, it does not perform HTTP. Instead, its Node http …
VulnCve 2025 58754
high System graph security Trivy conf 1.00 CVE-2025-65945: jws 4.0.0 — package-lock.json
node-jws: auth0/node-jws: Improper signature verification in HS256 algorithm auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under …
VulnCve 2025 65945
high System graph security Trivy conf 1.00 CVE-2025-66031: node-forge 1.3.1 — package-lock.json
node-forge: node-forge ASN.1 Unbounded Recursion Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 struc…
VulnCve 2025 66031
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 2.3.3 — package-lock.json
form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12143: form-data 4.0.0 — package-lock.json
form-data: form-data: Form field override via CRLF injection form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header with…
VulnCve 2026 12143
high System graph security Trivy conf 1.00 CVE-2026-12151: undici 5.25.2 — package-lock.json
undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream …
VulnCve 2026 12151
high System graph security Trivy conf 1.00 CVE-2026-13149: brace-expansion 1.1.11 — package-lock.json
brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a…
VulnCve 2026 13149
high System graph security Trivy conf 1.00 CVE-2026-14257: brace-expansion 1.1.11 — package-lock.json
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the lengt…
VulnCve 2026 14257
high System graph security Trivy conf 1.00 CVE-2026-1526: undici 5.25.2 — package-lock.json
undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotia…
VulnCve 2026 1526
high System graph security Trivy conf 1.00 CVE-2026-2229: undici 5.25.2 — package-lock.json
undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket clie…
VulnCve 2026 2229
high System graph security Trivy conf 1.00 CVE-2026-23745: tar 6.1.13 — package-lock.json
node-tar: tar: node-tar: Arbitrary file overwrite and symlink poisoning via unsanitized linkpaths in archives node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure be…
VulnCve 2026 23745
high System graph security Trivy conf 1.00 CVE-2026-23950: tar 6.1.13 — package-lock.json
node-tar: tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On c…
VulnCve 2026 23950
high System graph security Trivy conf 1.00 CVE-2026-24842: tar 6.1.13 — package-lock.json
node-tar: tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink crea…
VulnCve 2026 24842
high System graph security Trivy conf 1.00 CVE-2026-25639: axios 1.4.0 — package-lock.json
axios: Axios affected by Denial of Service via __proto__ Key in mergeConfig Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ a…
VulnCve 2026 25639
high System graph security Trivy conf 1.00 CVE-2026-26960: tar 6.1.13 — package-lock.json
node-tar: node-tar: Arbitrary file read/write via malicious archive hardlink creation node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outs…
VulnCve 2026 26960
high System graph security Trivy conf 1.00 CVE-2026-26996: minimatch 3.1.2 — package-lock.json
minimatch: minimatch: Denial of Service via specially crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains …
VulnCve 2026 26996
high System graph security Trivy conf 1.00 CVE-2026-27601: underscore 1.13.6 — package-lock.json
Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functions Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detaile…
VulnCve 2026 27601
high System graph security Trivy conf 1.00 CVE-2026-27903: minimatch 3.1.2 — package-lock.json
minimatch: minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne(…
VulnCve 2026 27903
high System graph security Trivy conf 1.00 CVE-2026-27904: minimatch 3.1.2 — package-lock.json
minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs prod…
VulnCve 2026 27904
high System graph security Trivy conf 1.00 CVE-2026-29786: tar 6.1.13 — package-lock.json
node-tar: hardlink path traversal via drive-relative linkpath node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables …
VulnCve 2026 29786
high System graph security Trivy conf 1.00 CVE-2026-30951: sequelize 6.31.0 — package-lock.json
sequelize: Sequelize: Data exfiltration via SQL injection in JSON/JSONB where clause processing Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extrac…
VulnCve 2026 30951
high System graph security Trivy conf 1.00 CVE-2026-31802: tar 6.1.13 — package-lock.json
tar: tar: File overwrite via drive-relative symlink traversal node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, …
VulnCve 2026 31802
high System graph security Trivy conf 1.00 CVE-2026-33036: fast-xml-parser 4.1.2 — package-lock.json
fast-xml-parser: fast-xml-parser: Denial of Service via XML entity expansion bypass fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, …
VulnCve 2026 33036
high System graph security Trivy conf 1.00 CVE-2026-33151: socket.io-parser 4.2.2 — package-lock.json
socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packets Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for …
VulnCve 2026 33151
high System graph security Trivy conf 1.00 CVE-2026-33891: node-forge 1.3.1 — package-lock.json
node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an i…
VulnCve 2026 33891
high System graph security Trivy conf 1.00 CVE-2026-33894: node-forge 1.3.1 — package-lock.json
node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent k…
VulnCve 2026 33894
high System graph security Trivy conf 1.00 CVE-2026-33895: node-forge 1.3.1 — package-lock.json
node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scala…
VulnCve 2026 33895
high System graph security Trivy conf 1.00 CVE-2026-33896: node-forge 1.3.1 — package-lock.json
node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstr…
VulnCve 2026 33896
high System graph security Trivy conf 1.00 CVE-2026-42033: axios 1.4.0 — package-lock.json
axios: Axios: HTTP Transport Hijacking via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) s…
VulnCve 2026 42033
high System graph security Trivy conf 1.00 CVE-2026-42035: axios 1.4.0 — package-lock.json
axios: Axios: Arbitrary HTTP header injection via prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, a prototype pollution gadget exists in the Axios HTTP adapter (lib/adapters/http.js) that allows an attacker to inject arbitrary HTTP …
VulnCve 2026 42035
high System graph security Trivy conf 1.00 CVE-2026-42043: axios 1.4.0 — package-lock.json
axios: Axios: NO_PROXY bypass via crafted URL Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the …
VulnCve 2026 42043
high System graph security Trivy conf 1.00 CVE-2026-42264: axios 1.4.0 — package-lock.json
axios: Axios: Prototype pollution allows information disclosure and request manipulation Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the…
VulnCve 2026 42264
high System graph security Trivy conf 1.00 CVE-2026-42334: mongoose 6.10.5 — package-lock.json
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization …
VulnCve 2026 42334
high System graph security Trivy conf 1.00 CVE-2026-44486: axios 1.4.0 — package-lock.json
axios: Axios: Information disclosure of proxy credentials via HTTP redirects Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent throug…
VulnCve 2026 44486
high System graph security Trivy conf 1.00 CVE-2026-44487: axios 1.4.0 — package-lock.json
axios: Axios: Information disclosure of proxy credentials via redirect flows Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct re…
VulnCve 2026 44487
high System graph security Trivy conf 1.00 CVE-2026-44494: axios 1.4.0 — package-lock.json
axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the applicatio…
VulnCve 2026 44494
high System graph security Trivy conf 1.00 CVE-2026-44495: axios 1.4.0 — package-lock.json
axios: Axios: Information disclosure due to prototype pollution vulnerability Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same Jav…
VulnCve 2026 44495
high System graph security Trivy conf 1.00 CVE-2026-44496: axios 1.4.0 — package-lock.json
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF co…
VulnCve 2026 44496
high System graph security Trivy conf 1.00 CVE-2026-4800: lodash 4.17.21 — package-lock.json
lodash: lodash: Arbitrary code execution via untrusted input in template imports Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both p…
VulnCve 2026 4800
high System graph security Trivy conf 1.00 CVE-2026-4867: path-to-regexp 0.1.7 — package-lock.json
path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c o…
VulnCve 2026 4867
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 3.3.3 — package-lock.json
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 7.5.9 — package-lock.json
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-48779: ws 8.11.0 — package-lock.json
ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memor…
VulnCve 2026 48779
high System graph security Trivy conf 1.00 CVE-2026-59725: engine.io 6.4.1 — package-lock.json
socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before 6.6.7, Engine.IO protocol v4 polling transport does not properly close the HTTP response for invalid binary POST r…
VulnCve 2026 59725
high System graph security Trivy conf 1.00 CVE-2026-59874: tar 6.1.13 — package-lock.json
tar: Node-tar: Denial of Service via malformed tar archive header node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, tar.replace accepts a checksum-valid tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeated…
VulnCve 2026 59874
high System graph security Trivy conf 1.00 CVE-2026-69152: brace-expansion 1.1.11 — package-lock.json
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-altern…
VulnCve 2026 69152
high System graph security Trivy conf 1.00 CVE-2026-69185: socket.io-parser 4.2.2 — package-lock.json
socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packets Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary a…
VulnCve 2026 69185
high System graph security Trivy conf 1.00 CVE-2026-73566: tar 6.1.13 — package-lock.json
tar: node-tar: Denial of Service via crafted long-path tar archive node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when ta…
VulnCve 2026 73566
high System graph security Trivy conf 1.00 CVE-2026-82659: nodemailer 6.9.1 — package-lock.json
nodemailer: Nodemailer: Arbitrary file read and Server-Side Request Forgery via raw option bypass nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request…
VulnCve 2026 82659
high System graph security Trivy conf 1.00 GHSA-2x7j-588g-ccc2: nodemailer 6.9.1 — package-lock.json
Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address list ### Summary Nodemailer's address parser (`lib/addressparser/index.js`) parses a list of comma‑separated addresses in **quadratic time — O(n²)** in the number of addresses. A s…
VulnGhsa 2x7j 588g ccc2
high System graph security security conf 1.00 Insecure pattern 'eval_used' in bot/login/loginMbasic.js:1
Found a known-risky pattern (eval_used). Review and replace if possible.
bot/login/loginMbasic.js:1 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in scripts/cmds/eval.js:72
Found a known-risky pattern (eval_used). Review and replace if possible.
scripts/cmds/eval.js:72 Eval used
high System graph security security conf 1.00 Insecure pattern 'eval_used' in update.js:4
Found a known-risky pattern (eval_used). Review and replace if possible.
update.js:4 Eval used
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in Goat.js:27
Found a known-risky pattern (node_child_process). Review and replace if possible.
Goat.js:27 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in index.js:20
Found a known-risky pattern (node_child_process). Review and replace if possible.
index.js:20 Node child process
high System graph security security conf 0.90 Insecure pattern 'node_child_process' in scripts/cmds/cmd.js:2
Found a known-risky pattern (node_child_process). Review and replace if possible.
scripts/cmds/cmd.js:2 Node child process
high System graph security Secrets conf 0.72 Possible secret in scripts/cmds/weather.js
Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager.
scripts/cmds/weather.js:39 Generic api key
high System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-3g43-6gmg-66jw
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-3g43-6gmg-66jw (aka CVE-2026-44495). axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge Aliases: CVE-2026-44495 Advisory: https://osv.dev/vulne…
package-lock.json ScaOsvGhsa 3g43 6gmg 66jw
high System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-43fc-jf86-j433
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-43fc-jf86-j433 (aka CVE-2026-25639). Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig Aliases: CVE-2026-25639 Advisory: https://osv.dev/vulnerability/GHSA-43fc-jf86-j433 Fix:…
package-lock.json ScaOsvGhsa 43fc jf86 j433
high System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-3g43-6gmg-66jw
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-3g43-6gmg-66jw (aka CVE-2026-44495). axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge Aliases: CVE-2026-44495 Advisory: https://osv.dev/vulner…
package.json ScaOsvGhsa 3g43 6gmg 66jw
high System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-43fc-jf86-j433
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-43fc-jf86-j433 (aka CVE-2026-25639). Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig Aliases: CVE-2026-25639 Advisory: https://osv.dev/vulnerability/GHSA-43fc-jf86-j433 Fix: …
package.json ScaOsvGhsa 43fc jf86 j433
high System graph dependencies dependencies conf 0.90 Vulnerable dependency cross-spawn 6.0.5: GHSA-3xgq-45jj-v275
OSV.dev reports `cross-spawn` at version `6.0.5` (resolved in `package-lock.json`) is affected by GHSA-3xgq-45jj-v275 (aka CVE-2024-21538). Note: `cross-spawn` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Regular Expression Denial of Service (ReDo…
package-lock.json ScaOsvGhsa 3xgq 45jj v275
high System graph dependencies dependencies conf 0.90 Vulnerable dependency cross-spawn 7.0.3: GHSA-3xgq-45jj-v275
OSV.dev reports `cross-spawn` at version `7.0.3` (resolved in `package-lock.json`) is affected by GHSA-3xgq-45jj-v275 (aka CVE-2024-21538). Note: `cross-spawn` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Regular Expression Denial of Service (ReDo…
package-lock.json ScaOsvGhsa 3xgq 45jj v275
high System graph dependencies dependencies conf 0.90 Vulnerable dependency flatted 2.0.2: GHSA-25h7-pfq9-p65f
OSV.dev reports `flatted` at version `2.0.2` (resolved in `package-lock.json`) is affected by GHSA-25h7-pfq9-p65f (aka CVE-2026-32141). Note: `flatted` is a transitive dependency — pulled in by another package, not declared directly in a manifest. flatted vulnerable to unbounded recursion DoS in p…
package-lock.json ScaOsvGhsa 25h7 pfq9 p65f
high System graph dependencies dependencies conf 0.90 Vulnerable dependency flatted 3.2.7: GHSA-25h7-pfq9-p65f
OSV.dev reports `flatted` at version `3.2.7` (resolved in `package-lock.json`) is affected by GHSA-25h7-pfq9-p65f (aka CVE-2026-32141). Note: `flatted` is a transitive dependency — pulled in by another package, not declared directly in a manifest. flatted vulnerable to unbounded recursion DoS in p…
package-lock.json ScaOsvGhsa 25h7 pfq9 p65f
high System graph dependencies dependencies conf 0.90 Vulnerable dependency ws 7.4.6: GHSA-3h5v-q93c-6h6q
OSV.dev reports `ws` at version `7.4.6` (resolved in `package-lock.json`) is affected by GHSA-3h5v-q93c-6h6q (aka CVE-2024-37890). Note: `ws` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ws affected by a DoS when handling a request with many HTTP …
package-lock.json ScaOsvGhsa 3h5v q93c 6h6q
high System graph dependencies dependencies conf 0.90 Vulnerable dependency ws 7.4.6: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `7.4.6` (resolved in `package-lock.json`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). Note: `ws` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ws: Memory exhaustion DoS from tiny fragments and data chunk…
package-lock.json ScaOsvGhsa 96hv 2xvq fx4p
high System graph dependencies dependencies conf 0.90 Vulnerable dependency ws 7.5.9: GHSA-3h5v-q93c-6h6q
OSV.dev reports `ws` at version `7.5.9` (resolved in `package-lock.json`) is affected by GHSA-3h5v-q93c-6h6q (aka CVE-2024-37890). Note: `ws` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ws affected by a DoS when handling a request with many HTTP …
package-lock.json ScaOsvGhsa 3h5v q93c 6h6q
high System graph dependencies dependencies conf 0.90 Vulnerable dependency ws 7.5.9: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `7.5.9` (resolved in `package-lock.json`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). Note: `ws` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ws: Memory exhaustion DoS from tiny fragments and data chunk…
package-lock.json ScaOsvGhsa 96hv 2xvq fx4p
high System graph dependencies dependencies conf 0.90 Vulnerable dependency ws 8.11.0: GHSA-3h5v-q93c-6h6q
OSV.dev reports `ws` at version `8.11.0` (resolved in `package-lock.json`) is affected by GHSA-3h5v-q93c-6h6q (aka CVE-2024-37890). Note: `ws` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ws affected by a DoS when handling a request with many HTTP…
package-lock.json ScaOsvGhsa 3h5v q93c 6h6q
high System graph dependencies dependencies conf 0.90 Vulnerable dependency ws 8.11.0: GHSA-96hv-2xvq-fx4p
OSV.dev reports `ws` at version `8.11.0` (resolved in `package-lock.json`) is affected by GHSA-96hv-2xvq-fx4p (aka CVE-2026-48779). Note: `ws` is a transitive dependency — pulled in by another package, not declared directly in a manifest. ws: Memory exhaustion DoS from tiny fragments and data chun…
package-lock.json ScaOsvGhsa 96hv 2xvq fx4p
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security Trivy conf 1.00 CVE-2021-32050: mongodb 4.14.0 — package-lock.json
Some MongoDB Drivers may erroneously publish events containing authent ... Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentic…
VulnCve 2021 32050
medium System graph security Trivy conf 1.00 CVE-2023-26136: tough-cookie 2.5.0 — package-lock.json
tough-cookie: prototype pollution in cookie memstore Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initi…
VulnCve 2023 26136
medium System graph security Trivy conf 1.00 CVE-2023-26159: follow-redirects 1.15.2 — package-lock.json
follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, i…
VulnCve 2023 26159
medium System graph security Trivy conf 1.00 CVE-2023-28155: request 2.88.2 — package-lock.json
request: bypass of SSRF mitigations when following a cross-protocol redirect The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only aff…
VulnCve 2023 28155
medium System graph security Trivy conf 1.00 CVE-2023-31125: engine.io 6.4.1 — package-lock.json
engine.io: Uncaught exception in engine.io Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent pac…
VulnCve 2023 31125
medium System graph security Trivy conf 1.00 CVE-2023-32695: socket.io-parser 4.2.2 — package-lock.json
socket.io parser is a socket.io encoder and decoder written in JavaScr ... socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus …
VulnCve 2023 32695
medium System graph security Trivy conf 1.00 CVE-2023-45857: axios 1.4.0 — package-lock.json
axios: exposure of confidential data stored in cookies An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information. Packag…
VulnCve 2023 45857
medium System graph security Trivy conf 1.00 CVE-2024-28849: follow-redirects 1.15.2 — package-lock.json
follow-redirects: Possible credential leak follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-aut…
VulnCve 2024 28849
medium System graph security Trivy conf 1.00 CVE-2024-28863: tar 6.1.13 — package-lock.json
node-tar: denial of service while parsing a tar file due to lack of folders depth validation node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can …
VulnCve 2024 28863
medium System graph security Trivy conf 1.00 CVE-2024-29041: express 4.18.2 — package-lock.json
express: cause malformed URLs to be evaluated Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect usin…
VulnCve 2024 29041
medium System graph security Trivy conf 1.00 CVE-2024-38355: socket.io 4.6.1 — package-lock.json
socket.io: Unhandled 'error' event Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc2…
VulnCve 2024 38355
medium System graph security Trivy conf 1.00 CVE-2025-13033: nodemailer 6.9.1 — package-lock.json
nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address th…
VulnCve 2025 13033
medium System graph security Trivy conf 1.00 CVE-2025-13465: lodash 4.17.21 — package-lock.json
lodash: prototype pollution in _.unset and _.omit functions Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion o…
VulnCve 2025 13465
medium System graph security Trivy conf 1.00 CVE-2025-15284: qs 6.11.0 — package-lock.json
qs: qs: Denial of Service via improper input validation in array parsing Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed…
VulnCve 2025 15284
medium System graph security Trivy conf 1.00 CVE-2025-15284: qs 6.11.1 — package-lock.json
qs: qs: Denial of Service via improper input validation in array parsing Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed…
VulnCve 2025 15284
medium System graph security Trivy conf 1.00 CVE-2025-15284: qs 6.5.3 — package-lock.json
qs: qs: Denial of Service via improper input validation in array parsing Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed…
VulnCve 2025 15284
medium System graph security Trivy conf 1.00 CVE-2025-22150: undici 5.25.2 — package-lock.json
undici: Undici Uses Insufficiently Random Values Undici is an HTTP/1.1 client. Starting in version 4.5.0 and prior to versions 5.28.5, 6.21.1, and 7.2.3, undici uses `Math.random()` to choose the boundary for a multipart/form-data request. It is known that the output of `Math.random()` can be pred…
VulnCve 2025 22150
medium System graph security Trivy conf 1.00 CVE-2025-56200: validator 13.9.0 — package-lock.json
validator.js has a URL validation bypass vulnerability in its isURL function A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference al…
VulnCve 2025 56200
medium System graph security Trivy conf 1.00 CVE-2025-62718: axios 1.4.0 — package-lock.json
axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback …
VulnCve 2025 62718
medium System graph security Trivy conf 1.00 CVE-2025-66030: node-forge 1.3.1 — package-lock.json
node-forge: node-forge: Integer Overflow allows OID-based security bypass Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to cra…
VulnCve 2025 66030
medium System graph security Trivy conf 1.00 CVE-2025-69873: ajv 6.12.6 — package-lock.json
ajv: ReDoS via $data reference ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaS…
VulnCve 2025 69873
medium System graph security Trivy conf 1.00 CVE-2026-15157: undici 5.25.2 — package-lock.json
undici: undici: HTTP header injection via unvalidated blob-like body type property undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and f…
VulnCve 2026 15157
medium System graph security Trivy conf 1.00 CVE-2026-1525: undici 5.25.2 — package-lock.json
undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests w…
VulnCve 2026 1525
medium System graph security Trivy conf 1.00 CVE-2026-1527: undici 5.25.2 — package-lock.json
undici: Undici: HTTP header injection and request smuggling vulnerability ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to: * Inject arbitrary HTTP headers * Terminate the HTTP request premature…
VulnCve 2026 1527
medium System graph security Trivy conf 1.00 CVE-2026-16728: undici 5.25.2 — package-lock.json
undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.…
VulnCve 2026 16728
medium System graph security Trivy conf 1.00 CVE-2026-16729: undici 5.25.2 — package-lock.json
undici: Undici: Cookie attribute injection allows bypassing security protections undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entri…
VulnCve 2026 16729
medium System graph security Trivy conf 1.00 CVE-2026-22036: undici 5.25.2 — package-lock.json
undici: Undici: Denial of Service via excessive decompression steps Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is unbounded and the default maxHeaderSize allows a malicious server to insert thousands compression steps leadin…
VulnCve 2026 22036
medium System graph security Trivy conf 1.00 CVE-2026-2950: lodash 4.17.21 — package-lock.json
lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/…
VulnCve 2026 2950
medium System graph security Trivy conf 1.00 CVE-2026-33349: fast-xml-parser 4.1.2 — package-lock.json
fast-xml-parser: fast-xml-parser: Denial of Service via unbounded entity expansion due to incorrect configuration limit handling fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From version 4.0.0-beta.3 to before version 5.5.7, the DocTypeRead…
VulnCve 2026 33349
medium System graph security Trivy conf 1.00 CVE-2026-33750: brace-expansion 1.1.11 — package-lock.json
brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) caus…
VulnCve 2026 33750
medium System graph security Trivy conf 1.00 CVE-2026-40175: axios 1.4.0 — package-lock.json
axios: Axios: Remote Code Execution via Prototype Pollution escalation Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leverag…
VulnCve 2026 40175
medium System graph security Trivy conf 1.00 CVE-2026-41650: fast-xml-parser 4.1.2 — package-lock.json
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or th…
VulnCve 2026 41650
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 3.4.0 — package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-41907: uuid 8.3.2 — package-lock.json
uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silen…
VulnCve 2026 41907
medium System graph security Trivy conf 1.00 CVE-2026-42034: axios 1.4.0 — package-lock.json
axios: Axios: Denial of Service via oversized streamed uploads bypassing body limits Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, for stream request bodies, maxBodyLength is bypassed when maxRedirects is set to 0 (native http/https transport path). …
VulnCve 2026 42034
medium System graph security Trivy conf 1.00 CVE-2026-42036: axios 1.4.0 — package-lock.json
axios: Axios: Denial of Service via unbounded stream consumption when 'responseType: 'stream'' is used Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLe…
VulnCve 2026 42036
medium System graph security Trivy conf 1.00 CVE-2026-42037: axios 1.4.0 — package-lock.json
axios: Node.js: Axios: Information disclosure via CRLF injection in multipart Content-Type header Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.1, the FormDataPart constructor in lib/helpers/formDataToStream.js interpolates value.type directly into the…
VulnCve 2026 42037
medium System graph security Trivy conf 1.00 CVE-2026-42038: axios 1.4.0 — package-lock.json
axios: Axios: Information disclosure due to `no_proxy` bypass Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route t…
VulnCve 2026 42038
medium System graph security Trivy conf 1.00 CVE-2026-42039: axios 1.4.0 — package-lock.json
axios: Node.js: Axios: Denial of Service via unbounded recursion in toFormData with deeply nested request data Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value pas…
VulnCve 2026 42039
medium System graph security Trivy conf 1.00 CVE-2026-42041: axios 1.4.0 — package-lock.json
axios: Axios: Authentication bypass due to prototype pollution of HTTP error handling Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution to…
VulnCve 2026 42041
medium System graph security Trivy conf 1.00 CVE-2026-42042: axios 1.4.0 — package-lock.json
axios: Axios: XSRF token bypass leading to information disclosure Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXS…
VulnCve 2026 42042
medium System graph security Trivy conf 1.00 CVE-2026-42044: axios 1.4.0 — package-lock.json
axios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the ap…
VulnCve 2026 42044
medium System graph security Trivy conf 1.00 CVE-2026-44490: axios 1.4.0 — package-lock.json
axios: Axios: Information disclosure and denial of service due to prototype pollution Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets. When Object.prototype is polluted by an upstream dependency i…
VulnCve 2026 44490
medium System graph security Trivy conf 1.00 CVE-2026-45736: ws 8.11.0 — package-lock.json
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument.…
VulnCve 2026 45736
medium System graph security Trivy conf 1.00 CVE-2026-53655: tar 6.1.13 — package-lock.json
node-tar: node-tar: File smuggling due to inconsistent tar archive parsing node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar (node-tar) applies a PAX extended header's size= record (and other PAX overrides) to the next header entry of any type, including intermediary metadata heade…
VulnCve 2026 53655
medium System graph security Trivy conf 1.00 CVE-2026-59871: tar 6.1.13 — package-lock.json
node-tar: node-tar: Denial of Service due to incorrect PAX path handling node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindo…
VulnCve 2026 59871
medium System graph security Trivy conf 1.00 CVE-2026-59875: tar 6.1.13 — package-lock.json
node-tar: node-tar: Denial of Service via crafted archive with NUL bytes in metadata node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip NUL bytes from PAX path and linkpath records in src/pax.ts, allowing a crafted archive with values to reach fs.l…
VulnCve 2026 59875
medium System graph security Trivy conf 1.00 CVE-2026-67312: axios 1.4.0 — package-lock.json
axios: axios: Denial of Service via uncontrolled recursion in form data processing axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: …
VulnCve 2026 67312
medium System graph security Trivy conf 1.00 CVE-2026-67313: axios 1.4.0 — package-lock.json
axios versions 0.28.0 and later contain uncontrolled recursion in form ... axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket segments. Attackers can supply FormData with field names containing thousands …
VulnCve 2026 67313
medium System graph security Trivy conf 1.00 CVE-2026-67316: axios 1.4.0 — package-lock.json
axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyles…
VulnCve 2026 67316
medium System graph security Trivy conf 1.00 CVE-2026-67319: axios 1.4.0 — package-lock.json
axios: axios: Information disclosure and data manipulation via prototype pollution axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While th…
VulnCve 2026 67319
medium System graph security Trivy conf 1.00 CVE-2026-73562: mongoose 6.10.5 — package-lock.json
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such…
VulnCve 2026 73562
medium System graph security Trivy conf 1.00 CVE-2026-82417: qs 6.11.0 — package-lock.json
qs: qs: Denial of Service via improper validation in stringify function ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isB…
VulnCve 2026 82417
medium System graph security Trivy conf 1.00 CVE-2026-82417: qs 6.11.1 — package-lock.json
qs: qs: Denial of Service via improper validation in stringify function ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isB…
VulnCve 2026 82417
medium System graph security Trivy conf 1.00 CVE-2026-82417: qs 6.5.3 — package-lock.json
qs: qs: Denial of Service via improper validation in stringify function ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isB…
VulnCve 2026 82417
medium System graph security Trivy conf 1.00 CVE-2026-8723: qs 6.11.1 — package-lock.json
qs: qs: Denial of Service due to improper handling of null/undefined array elements ### Summary `qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of…
VulnCve 2026 8723
medium System graph security Trivy conf 1.00 CVE-2026-9679: undici 5.25.2 — package-lock.json
undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not spe…
VulnCve 2026 9679
medium System graph dependencies dependencies conf 0.90 Dependency eta is two or more major versions behind
`eta` is pinned at `1.12.3` in `package.json` while the latest release on the npm registry is `4.6.0` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `eta` to `4.6.0`.
package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency express-rate-limit is two or more major versions behind
`express-rate-limit` is pinned at `6.5.2` in `package.json` while the latest release on the npm registry is `8.7.0` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `express-rate-limit` t…
package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency googleapis is two or more major versions behind
`googleapis` is pinned at `100.0.0` in `package.json` while the latest release on the npm registry is `181.0.0` — 81 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `googleapis` to `181.0.0`.
package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency mongoose is two or more major versions behind
`mongoose` is pinned at `6.3.1` in `package.json` while the latest release on the npm registry is `9.10.1` — 3 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `mongoose` to `9.10.1`.
package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency nodemailer is two or more major versions behind
`nodemailer` is pinned at `6.7.5` in `package.json` while the latest release on the npm registry is `10.0.10` — 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `nodemailer` to `10.0.10`.
package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency ora is two or more major versions behind
`ora` is pinned at `5.4.1` in `package.json` while the latest release on the npm registry is `9.4.1` — 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `ora` to `9.4.1`.
package.json FreshnessOutdated
medium System graph dependencies dependencies conf 0.90 Dependency totp-generator is two or more major versions behind
`totp-generator` is pinned at `0.0.13` in `package.json` while the latest release on the npm registry is `2.0.1` — 2 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `totp-generator` to `2.0.…
package.json FreshnessOutdated
medium System graph security Semgrep conf 0.55 detect child process — Goat.js:37
Detected calls to child_process from a function argument `pathDir`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child-…
Goat.js:37 SecurityJavascript
medium System graph security Semgrep conf 0.55 detect child process — scripts/cmds/cmd.js:327
Detected calls to child_process from a function argument `fileName`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. Rule: javascript.lang.security.detect-child…
scripts/cmds/cmd.js:327 SecurityJavascript
medium System graph security Trivy conf 1.00 GHSA-268h-hp4c-crq3: nodemailer 6.9.1 — package-lock.json
Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection ### Summary Nodemailer constructs `List-*` headers from the caller-provided `list` message option using internally prepared header values. The `list.*.comment` field is inserted into those pr…
VulnGhsa 268h hp4c crq3
medium System graph security Trivy conf 1.00 GHSA-8m3c-c648-2xjj: nodemailer 6.9.1 — package-lock.json
Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature ### Summary Nodemailer's `disableFileAccess` / `disableUrlAccess` options are a security sandbox that lets an application forbid untrusted message content (`html`/`text`…
VulnGhsa 8m3c c648 2xjj
medium System graph security Trivy conf 1.00 GHSA-9h6g-pr28-7cqp: nodemailer 6.9.1 — package-lock.json
nodemailer ReDoS when trying to send a specially crafted email ### Summary A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter `attachDataUrls` set, causing the stuck of event loop. Another flaw was found when nodemailer tries to parse an attachments with a em…
VulnGhsa 9h6g pr28 7cqp
medium System graph security Trivy conf 1.00 GHSA-r4q5-vmmm-2653: follow-redirects 1.15.2 — package-lock.json
follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets ## Summary When an HTTP request follows a cross-domain redirect (301/302/307/308), `follow-redirects` only strips `authorization`, `proxy-authorization`, and `cookie` headers (matched by regex at index.js:469-47…
VulnGhsa r4q5 vmmm 2653
medium System graph security Trivy conf 1.00 GHSA-r7g4-qg5f-qqm2: nodemailer 6.9.1 — package-lock.json
Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception ### Summary Nodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js. As a result, OAuth2 token r…
VulnGhsa r7g4 qg5f qqm2
medium System graph security Trivy conf 1.00 GHSA-vvjj-xcjg-gr5g: nodemailer 6.9.1 — package-lock.json
Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) ### Summary Nodemailer versions up to and including 8.0.4 are vulnerable to SMTP command injection via CRLF sequences in the transport `name` configuration option. The `name` value is used directly in t…
VulnGhsa vvjj xcjg gr5g
medium System graph security Trivy conf 1.00 GHSA-wmmp-3585-3rmp: nodemailer 6.9.1 — package-lock.json
Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain ### Summary Nodemailer resolves an international (IDN / non-ASCII) recipient **domain** to a different Punycode `xn--` label than every UTS‑46‑conformant parser (web browsers, the WHATWG URL…
VulnGhsa wmmp 3585 3rmp
medium System graph security Trivy conf 1.00 GHSA-wqvq-jvpq-h66f: nodemailer 6.9.1 — package-lock.json
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization ### Summary Nodemailer's `disableFileAccess` and `disableUrlAccess` options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME stre…
VulnGhsa wqvq jvpq h66f
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/bootstrap.bundle.min.js:3049
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
dashboard/js/bootstrap.bundle.min.js:3049 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/preview-modal.js:4
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
dashboard/js/preview-modal.js:4 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'direct_innerhtml_assignment' in dashboard/js/toast.js:43
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
dashboard/js/toast.js:43 Direct innerhtml assignment
medium System graph security security conf 0.65 Insecure pattern 'domparser_html_parse' in dashboard/js/bootstrap.bundle.min.js:3078
Found a known-risky pattern (domparser_html_parse). Review and replace if possible.
dashboard/js/bootstrap.bundle.min.js:3078 Domparser html parse
medium System graph quality Tests conf 1.00 Very low test-to-source ratio
0 test file(s) for 195 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.
Coverage
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/runtime 7.21.0: GHSA-968p-4wvh-cqc8
OSV.dev reports `@babel/runtime` at version `7.21.0` (resolved in `package-lock.json`) is affected by GHSA-968p-4wvh-cqc8. Note: `@babel/runtime` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vul…
package-lock.json ScaOsvGhsa 968p 4wvh cqc8
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @babel/traverse 7.21.4: GHSA-67hx-6x53-jw92
OSV.dev reports `@babel/traverse` at version `7.21.4` (resolved in `package-lock.json`) is affected by GHSA-67hx-6x53-jw92. Note: `@babel/traverse` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/v…
package-lock.json ScaOsvGhsa 67hx 6x53 jw92
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency @tootallnate/once 1.1.2: GHSA-vpq2-c234-7xj6
OSV.dev reports `@tootallnate/once` at version `1.1.2` (resolved in `package-lock.json`) is affected by GHSA-vpq2-c234-7xj6. Note: `@tootallnate/once` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Note: `@tootallnate/once` is an optional dependency …
package-lock.json ScaOsvGhsa vpq2 c234 7xj6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ajv 6.12.6: GHSA-2g4f-4pwh-qvx6
OSV.dev reports `ajv` at version `6.12.6` (resolved in `package-lock.json`) is affected by GHSA-2g4f-4pwh-qvx6. Note: `ajv` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-2g4f-4…
package-lock.json ScaOsvGhsa 2g4f 4pwh qvx6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-3p68-rc4w-qgx5
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-3p68-rc4w-qgx5 (aka CVE-2025-62718). Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF Aliases: CVE-2025-62718 Advisory: https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5 Fix: upg…
package-lock.json ScaOsvGhsa 3p68 rc4w qgx5
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-5c9x-8gcm-mpgx
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-5c9x-8gcm-mpgx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5c9x-8gcm-mpgx Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa 5c9x 8gcm mpgx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-62hf-57xw-28j9
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-62hf-57xw-28j9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-62hf-57xw-28j9 Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa 62hf 57xw 28j9
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-6chq-wfr3-2hj9
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-6chq-wfr3-2hj9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9 Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa 6chq wfr3 2hj9
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-7q8q-rj6j-mhjq
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-7q8q-rj6j-mhjq. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa 7q8q rj6j mhjq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-898c-q2cr-xwhg
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-898c-q2cr-xwhg. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa 898c q2cr xwhg
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-fvcv-3m26-pcqx
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-fvcv-3m26-pcqx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fvcv-3m26-pcqx Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa fvcv 3m26 pcqx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-hfxv-24rg-xrqf
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-hfxv-24rg-xrqf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hfxv-24rg-xrqf Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa hfxv 24rg xrqf
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-j5f8-grm9-p9fc
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-j5f8-grm9-p9fc. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-j5f8-grm9-p9fc Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa j5f8 grm9 p9fc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-jr5f-v2jv-69x6
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-jr5f-v2jv-69x6. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jr5f-v2jv-69x6 Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa jr5f v2jv 69x6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-m7pr-hjqh-92cm
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-m7pr-hjqh-92cm. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m7pr-hjqh-92cm Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa m7pr hjqh 92cm
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-mmx7-hfxf-jppx
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-mmx7-hfxf-jppx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa mmx7 hfxf jppx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-p92q-9vqr-4j8v
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-p92q-9vqr-4j8v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p92q-9vqr-4j8v Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa p92q 9vqr 4j8v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-pf86-5x62-jrwf
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-pf86-5x62-jrwf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pf86-5x62-jrwf Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa pf86 5x62 jrwf
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-pjwm-pj3p-43mv
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-pjwm-pj3p-43mv. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pjwm-pj3p-43mv Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa pjwm pj3p 43mv
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-pmwg-cvhr-8vh7
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-pmwg-cvhr-8vh7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pmwg-cvhr-8vh7 Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa pmwg cvhr 8vh7
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-vf2m-468p-8v99
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-vf2m-468p-8v99. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vf2m-468p-8v99 Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa vf2m 468p 8v99
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-w9j2-pvgh-6h63
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-w9j2-pvgh-6h63. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w9j2-pvgh-6h63 Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa w9j2 pvgh 6h63
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-wf5p-g6vw-rhxx
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-wf5p-g6vw-rhxx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa wf5p g6vw rhxx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-xhjh-pmcv-23jw
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-xhjh-pmcv-23jw. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xhjh-pmcv-23jw Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa xhjh pmcv 23jw
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency axios 0.21.4: GHSA-xx6v-rp6x-q39c
OSV.dev reports `axios` at version `0.21.4` (resolved in `package-lock.json`) is affected by GHSA-xx6v-rp6x-q39c. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xx6v-rp6x-q39c Fix: upgrade `axios` past the affected range per the advisory.
package-lock.json ScaOsvGhsa xx6v rp6x q39c
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-35jp-ww65-95wh
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-35jp-ww65-95wh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-35jp-ww65-95wh Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 35jp ww65 95wh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-3p68-rc4w-qgx5
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-3p68-rc4w-qgx5 (aka CVE-2025-62718). Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF Aliases: CVE-2025-62718 Advisory: https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5 Fix: upgr…
package.json ScaOsvGhsa 3p68 rc4w qgx5
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-3w6x-2g7m-8v23
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-3w6x-2g7m-8v23. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-3w6x-2g7m-8v23 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 3w6x 2g7m 8v23
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-42h9-826w-cgv3
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-42h9-826w-cgv3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-42h9-826w-cgv3 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 42h9 826w cgv3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-445q-vr5w-6q77
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-445q-vr5w-6q77. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-445q-vr5w-6q77 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 445q vr5w 6q77
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-4hjh-wcwx-xvwj
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-4hjh-wcwx-xvwj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-4hjh-wcwx-xvwj Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 4hjh wcwx xvwj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-5c9x-8gcm-mpgx
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-5c9x-8gcm-mpgx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-5c9x-8gcm-mpgx Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 5c9x 8gcm mpgx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-62hf-57xw-28j9
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-62hf-57xw-28j9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-62hf-57xw-28j9 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 62hf 57xw 28j9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-6chq-wfr3-2hj9
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-6chq-wfr3-2hj9. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6chq-wfr3-2hj9 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 6chq wfr3 2hj9
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-7q8q-rj6j-mhjq
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-7q8q-rj6j-mhjq. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-7q8q-rj6j-mhjq Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 7q8q rj6j mhjq
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-898c-q2cr-xwhg
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-898c-q2cr-xwhg. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-898c-q2cr-xwhg Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 898c q2cr xwhg
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-8hc4-vh64-cxmj
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-8hc4-vh64-cxmj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8hc4-vh64-cxmj Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa 8hc4 vh64 cxmj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-fvcv-3m26-pcqx
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-fvcv-3m26-pcqx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fvcv-3m26-pcqx Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa fvcv 3m26 pcqx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-hfxv-24rg-xrqf
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-hfxv-24rg-xrqf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hfxv-24rg-xrqf Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa hfxv 24rg xrqf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-j5f8-grm9-p9fc
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-j5f8-grm9-p9fc. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-j5f8-grm9-p9fc Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa j5f8 grm9 p9fc
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-jr5f-v2jv-69x6
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-jr5f-v2jv-69x6. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-jr5f-v2jv-69x6 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa jr5f v2jv 69x6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-m7pr-hjqh-92cm
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-m7pr-hjqh-92cm. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m7pr-hjqh-92cm Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa m7pr hjqh 92cm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-mmx7-hfxf-jppx
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-mmx7-hfxf-jppx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mmx7-hfxf-jppx Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa mmx7 hfxf jppx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-p92q-9vqr-4j8v
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-p92q-9vqr-4j8v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p92q-9vqr-4j8v Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa p92q 9vqr 4j8v
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-pf86-5x62-jrwf
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-pf86-5x62-jrwf. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pf86-5x62-jrwf Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa pf86 5x62 jrwf
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-pmv8-rq9r-6j72
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-pmv8-rq9r-6j72. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pmv8-rq9r-6j72 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa pmv8 rq9r 6j72
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-pmwg-cvhr-8vh7
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-pmwg-cvhr-8vh7. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-pmwg-cvhr-8vh7 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa pmwg cvhr 8vh7
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-q8qp-cvcw-x6jj
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-q8qp-cvcw-x6jj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q8qp-cvcw-x6jj Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa q8qp cvcw x6jj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-vf2m-468p-8v99
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-vf2m-468p-8v99. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vf2m-468p-8v99 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa vf2m 468p 8v99
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-w9j2-pvgh-6h63
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-w9j2-pvgh-6h63. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w9j2-pvgh-6h63 Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa w9j2 pvgh 6h63
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-wf5p-g6vw-rhxx
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-wf5p-g6vw-rhxx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wf5p-g6vw-rhxx Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa wf5p g6vw rhxx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-xhjh-pmcv-23jw
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-xhjh-pmcv-23jw. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xhjh-pmcv-23jw Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa xhjh pmcv 23jw
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency axios 1.4.0: GHSA-xx6v-rp6x-q39c
OSV.dev reports `axios` at version `1.4.0` (resolved in `package-lock.json`) is affected by GHSA-xx6v-rp6x-q39c. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xx6v-rp6x-q39c Fix: upgrade `axios` past the affected range per the advisory.
package.json ScaOsvGhsa xx6v rp6x q39c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency basic-ftp 5.0.4: GHSA-5rq4-664w-9x2c
OSV.dev reports `basic-ftp` at version `5.0.4` (resolved in `package-lock.json`) is affected by GHSA-5rq4-664w-9x2c. Note: `basic-ftp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/…
package-lock.json ScaOsvGhsa 5rq4 664w 9x2c
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency basic-ftp 5.0.4: GHSA-6v7q-wjvx-w8wg
OSV.dev reports `basic-ftp` at version `5.0.4` (resolved in `package-lock.json`) is affected by GHSA-6v7q-wjvx-w8wg. Note: `basic-ftp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/…
package-lock.json ScaOsvGhsa 6v7q wjvx w8wg
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency basic-ftp 5.0.4: GHSA-rp42-5vxx-qpwr
OSV.dev reports `basic-ftp` at version `5.0.4` (resolved in `package-lock.json`) is affected by GHSA-rp42-5vxx-qpwr. Note: `basic-ftp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/…
package-lock.json ScaOsvGhsa rp42 5vxx qpwr
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency basic-ftp 5.0.4: GHSA-rpmf-866q-6p89
OSV.dev reports `basic-ftp` at version `5.0.4` (resolved in `package-lock.json`) is affected by GHSA-rpmf-866q-6p89. Note: `basic-ftp` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/…
package-lock.json ScaOsvGhsa rpmf 866q 6p89
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency body-parser 1.20.1: GHSA-qwcr-r2fm-qrc7
OSV.dev reports `body-parser` at version `1.20.1` (resolved in `package-lock.json`) is affected by GHSA-qwcr-r2fm-qrc7. Note: `body-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
package-lock.json ScaOsvGhsa qwcr r2fm qrc7
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency body-parser 1.20.1: GHSA-v422-hmwv-36x6
OSV.dev reports `body-parser` at version `1.20.1` (resolved in `package-lock.json`) is affected by GHSA-v422-hmwv-36x6. Note: `body-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerabi…
package-lock.json ScaOsvGhsa v422 hmwv 36x6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.11: GHSA-3jxr-9vmj-r5cp
OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/v…
package-lock.json ScaOsvGhsa 3jxr 9vmj r5cp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.11: GHSA-f886-m6hf-6m8v
OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-f886-m6hf-6m8v. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/v…
package-lock.json ScaOsvGhsa f886 m6hf 6m8v
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.11: GHSA-mh99-v99m-4gvg
OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-mh99-v99m-4gvg. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/v…
package-lock.json ScaOsvGhsa mh99 v99m 4gvg
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.11: GHSA-rgw5-rvv9-x895
OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-rgw5-rvv9-x895. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/v…
package-lock.json ScaOsvGhsa rgw5 rvv9 x895
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency brace-expansion 1.1.11: GHSA-v6h2-p8h4-qcjw
OSV.dev reports `brace-expansion` at version `1.1.11` (resolved in `package-lock.json`) is affected by GHSA-v6h2-p8h4-qcjw. Note: `brace-expansion` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/v…
package-lock.json ScaOsvGhsa v6h2 p8h4 qcjw
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency braces 3.0.2: GHSA-grv7-fg5c-xmjg
OSV.dev reports `braces` at version `3.0.2` (resolved in `package-lock.json`) is affected by GHSA-grv7-fg5c-xmjg. Note: `braces` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-g…
package-lock.json ScaOsvGhsa grv7 fg5c xmjg
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency dottie 2.0.3: GHSA-4gxf-g5gf-22h4
OSV.dev reports `dottie` at version `2.0.3` (resolved in `package-lock.json`) is affected by GHSA-4gxf-g5gf-22h4. Note: `dottie` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-4…
package-lock.json ScaOsvGhsa 4gxf g5gf 22h4
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency engine.io 6.4.1: GHSA-q9mw-68c2-j6m5
OSV.dev reports `engine.io` at version `6.4.1` (resolved in `package-lock.json`) is affected by GHSA-q9mw-68c2-j6m5. Note: `engine.io` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/…
package-lock.json ScaOsvGhsa q9mw 68c2 j6m5
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency engine.io 6.4.1: GHSA-r635-g3xr-vw7x
OSV.dev reports `engine.io` at version `6.4.1` (resolved in `package-lock.json`) is affected by GHSA-r635-g3xr-vw7x. Note: `engine.io` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/…
package-lock.json ScaOsvGhsa r635 g3xr vw7x
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency eta 1.12.3: GHSA-mf6x-hrgr-658f
OSV.dev reports `eta` at version `1.12.3` (resolved in `package-lock.json`) is affected by GHSA-mf6x-hrgr-658f. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mf6x-hrgr-658f Fix: upgrade `eta` past the affected range per the advisory.
package.json ScaOsvGhsa mf6x hrgr 658f
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency eta 1.12.3: GHSA-xrh7-m5pp-39r6
OSV.dev reports `eta` at version `1.12.3` (resolved in `package-lock.json`) is affected by GHSA-xrh7-m5pp-39r6. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-xrh7-m5pp-39r6 Fix: upgrade `eta` past the affected range per the advisory.
package.json ScaOsvGhsa xrh7 m5pp 39r6
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency express 4.18.2: GHSA-qw6h-vgh9-j6wx
OSV.dev reports `express` at version `4.18.2` (resolved in `package-lock.json`) is affected by GHSA-qw6h-vgh9-j6wx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-qw6h-vgh9-j6wx Fix: upgrade `express` past the affected range per the advisory.
package.json ScaOsvGhsa qw6h vgh9 j6wx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency express 4.18.2: GHSA-rv95-896h-c2vc
OSV.dev reports `express` at version `4.18.2` (resolved in `package-lock.json`) is affected by GHSA-rv95-896h-c2vc. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rv95-896h-c2vc Fix: upgrade `express` past the affected range per the advisory.
package.json ScaOsvGhsa rv95 896h c2vc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-xml-parser 4.1.2: GHSA-8gc5-j5rx-235r
OSV.dev reports `fast-xml-parser` at version `4.1.2` (resolved in `package-lock.json`) is affected by GHSA-8gc5-j5rx-235r. Note: `fast-xml-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Note: `fast-xml-parser` is an optional dependency — inst…
package-lock.json ScaOsvGhsa 8gc5 j5rx 235r
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-xml-parser 4.1.2: GHSA-fj3w-jwp8-x2g3
OSV.dev reports `fast-xml-parser` at version `4.1.2` (resolved in `package-lock.json`) is affected by GHSA-fj3w-jwp8-x2g3. Note: `fast-xml-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Note: `fast-xml-parser` is an optional dependency — inst…
package-lock.json ScaOsvGhsa fj3w jwp8 x2g3
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-xml-parser 4.1.2: GHSA-gh4j-gqv2-49f6
OSV.dev reports `fast-xml-parser` at version `4.1.2` (resolved in `package-lock.json`) is affected by GHSA-gh4j-gqv2-49f6. Note: `fast-xml-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Note: `fast-xml-parser` is an optional dependency — inst…
package-lock.json ScaOsvGhsa gh4j gqv2 49f6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency fast-xml-parser 4.1.2: GHSA-jp2q-39xq-3w4g
OSV.dev reports `fast-xml-parser` at version `4.1.2` (resolved in `package-lock.json`) is affected by GHSA-jp2q-39xq-3w4g. Note: `fast-xml-parser` is a transitive dependency — pulled in by another package, not declared directly in a manifest. Note: `fast-xml-parser` is an optional dependency — inst…
package-lock.json ScaOsvGhsa jp2q 39xq 3w4g
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency flatted 2.0.2: GHSA-rf6f-7fwh-wjgh
OSV.dev reports `flatted` at version `2.0.2` (resolved in `package-lock.json`) is affected by GHSA-rf6f-7fwh-wjgh. Note: `flatted` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA…
package-lock.json ScaOsvGhsa rf6f 7fwh wjgh
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency flatted 3.2.7: GHSA-rf6f-7fwh-wjgh
OSV.dev reports `flatted` at version `3.2.7` (resolved in `package-lock.json`) is affected by GHSA-rf6f-7fwh-wjgh. Note: `flatted` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA…
package-lock.json ScaOsvGhsa rf6f 7fwh wjgh
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency follow-redirects 1.15.2: GHSA-cxjh-pqwp-8mfp
OSV.dev reports `follow-redirects` at version `1.15.2` (resolved in `package-lock.json`) is affected by GHSA-cxjh-pqwp-8mfp. Note: `follow-redirects` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev…
package-lock.json ScaOsvGhsa cxjh pqwp 8mfp
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency follow-redirects 1.15.2: GHSA-jchw-25xp-jwwc
OSV.dev reports `follow-redirects` at version `1.15.2` (resolved in `package-lock.json`) is affected by GHSA-jchw-25xp-jwwc. Note: `follow-redirects` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev…
package-lock.json ScaOsvGhsa jchw 25xp jwwc
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency follow-redirects 1.15.2: GHSA-r4q5-vmmm-2653
OSV.dev reports `follow-redirects` at version `1.15.2` (resolved in `package-lock.json`) is affected by GHSA-r4q5-vmmm-2653. Note: `follow-redirects` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev…
package-lock.json ScaOsvGhsa r4q5 vmmm 2653
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency form-data 2.3.3: GHSA-fjxv-7rqg-78g4
OSV.dev reports `form-data` at version `2.3.3` (resolved in `package-lock.json`) is affected by GHSA-fjxv-7rqg-78g4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fjxv-7rqg-78g4 Fix: upgrade `form-data` past the affected range per the advisory.
package-lock.json ScaOsvGhsa fjxv 7rqg 78g4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency form-data 2.3.3: GHSA-hmw2-7cc7-3qxx
OSV.dev reports `form-data` at version `2.3.3` (resolved in `package-lock.json`) is affected by GHSA-hmw2-7cc7-3qxx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hmw2-7cc7-3qxx Fix: upgrade `form-data` past the affected range per the advisory.
package-lock.json ScaOsvGhsa hmw2 7cc7 3qxx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency form-data 4.0.0: GHSA-fjxv-7rqg-78g4
OSV.dev reports `form-data` at version `4.0.0` (resolved in `package-lock.json`) is affected by GHSA-fjxv-7rqg-78g4. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-fjxv-7rqg-78g4 Fix: upgrade `form-data` past the affected range per the advisory.
package.json ScaOsvGhsa fjxv 7rqg 78g4
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency form-data 4.0.0: GHSA-hmw2-7cc7-3qxx
OSV.dev reports `form-data` at version `4.0.0` (resolved in `package-lock.json`) is affected by GHSA-hmw2-7cc7-3qxx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-hmw2-7cc7-3qxx Fix: upgrade `form-data` past the affected range per the advisory.
package.json ScaOsvGhsa hmw2 7cc7 3qxx
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 3.14.1: GHSA-2883-xcg3-v3hh
OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-2883-xcg3-v3hh. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
package-lock.json ScaOsvGhsa 2883 xcg3 v3hh
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 3.14.1: GHSA-52cp-r559-cp3m
OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-52cp-r559-cp3m. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
package-lock.json ScaOsvGhsa 52cp r559 cp3m
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 3.14.1: GHSA-5p4m-2wfm-xmqj
OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-5p4m-2wfm-xmqj. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
package-lock.json ScaOsvGhsa 5p4m 2wfm xmqj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 3.14.1: GHSA-h67p-54hq-rp68
OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-h67p-54hq-rp68. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
package-lock.json ScaOsvGhsa h67p 54hq rp68
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency js-yaml 3.14.1: GHSA-mh29-5h37-fv8m
OSV.dev reports `js-yaml` at version `3.14.1` (resolved in `package-lock.json`) is affected by GHSA-mh29-5h37-fv8m. Note: `js-yaml` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHS…
package-lock.json ScaOsvGhsa mh29 5h37 fv8m
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mongoose 6.10.5: GHSA-664h-wqgq-64gw
OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-664h-wqgq-64gw. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-664h-wqgq-64gw Fix: upgrade `mongoose` past the affected range per the advisory.
package.json ScaOsvGhsa 664h wqgq 64gw
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mongoose 6.10.5: GHSA-9m93-w8w6-76hh
OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-9m93-w8w6-76hh. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9m93-w8w6-76hh Fix: upgrade `mongoose` past the affected range per the advisory.
package.json ScaOsvGhsa 9m93 w8w6 76hh
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mongoose 6.10.5: GHSA-m7xq-9374-9rvx
OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-m7xq-9374-9rvx. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-m7xq-9374-9rvx Fix: upgrade `mongoose` past the affected range per the advisory.
package.json ScaOsvGhsa m7xq 9374 9rvx
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mongoose 6.10.5: GHSA-vg7j-7cwx-8wgw
OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-vg7j-7cwx-8wgw. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vg7j-7cwx-8wgw Fix: upgrade `mongoose` past the affected range per the advisory.
package.json ScaOsvGhsa vg7j 7cwx 8wgw
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency mongoose 6.10.5: GHSA-wpg9-53fq-2r8h
OSV.dev reports `mongoose` at version `6.10.5` (resolved in `package-lock.json`) is affected by GHSA-wpg9-53fq-2r8h. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wpg9-53fq-2r8h Fix: upgrade `mongoose` past the affected range per the advisory.
package.json ScaOsvGhsa wpg9 53fq 2r8h
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-268h-hp4c-crq3
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-268h-hp4c-crq3. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-268h-hp4c-crq3 Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa 268h hp4c crq3
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-2x7j-588g-ccc2
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-2x7j-588g-ccc2. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-2x7j-588g-ccc2 Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa 2x7j 588g ccc2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-8m3c-c648-2xjj
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-8m3c-c648-2xjj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-8m3c-c648-2xjj Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa 8m3c c648 2xjj
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-9h6g-pr28-7cqp
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-9h6g-pr28-7cqp. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-9h6g-pr28-7cqp Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa 9h6g pr28 7cqp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-c7w3-x93f-qmm8
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-c7w3-x93f-qmm8. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c7w3-x93f-qmm8 Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa c7w3 x93f qmm8
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-mm7p-fcc7-pg87
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-mm7p-fcc7-pg87. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-mm7p-fcc7-pg87 Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa mm7p fcc7 pg87
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-p6gq-j5cr-w38f
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-p6gq-j5cr-w38f. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p6gq-j5cr-w38f Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa p6gq j5cr w38f
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-r7g4-qg5f-qqm2
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-r7g4-qg5f-qqm2. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-r7g4-qg5f-qqm2 Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa r7g4 qg5f qqm2
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-rcmh-qjqh-p98v
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-rcmh-qjqh-p98v. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-rcmh-qjqh-p98v Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa rcmh qjqh p98v
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-vvjj-xcjg-gr5g
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-vvjj-xcjg-gr5g. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-vvjj-xcjg-gr5g Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa vvjj xcjg gr5g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-wmmp-3585-3rmp
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-wmmp-3585-3rmp. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wmmp-3585-3rmp Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa wmmp 3585 3rmp
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency nodemailer 6.9.1: GHSA-wqvq-jvpq-h66f
OSV.dev reports `nodemailer` at version `6.9.1` (resolved in `package-lock.json`) is affected by GHSA-wqvq-jvpq-h66f. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-wqvq-jvpq-h66f Fix: upgrade `nodemailer` past the affected range per the advisory.
package.json ScaOsvGhsa wqvq jvpq h66f
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency pm2 5.3.0: GHSA-x5gf-qvw8-r2rm
OSV.dev reports `pm2` at version `5.3.0` (resolved in `package-lock.json`) is affected by GHSA-x5gf-qvw8-r2rm. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-x5gf-qvw8-r2rm Fix: upgrade `pm2` past the affected range per the advisory.
package.json ScaOsvGhsa x5gf qvw8 r2rm
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.11.0: GHSA-4mjr-xmp4-gh2g
OSV.dev reports `qs` at version `6.11.0` (resolved in `package-lock.json`) is affected by GHSA-4mjr-xmp4-gh2g (aka CVE-2026-82417). qs: Denial of Service via Attacker Controlled isBuffer Aliases: CVE-2026-82417 Advisory: https://osv.dev/vulnerability/GHSA-4mjr-xmp4-gh2g Fix: upgrade `qs` past the…
package.json ScaOsvGhsa 4mjr xmp4 gh2g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.11.0: GHSA-6rw7-vpxm-498p
OSV.dev reports `qs` at version `6.11.0` (resolved in `package-lock.json`) is affected by GHSA-6rw7-vpxm-498p (aka CVE-2025-15284). qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion Aliases: CVE-2025-15284 Advisory: https://osv.dev/vulnerability/GHSA-6rw7-vpxm-498p F…
package.json ScaOsvGhsa 6rw7 vpxm 498p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.11.0: GHSA-w7fw-mjwx-w883
OSV.dev reports `qs` at version `6.11.0` (resolved in `package-lock.json`) is affected by GHSA-w7fw-mjwx-w883. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w7fw-mjwx-w883 Fix: upgrade `qs` past the affected range per the advisory.
package.json ScaOsvGhsa w7fw mjwx w883
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.11.1: GHSA-4mjr-xmp4-gh2g
OSV.dev reports `qs` at version `6.11.1` (resolved in `package-lock.json`) is affected by GHSA-4mjr-xmp4-gh2g (aka CVE-2026-82417). qs: Denial of Service via Attacker Controlled isBuffer Aliases: CVE-2026-82417 Advisory: https://osv.dev/vulnerability/GHSA-4mjr-xmp4-gh2g Fix: upgrade `qs` past the…
package-lock.json ScaOsvGhsa 4mjr xmp4 gh2g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.11.1: GHSA-6rw7-vpxm-498p
OSV.dev reports `qs` at version `6.11.1` (resolved in `package-lock.json`) is affected by GHSA-6rw7-vpxm-498p (aka CVE-2025-15284). qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion Aliases: CVE-2025-15284 Advisory: https://osv.dev/vulnerability/GHSA-6rw7-vpxm-498p F…
package-lock.json ScaOsvGhsa 6rw7 vpxm 498p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.11.1: GHSA-q8mj-m7cp-5q26
OSV.dev reports `qs` at version `6.11.1` (resolved in `package-lock.json`) is affected by GHSA-q8mj-m7cp-5q26. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-q8mj-m7cp-5q26 Fix: upgrade `qs` past the affected range per the advisory.
package-lock.json ScaOsvGhsa q8mj m7cp 5q26
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.11.1: GHSA-w7fw-mjwx-w883
OSV.dev reports `qs` at version `6.11.1` (resolved in `package-lock.json`) is affected by GHSA-w7fw-mjwx-w883. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w7fw-mjwx-w883 Fix: upgrade `qs` past the affected range per the advisory.
package-lock.json ScaOsvGhsa w7fw mjwx w883
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.5.3: GHSA-4mjr-xmp4-gh2g
OSV.dev reports `qs` at version `6.5.3` (resolved in `package-lock.json`) is affected by GHSA-4mjr-xmp4-gh2g (aka CVE-2026-82417). qs: Denial of Service via Attacker Controlled isBuffer Aliases: CVE-2026-82417 Advisory: https://osv.dev/vulnerability/GHSA-4mjr-xmp4-gh2g Fix: upgrade `qs` past the …
package-lock.json ScaOsvGhsa 4mjr xmp4 gh2g
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency qs 6.5.3: GHSA-6rw7-vpxm-498p
OSV.dev reports `qs` at version `6.5.3` (resolved in `package-lock.json`) is affected by GHSA-6rw7-vpxm-498p (aka CVE-2025-15284). qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion Aliases: CVE-2025-15284 Advisory: https://osv.dev/vulnerability/GHSA-6rw7-vpxm-498p Fi…
package-lock.json ScaOsvGhsa 6rw7 vpxm 498p
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency request 2.88.2: GHSA-p8p7-x288-28g6
OSV.dev reports `request` at version `2.88.2` (resolved in `package-lock.json`) is affected by GHSA-p8p7-x288-28g6. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-p8p7-x288-28g6 Fix: upgrade `request` past the affected range per the advisory.
package.json ScaOsvGhsa p8p7 x288 28g6
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency semver 5.7.1: GHSA-c2qf-rxjj-qqgw
OSV.dev reports `semver` at version `5.7.1` (resolved in `package-lock.json`) is affected by GHSA-c2qf-rxjj-qqgw. Note: `semver` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c…
package-lock.json ScaOsvGhsa c2qf rxjj qqgw
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency semver 6.3.0: GHSA-c2qf-rxjj-qqgw
OSV.dev reports `semver` at version `6.3.0` (resolved in `package-lock.json`) is affected by GHSA-c2qf-rxjj-qqgw. Note: `semver` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-c…
package-lock.json ScaOsvGhsa c2qf rxjj qqgw
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency sequelize 6.31.0: GHSA-6457-6jrx-69cr
OSV.dev reports `sequelize` at version `6.31.0` (resolved in `package-lock.json`) is affected by GHSA-6457-6jrx-69cr. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-6457-6jrx-69cr Fix: upgrade `sequelize` past the affected range per the advisory.
package.json ScaOsvGhsa 6457 6jrx 69cr
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency sequelize 6.31.0: GHSA-v8fg-2rw7-q452
OSV.dev reports `sequelize` at version `6.31.0` (resolved in `package-lock.json`) is affected by GHSA-v8fg-2rw7-q452. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-v8fg-2rw7-q452 Fix: upgrade `sequelize` past the affected range per the advisory.
package.json ScaOsvGhsa v8fg 2rw7 q452
medium System graph dependencies dependencies conf 1.00 Vulnerable dependency socket.io 4.6.1: GHSA-25hc-qcg6-38wj
OSV.dev reports `socket.io` at version `4.6.1` (resolved in `package-lock.json`) is affected by GHSA-25hc-qcg6-38wj. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-25hc-qcg6-38wj Fix: upgrade `socket.io` past the affected range per the advisory.
package.json ScaOsvGhsa 25hc qcg6 38wj
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency uuid 3.4.0: GHSA-w5hq-g745-h8pq
OSV.dev reports `uuid` at version `3.4.0` (resolved in `package-lock.json`) is affected by GHSA-w5hq-g745-h8pq. Note: `uuid` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-w5hq-…
package-lock.json ScaOsvGhsa w5hq g745 h8pq
medium System graph dependencies dependencies conf 0.90 Vulnerable dependency ws 8.11.0: GHSA-58qx-3vcg-4xpx
OSV.dev reports `ws` at version `8.11.0` (resolved in `package-lock.json`) is affected by GHSA-58qx-3vcg-4xpx. Note: `ws` is a transitive dependency — pulled in by another package, not declared directly in a manifest. No summary published yet. Advisory: https://osv.dev/vulnerability/GHSA-58qx-3vc…
package-lock.json ScaOsvGhsa 58qx 3vcg 4xpx

Showing first 300 of 339. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/a981c7cf-2da7-49ad-acd2-d569014fb7a0/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/a981c7cf-2da7-49ad-acd2-d569014fb7a0/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.