Skip to content
Tools / Ombi / Security

Security Deep Dive

Ombi

Security posture and CVE patch evidence from tracked releases.

Back to Tool

2 critical dependency CVEs affects v4.53.10.

Audit transitive dependencies; consider upgrading or pinning replacements.

— Signed — SLSA — SBOM ✗ Security policy Quarterly cadence · 70d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
—
SLSA provenance Unknown
Attestation predicate level Latest release
—
SBOM published Unknown
GitHub SBOM API Latest release
—
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 22d ago
Release cadence: quarterly Present
70d median over recent releases Release history
Latest release: 4d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 4d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 4d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 4d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 4d ago
4.3/10 Security Score
5.1/10 Scorecard
Dependency Exposure 55 transitive dependency CVEs found in the latest SBOM. 2 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

4d stale

scorecard

2.04 / 4.0

Score 5.1/10

cve health

0.50 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

2.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 2c/55h

Provenance trust

provenance trust

5.1

40%

scorecard score: 5.1 openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 4d

Operational risk

operational risk

8.5

10%

kev exposure: clear epss max: none
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
2 Transitive critical CVEs
0 KEV-transitive CVEs
47% Dependency freshness

Scorecard

Scorecard 5.1/10

OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.

Check Score Reason
Maintained 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Code-Review 8 Found 13/16 approved changesets -- score normalized to 8
CII-Best-Practices 0 no effort to earn an OpenSSF best practices badge detected
Token-Permissions 0 detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow 10 no dangerous workflow patterns detected
Security-Policy 0 security policy file not detected
Binary-Artifacts 10 no binaries found in the repo
License 10 license file detected
Fuzzing 0 project is not fuzzed
Pinned-Dependencies 0 dependency not pinned by hash detected -- score normalized to 0
Branch-Protection 0 branch protection not enabled on development/release branches
Signed-Releases 0 Project has not signed or included provenance with any releases.
Packaging 10 packaging workflow detected
SAST 10 SAST tool is run on all commits

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

Dependency Vulnerabilities

1956 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

2

High

29

Medium

14

Low

10

Unknown

0

Still affecting latest (55) All (94)
Critical 2 High 29 Medium 14 Low 10
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2025-7783 critical — form-data 4.0.0 v4.53.10
CVE-2026-33937 critical — handlebars 4.7.8 v4.53.10
CVE-2024-12905 high — tar-fs 2.1.1 v4.53.10
CVE-2024-29415 high — ip 2.0.1 v4.53.10
CVE-2024-45296 high — path-to-regexp 0.1.7 v4.53.10
CVE-2024-45590 high — body-parser 1.20.2 v4.53.10
CVE-2024-52798 high — path-to-regexp 0.1.7 v4.53.10
CVE-2025-12816 high — node-forge 1.3.1 v4.53.10
CVE-2025-48387 high — tar-fs 2.1.1 v4.53.10
CVE-2025-59343 high — tar-fs 2.1.1 v4.53.10
CVE-2025-66031 high — node-forge 1.3.1 v4.53.10
CVE-2025-66414 high — @modelcontextprotocol/sdk 1.13.3 v4.53.10
CVE-2026-0621 high — @modelcontextprotocol/sdk 1.13.3 v4.53.10
CVE-2026-25536 high — @modelcontextprotocol/sdk 1.13.3 v4.53.10
CVE-2026-27606 high — rollup 4.44.1 v4.53.10
CVE-2026-32141 high — flatted 3.3.3 v4.53.10
CVE-2026-33228 high — flatted 3.3.3 v4.53.10
CVE-2026-33671 high — picomatch 2.3.1 v4.53.10
CVE-2026-33891 high — node-forge 1.3.1 v4.53.10
CVE-2026-33894 high — node-forge 1.3.1 v4.53.10
CVE-2026-33895 high — node-forge 1.3.1 v4.53.10
CVE-2026-33896 high — node-forge 1.3.1 v4.53.10
CVE-2026-33938 high — handlebars 4.7.8 v4.53.10
CVE-2026-33939 high — handlebars 4.7.8 v4.53.10
CVE-2026-33940 high — handlebars 4.7.8 v4.53.10
CVE-2026-33941 high — handlebars 4.7.8 v4.53.10
CVE-2026-4800 high — lodash 4.17.23 v4.53.10
CVE-2026-4800 high — lodash-es 4.17.23 v4.53.10
CVE-2026-4867 high — path-to-regexp 0.1.7 v4.53.10
CVE-2026-6321 high — fast-uri 3.0.1 v4.53.10
CVE-2026-6322 high — fast-uri 3.0.1 v4.53.10
CVE-2024-53382 medium — prismjs 1.29.0 v4.53.10
CVE-2025-13465 medium — lodash 4.17.21 v4.53.10
CVE-2025-13466 medium — body-parser 2.2.0 v4.53.10
CVE-2025-66030 medium — node-forge 1.3.1 v4.53.10
CVE-2026-2950 medium — lodash 4.17.23 v4.53.10
CVE-2026-2950 medium — lodash-es 4.17.23 v4.53.10
CVE-2026-33532 medium — yaml 1.10.2 v4.53.10
CVE-2026-33672 medium — picomatch 2.3.1 v4.53.10
CVE-2026-33750 medium — brace-expansion 2.0.1 v4.53.10
CVE-2026-33916 medium — handlebars 4.7.8 v4.53.10
CVE-2026-41319 medium — MailKit 4.6.0 v4.53.10
GHSA-67mh-4wv8-2f99 medium — esbuild 0.18.20 v4.53.10
GHSA-7rx3-28cr-v5wh medium — handlebars 4.7.8 v4.53.10
GHSA-r4q5-vmmm-2653 medium — follow-redirects 1.15.6 v4.53.10
CVE-2024-43796 low — express 4.19.2 v4.53.10
CVE-2024-43799 low — send 0.18.0 v4.53.10
CVE-2024-43800 low — serve-static 1.15.0 v4.53.10
CVE-2024-47764 low — cookie 0.6.0 v4.53.10
CVE-2025-54798 low — tmp 0.0.33 v4.53.10
CVE-2025-5889 low — brace-expansion 2.0.1 v4.53.10
CVE-2025-7339 low — on-headers 1.0.2 v4.53.10
CVE-2026-24001 low — diff 3.5.0 v4.53.10
GHSA-442j-39wm-28r2 low — handlebars 4.7.8 v4.53.10
GHSA-xffm-g5w8-qvg7 low — @eslint/plugin-kit 0.2.8 v4.53.10

Showing 55 of 94

Beta — feedback welcome: [email protected]