Skip to content
Tools / Pulsarr / Security

Security Deep Dive

Pulsarr

Security posture and CVE patch evidence from tracked releases.

Back to Tool

1 critical dependency CVE affects v0.16.0.

Audit transitive dependencies; consider upgrading or pinning replacements.

— Signed — SLSA — SBOM ✗ Security policy Weekly cadence · 4d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
SLSA provenance Unknown
Attestation predicate level Latest release
SBOM published Unknown
GitHub SBOM API Latest release
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 22d ago
Release cadence: weekly Present
4d median over recent releases Release history
Latest release: 1d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 2d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 1d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 1d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 1d ago
4.8/10 Security Score
Dependency Exposure 37 transitive dependency CVEs found in the latest SBOM. 1 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.25 / 0.5

No EPSS data

freshness

1.00 / 1.0

1d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

1.00 / 2.5

No open CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

1.50 / 1.5

No KEV exposure

supply chain risk

-1.50 / 10.0

Risk 43.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

4.0

25%

direct cves: clear cve scan: available

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

5.7

10%

supply chain risk: 42.96 transitive cves: 1c/19h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 1d

Operational risk

operational risk

8.5

10%

kev exposure: clear epss max: none
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 43.0/100
1 Transitive critical CVEs
0 KEV-transitive CVEs
52% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

Dependency Vulnerabilities

1600 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

1

High

19

Medium

13

Low

4

Unknown

0

Critical 1 High 19 Medium 13 Low 4
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2026-25896 critical fast-xml-parser 5.2.2 v0.15.5
CVE-2026-25128 high fast-xml-parser 5.2.2 v0.15.5
CVE-2026-25223 high fastify 5.6.1 v0.15.5
CVE-2026-26278 high fast-xml-parser 5.2.2 v0.15.5
CVE-2026-26996 high minimatch 5.1.6 v0.15.5
CVE-2026-27903 high minimatch 5.1.6 v0.15.5
CVE-2026-27904 high minimatch 5.1.6 v0.15.5
CVE-2026-29063 high immutable 5.1.4 v0.15.5
CVE-2026-29074 high svgo 3.3.2 v0.15.5
CVE-2026-33036 high fast-xml-parser 5.2.2 v0.15.5
CVE-2026-33671 high picomatch 4.0.3 v0.15.5
CVE-2026-33806 high fastify 5.6.1 v0.15.5
CVE-2026-39363 high vite 8.0.0 v0.15.5
CVE-2026-39364 high vite 8.0.0 v0.15.5
CVE-2026-44728 high @babel/plugin-transform-modules-systemjs 7.28.5 v0.15.5
CVE-2026-4800 high lodash 4.17.21 v0.15.5
CVE-2026-4867 high path-to-regexp 0.1.12 v0.15.5
CVE-2026-6321 high fast-uri 3.1.0 v0.15.5
CVE-2026-6322 high fast-uri 3.1.0 v0.15.5
GHSA-5c6j-r48x-rmvq high serialize-javascript 6.0.2 v0.15.5
CVE-2025-13465 medium lodash 4.17.21 v0.15.5
CVE-2025-64718 medium js-yaml 4.1.0 v0.15.5
CVE-2025-69873 medium ajv 6.12.6 v0.15.5
CVE-2026-2950 medium lodash 4.17.21 v0.15.5
CVE-2026-33349 medium fast-xml-parser 5.2.2 v0.15.5
CVE-2026-33532 medium yaml 1.10.2 v0.15.5
CVE-2026-33672 medium picomatch 4.0.3 v0.15.5
CVE-2026-33750 medium brace-expansion 1.1.12 v0.15.5
CVE-2026-34043 medium serialize-javascript 6.0.2 v0.15.5
CVE-2026-3635 medium fastify 5.6.1 v0.15.5
CVE-2026-39365 medium vite 8.0.0 v0.15.5
CVE-2026-41650 medium fast-xml-parser 5.2.2 v0.15.5
GHSA-r4q5-vmmm-2653 medium follow-redirects 1.15.11 v0.15.5
CVE-2026-2391 low qs 6.14.1 v0.15.5
CVE-2026-24001 low diff 5.2.0 v0.15.5
CVE-2026-25224 low fastify 5.6.1 v0.15.5
CVE-2026-27942 low fast-xml-parser 5.2.2 v0.15.5

Showing 37 of 37

Beta — feedback welcome: [email protected]