Skip to content
Tools / stump / Security

Security Deep Dive

stump

Security posture and CVE patch evidence from tracked releases.

Back to Tool

1 actively-exploited dependency CVE affects v0.1.4.

KEV-listed CVEs are confirmed exploited in the wild — patch urgently.

Versions by Severity

CVEs are attributed to tracked releases published before the patch release.

5 versions tracked
Version Published C H M L KEV Notes
v0.1.4 2026-05-29
Latest
v0.1.3 2026-05-17
Patches CVE-2025-31125
v0.1.2 2026-04-18 1 KEV 1
v0.1.1 2026-04-04 1 KEV 1
v0.1.0 2026-03-29 1 KEV 1
— Signed — SLSA — SBOM ✗ Security policy Weekly cadence · 12d median Active maintainer

Trust Signals — 2 of 9 Present

Evidence already collected from releases and repository metadata.

2/9 Present
Signed releases Unknown
Latest release artifact signature Latest release
SLSA provenance Unknown
Attestation predicate level Latest release
SBOM published Unknown
GitHub SBOM API Latest release
SECURITY.md Absent
GitHub repository metadata Repository policy
Checked: 21d ago
Release cadence: weekly Present
12d median over recent releases Release history
Latest release: 5d ago
Maintainer active Present
Recent commit activity Repository
Last commit: 1d ago
Checksums (SHA256SUMS) Not active yet
SHA256SUMS or equivalent Release asset
Latest release: 5d ago
GitHub Actions attestation Not active yet
actions/attest-build-provenance Workflow file
Latest release: 5d ago
Signing assets Not active yet
.sig, .crt, cosign.pub, or similar Release asset
Latest release: 5d ago
0.5/10 Security Score
Dependency Exposure 207 transitive dependency CVEs found in the latest SBOM. 5 critical.

Security Score

A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.

epss

0.00 / 0.5

Max EPSS 0.832

freshness

1.00 / 1.0

1d stale

scorecard

2.00 / 4.0

⚠ Estimated — not yet collected

cve health

0.00 / 2.5

⚠ No direct scan — 5c/70h transitive CVEs

patch speed

0.50 / 0.5

⚠ Estimated — no CVE patch history

kev exposure

-1.50 / 1.5

KEV exposure detected

supply chain risk

-1.50 / 10.0

Risk 100.0/100

Score breakdown

schema v2

Vulnerability posture

vulnerability posture

0.0

25%

direct cves: clear cve scan: estimated

Release responsiveness

release responsiveness

10.0

5%

patch speed days: no_history

Dependency exposure

dependency exposure

0.0

10%

supply chain risk: 100.0 transitive cves: 5c/70h

Provenance trust

provenance trust

5.0

40%

scorecard score: estimated openssf badge: none

Maintainer health

maintainer health

10.0

10%

activity freshness: 1d

Operational risk

operational risk

0.0

10%

kev exposure: detected epss max: 0.832
How is this calculated?

The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.

Supply Chain Risk

Risk 100.0/100
5 Transitive critical CVEs
1 KEV-transitive CVEs
59% Dependency freshness

OpenSSF Badge

OpenSSF none

Badge indicates adherence to open-source best practices.

CVE Patch History

Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.

CVEs Patched by Year

Critical High Medium Low
2026
1
CVE Severity EPSS Disclosed Fixed in Days to fix vs Ecosystem Median KEV
CVE-2025-31125 MEDIUM 99%ile v0.1.3 KEV

KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.

Dependency Vulnerabilities

4683 dependencies scanned View full dependency list →

Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.

Critical

5

High

70

Medium

78

Low

19

Unknown

35

1 dependency vulnerabilities are in KEV.

CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.

Critical 5 High 70 Medium 78 Low 19 Unknown 35
CVE Severity KEV Dependency Affected version Cleared in release
CVE-2025-24964 critical vitest 3.0.0 v0.1.3
CVE-2025-29927 critical next 14.2.15 v0.1.3
CVE-2025-31477 critical tauri-plugin-shell 2.0.2 v0.1.3
CVE-2026-25896 critical fast-xml-parser 5.3.4 v0.1.3
CVE-2026-33937 critical handlebars 4.7.8 v0.1.3
CVE-2024-23331 high vite 4.5.0 v0.1.3
CVE-2024-27308 high mio 0.8.10 v0.1.3
CVE-2024-39338 high axios 1.6.8 v0.1.3
CVE-2024-45311 high quinn-proto 0.11.6 v0.1.3
CVE-2025-27152 high axios 1.6.8 v0.1.3
CVE-2025-58754 high axios 1.6.8 v0.1.3
CVE-2025-64756 high glob 10.3.10 v0.1.3
CVE-2025-68429 high storybook 7.6.17 v0.1.3
CVE-2026-1526 high undici 6.22.0 v0.1.3
CVE-2026-1528 high undici 6.22.0 v0.1.3
CVE-2026-22029 high @remix-run/router 1.23.1 v0.1.3
CVE-2026-2229 high undici 6.22.0 v0.1.3
CVE-2026-23745 high tar 6.2.1 v0.1.3
CVE-2026-23950 high tar 6.2.1 v0.1.3
CVE-2026-24842 high tar 6.2.1 v0.1.3
CVE-2026-25547 high @isaacs/brace-expansion 5.0.0 v0.1.3
CVE-2026-25639 high axios 1.6.8 v0.1.3
CVE-2026-26278 high fast-xml-parser 5.3.4 v0.1.3
CVE-2026-26960 high tar 6.2.1 v0.1.3
CVE-2026-26996 high minimatch 9.0.5 v0.1.3
CVE-2026-27606 high rollup 4.53.3 v0.1.3
CVE-2026-27903 high minimatch 9.0.5 v0.1.3
CVE-2026-27904 high minimatch 9.0.5 v0.1.3
CVE-2026-29063 high immutable 3.7.6 v0.1.3
CVE-2026-29786 high tar 6.2.1 v0.1.3
CVE-2026-31802 high tar 6.2.1 v0.1.3
CVE-2026-31812 high quinn-proto 0.11.6 v0.1.3
CVE-2026-32141 high flatted 3.3.3 v0.1.3
CVE-2026-33036 high fast-xml-parser 5.3.4 v0.1.3
CVE-2026-33228 high flatted 3.3.3 v0.1.3
CVE-2026-33671 high picomatch 3.0.1 v0.1.3
CVE-2026-33891 high node-forge 1.3.3 v0.1.3
CVE-2026-33894 high node-forge 1.3.3 v0.1.3
CVE-2026-33895 high node-forge 1.3.3 v0.1.3
CVE-2026-33896 high node-forge 1.3.3 v0.1.3
CVE-2026-33938 high handlebars 4.7.8 v0.1.3
CVE-2026-33939 high handlebars 4.7.8 v0.1.3
CVE-2026-33940 high handlebars 4.7.8 v0.1.3
CVE-2026-33941 high handlebars 4.7.8 v0.1.3
CVE-2026-34601 high @xmldom/xmldom 0.7.13 v0.1.3
CVE-2026-35209 high defu 6.1.4 v0.1.3
CVE-2026-39356 high drizzle-orm 0.44.7 v0.1.3
CVE-2026-39363 high vite 7.2.6 v0.1.3
CVE-2026-39364 high vite 7.2.6 v0.1.3
CVE-2026-41672 high @xmldom/xmldom 0.7.13 v0.1.3
CVE-2026-41673 high @xmldom/xmldom 0.7.13 v0.1.3
CVE-2026-41674 high @xmldom/xmldom 0.7.13 v0.1.3
CVE-2026-41675 high @xmldom/xmldom 0.7.13 v0.1.3
CVE-2026-41676 high openssl 0.10.68 v0.1.3
CVE-2026-41678 high openssl 0.10.68 v0.1.3
CVE-2026-41681 high openssl 0.10.68 v0.1.3
CVE-2026-41898 high openssl 0.10.68 v0.1.3
CVE-2026-42033 high axios 1.6.8 v0.1.3
CVE-2026-42035 high axios 1.6.8 v0.1.3
CVE-2026-42043 high axios 1.6.8 v0.1.3
CVE-2026-42264 high axios 1.6.8 v0.1.3
CVE-2026-42327 high openssl 0.10.68 v0.1.3
CVE-2026-44728 high @babel/plugin-transform-modules-systemjs 7.28.5 v0.1.3
CVE-2026-4800 high lodash 4.17.21 v0.1.3
CVE-2026-4800 high lodash-es 4.17.21 v0.1.3
CVE-2026-4867 high path-to-regexp 0.1.12 v0.1.3
CVE-2026-6321 high fast-uri 3.1.0 v0.1.3
CVE-2026-6322 high fast-uri 3.1.0 v0.1.3
GHSA-5c6j-r48x-rmvq high serialize-javascript 6.0.2 v0.1.3
GHSA-5j59-xgg2-r9c4 high next 14.2.33 v0.1.3
GHSA-82j2-j2ch-gfr8 high rustls-webpki 0.103.7 v0.1.3
GHSA-h25m-26qc-wcjf high next 14.2.33 v0.1.3
GHSA-m5qc-5hw7-8vg7 high image-size 2.0.0 v0.1.3
GHSA-mwv6-3258-q52c high next 14.2.33 v0.1.3
GHSA-q4gf-8mx6-v5v3 high next 14.2.33 v0.1.3
CVE-2023-44270 medium postcss 7.0.39 v0.1.3
CVE-2023-49092 medium rsa 0.9.7 v0.1.3
CVE-2023-49293 medium vite 4.5.0 v0.1.3
CVE-2024-12224 medium idna 0.5.0 v0.1.3
CVE-2024-31207 medium vite 4.5.0 v0.1.3
CVE-2024-43788 medium webpack 5.89.0 v0.1.3
CVE-2024-45811 medium vite 4.5.0 v0.1.3
CVE-2024-45812 medium vite 4.5.0 v0.1.3
CVE-2024-56332 medium next 14.2.15 v0.1.3
CVE-2025-13465 medium lodash 4.17.21 v0.1.3
CVE-2025-13465 medium lodash-es 4.17.21 v0.1.3
CVE-2025-15284 medium qs 6.12.1 v0.1.3
CVE-2025-24010 medium vite 4.5.0 v0.1.3
CVE-2025-24898 medium openssl 0.10.68 v0.1.3
CVE-2025-30208 medium vite 4.5.0 v0.1.3
CVE-2025-31125 medium KEV vite 4.5.0 v0.1.4
CVE-2025-31486 medium vite 4.5.0 v0.1.3
CVE-2025-32395 medium vite 4.5.0 v0.1.3
CVE-2025-4432 medium ring 0.17.8 v0.1.3
CVE-2025-46565 medium vite 4.5.0 v0.1.3
CVE-2025-55173 medium next 14.2.15 v0.1.3
CVE-2025-57752 medium next 14.2.15 v0.1.3
CVE-2025-57822 medium next 14.2.15 v0.1.3
CVE-2025-59471 medium next 14.2.33 v0.1.3
CVE-2025-62522 medium vite 4.5.14 v0.1.3
CVE-2025-62718 medium axios 1.6.8 v0.1.3
CVE-2025-68470 medium react-router 6.30.0 v0.1.3
CVE-2025-69873 medium ajv 6.12.6 v0.1.3
CVE-2026-0540 medium dompurify 3.3.0 v0.1.3
CVE-2026-1525 medium undici 6.22.0 v0.1.3
CVE-2026-1527 medium undici 6.22.0 v0.1.3
CVE-2026-22036 medium undici 6.22.0 v0.1.3
CVE-2026-25537 medium jsonwebtoken 9.3.0 v0.1.3
CVE-2026-25541 medium bytes 1.9.0 v0.1.3
CVE-2026-25727 medium time 0.3.36 v0.1.3
CVE-2026-27980 medium next 14.2.33 v0.1.3
CVE-2026-29057 medium next 14.2.33 v0.1.3
CVE-2026-2950 medium lodash 4.17.21 v0.1.3
CVE-2026-2950 medium lodash-es 4.17.21 v0.1.3
CVE-2026-33055 medium tar 0.4.38 v0.1.3
CVE-2026-33056 medium tar 0.4.38 v0.1.3
CVE-2026-33349 medium fast-xml-parser 5.3.4 v0.1.3
CVE-2026-33532 medium yaml 2.8.2 v0.1.3
CVE-2026-33672 medium picomatch 3.0.1 v0.1.3
CVE-2026-33750 medium brace-expansion 1.1.12 v0.1.3
CVE-2026-33916 medium handlebars 4.7.8 v0.1.3
CVE-2026-34043 medium serialize-javascript 6.0.2 v0.1.3
CVE-2026-39365 medium vite 7.2.6 v0.1.3
CVE-2026-40175 medium axios 1.6.8 v0.1.3
CVE-2026-41238 medium dompurify 3.3.0 v0.1.3
CVE-2026-41239 medium dompurify 3.3.0 v0.1.3
CVE-2026-41240 medium dompurify 3.3.0 v0.1.3
CVE-2026-41305 medium postcss 8.4.38 v0.1.3
CVE-2026-41650 medium fast-xml-parser 5.3.4 v0.1.3
CVE-2026-41907 medium uuid 11.1.0 v0.1.3
CVE-2026-42034 medium axios 1.6.8 v0.1.3
CVE-2026-42036 medium axios 1.6.8 v0.1.3
CVE-2026-42037 medium axios 1.6.8 v0.1.3
CVE-2026-42038 medium axios 1.6.8 v0.1.3
CVE-2026-42039 medium axios 1.6.8 v0.1.3
CVE-2026-42041 medium axios 1.6.8 v0.1.3
CVE-2026-42042 medium axios 1.6.8 v0.1.3
CVE-2026-42044 medium axios 1.6.8 v0.1.3
CVE-2026-42184 medium tauri 2.0.4 v0.1.3
CVE-2026-42338 medium ip-address 10.1.0 v0.1.3
CVE-2026-44662 medium openssl 0.10.68 v0.1.3
GHSA-39q2-94rc-95cp medium dompurify 3.3.0 v0.1.3
GHSA-4fcv-w3qc-ppgg medium openssl 0.10.68 v0.1.3
GHSA-67mh-4wv8-2f99 medium esbuild 0.18.20 v0.1.3
GHSA-7rx3-28cr-v5wh medium handlebars 4.7.8 v0.1.3
GHSA-9q78-27f3-2jmh medium webp 0.3.0 v0.1.3
GHSA-cj63-jhhr-wcxv medium dompurify 3.3.0 v0.1.3
GHSA-cjmm-f4jc-qw8r medium dompurify 3.3.0 v0.1.3
GHSA-h8r8-wccr-v5f2 medium dompurify 3.3.0 v0.1.3
GHSA-pwjx-qhcg-rvj4 medium rustls-webpki 0.103.7 v0.1.3
GHSA-r4q5-vmmm-2653 medium follow-redirects 1.15.11 v0.1.3
GHSA-rjhf-4mh8-9xjq medium zerocopy 0.7.26 v0.1.3
GHSA-wrw7-89jp-8q8g medium glib 0.18.5 v0.1.3
CVE-2025-32421 low next 14.2.15 v0.1.3
CVE-2025-48068 low next 14.2.15 v0.1.3
CVE-2025-58160 low tracing-subscriber 0.3.18 v0.1.3
CVE-2025-58751 low vite 4.5.14 v0.1.3
CVE-2025-58752 low vite 4.5.14 v0.1.3
CVE-2025-68157 low webpack 5.89.0 v0.1.3
CVE-2025-68458 low webpack 5.89.0 v0.1.3
CVE-2026-21895 low rsa 0.9.7 v0.1.3
CVE-2026-2391 low qs 6.12.1 v0.1.3
CVE-2026-24001 low diff 4.0.2 v0.1.3
CVE-2026-27942 low fast-xml-parser 5.3.4 v0.1.3
CVE-2026-3449 low @tootallnate/once 2.0.0 v0.1.3
CVE-2026-41677 low openssl 0.10.68 v0.1.3
CVE-2026-42040 low axios 1.6.8 v0.1.3
GHSA-3mv5-343c-w2qg low zerocopy 0.7.26 v0.1.3
GHSA-442j-39wm-28r2 low handlebars 4.7.8 v0.1.3
GHSA-965h-392x-2mh5 low rustls-webpki 0.103.7 v0.1.3
GHSA-cq8v-f236-94qc low rand 0.9.2 v0.1.3
GHSA-xgp8-3hg3-c2mh low rustls-webpki 0.103.7 v0.1.3
RUSTSEC-2023-0074 unknown zerocopy 0.7.26 v0.1.3
RUSTSEC-2023-0081 unknown safemem 0.3.3 v0.1.3
RUSTSEC-2024-0370 unknown proc-macro-error 1.0.4 v0.1.3
RUSTSEC-2024-0384 unknown instant 0.1.12 v0.1.3
RUSTSEC-2024-0388 unknown derivative 2.2.0 v0.1.3
RUSTSEC-2024-0411 unknown gdkwayland-sys 0.18.0 v0.1.3
RUSTSEC-2024-0412 unknown gdk 0.18.0 v0.1.3
RUSTSEC-2024-0413 unknown atk 0.18.0 v0.1.3
RUSTSEC-2024-0414 unknown gdkx11-sys 0.18.0 v0.1.3
RUSTSEC-2024-0415 unknown gtk 0.18.1 v0.1.3
RUSTSEC-2024-0416 unknown atk-sys 0.18.0 v0.1.3
RUSTSEC-2024-0417 unknown gdkx11 0.18.0 v0.1.3
RUSTSEC-2024-0418 unknown gdk-sys 0.18.0 v0.1.3
RUSTSEC-2024-0419 unknown gtk3-macros 0.18.0 v0.1.3
RUSTSEC-2024-0420 unknown gtk-sys 0.18.0 v0.1.3
RUSTSEC-2024-0429 unknown glib 0.18.5 v0.1.3
RUSTSEC-2024-0436 unknown paste 1.0.15 v0.1.3
RUSTSEC-2024-0443 unknown webp 0.3.0 v0.1.3
RUSTSEC-2025-0022 unknown openssl 0.10.68 v0.1.3
RUSTSEC-2025-0056 unknown adler 1.0.2 v0.1.3
RUSTSEC-2025-0057 unknown fxhash 0.2.1 v0.1.3
RUSTSEC-2025-0075 unknown unic-char-range 0.9.0 v0.1.3
RUSTSEC-2025-0080 unknown unic-common 0.9.0 v0.1.3
RUSTSEC-2025-0081 unknown unic-char-property 0.9.0 v0.1.3
RUSTSEC-2025-0098 unknown unic-ucd-version 0.9.0 v0.1.3
RUSTSEC-2025-0100 unknown unic-ucd-ident 0.9.0 v0.1.3
RUSTSEC-2025-0119 unknown number_prefix 0.4.0 v0.1.3
RUSTSEC-2025-0141 unknown bincode 1.3.3 v0.1.3
RUSTSEC-2026-0001 unknown rkyv 0.7.45 v0.1.3
RUSTSEC-2026-0049 unknown rustls-webpki 0.103.7 v0.1.3
RUSTSEC-2026-0097 unknown rand 0.9.2 v0.1.3
RUSTSEC-2026-0098 unknown rustls-webpki 0.103.7 v0.1.3
RUSTSEC-2026-0099 unknown rustls-webpki 0.103.7 v0.1.3
RUSTSEC-2026-0104 unknown rustls-webpki 0.103.7 v0.1.3
RUSTSEC-2026-0105 unknown core2 0.4.0 v0.1.3

Showing 207 of 207

Beta — feedback welcome: [email protected]