Security Deep Dive
yugabyte-db
Security posture and CVE patch evidence from tracked releases.
1 actively-exploited dependency CVE affects v2024.2.9.1.
KEV-listed CVEs are confirmed exploited in the wild — patch urgently.
Versions by Severity
CVEs are attributed to tracked releases published before the patch release.
| Version | Published | C | H | M | L | KEV | Notes |
|---|---|---|---|---|---|---|---|
| v2024.2.9.1 | 2026-06-03 | — | — | — | — | — |
Latest
|
| v2025.2.3.1 | 2026-06-02 | — | — | — | — | — |
—
|
| v2025.2.3.0 | 2026-05-14 | — | — | — | — | — |
Patches
CVE-2025-31125
|
| v2024.2.9.0 | 2026-04-29 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.4.0 | 2026-04-20 | — | — | 1 | — | KEV 1 |
—
|
| v2025.2.2.2 | 2026-04-07 | — | — | 1 | — | KEV 1 |
—
|
| v2025.2.2.1 | 2026-03-23 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.3.2 | 2026-02-26 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.8.0 | 2026-02-23 | — | — | 1 | — | KEV 1 |
—
|
| v2025.2.1.0 | 2026-02-12 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.3.1 | 2026-02-06 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.7.3 | 2026-02-03 | — | — | 1 | — | KEV 1 |
—
|
| v2025.2.0.1 | 2026-01-27 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.7.2 | 2026-01-16 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.3.0 | 2026-01-16 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.7.1 | 2025-12-31 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.7.0 | 2025-12-30 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.6.2 | 2025-12-22 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.2.2 | 2025-12-17 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.4.2 | 2025-12-16 | — | — | 1 | — | KEV 1 |
—
|
— Signed
— SLSA
— SBOM
✗ Security policy
Weekly cadence · 10d median
Active maintainer
Trust Signals — 2 of 9 Present
Evidence already collected from releases and repository metadata.
2/9
Present
Signed releases
Unknown
Latest release artifact signature
Latest release
—
SLSA provenance
Unknown
Attestation predicate level
Latest release
—
SBOM published
Unknown
GitHub SBOM API
Latest release
—
SECURITY.md
Absent
GitHub repository metadata
Repository policy
Checked: 22d ago
Release cadence: weekly
Present
10d median over recent releases
Release history
Latest release: today
Maintainer active
Present
Recent commit activity
Repository
Last commit: 1d ago
Checksums (SHA256SUMS)
Not active yet
SHA256SUMS or equivalent
Release asset
Latest release: today
GitHub Actions attestation
Not active yet
actions/attest-build-provenance
Workflow file
Latest release: today
Signing assets
Not active yet
.sig, .crt, cosign.pub, or similar
Release asset
Latest release: today
0.0/10
Security Score
3.8/10
Scorecard
Dependency Exposure
323 transitive dependency
CVEs found in the latest SBOM.
21 critical.
Security Score
A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.
epss
0.00 / 0.5
Max EPSS 0.832
freshness
1.00 / 1.0
Up to date
scorecard
1.52 / 4.0
Score 3.8/10
cve health
0.00 / 2.5
⚠ No direct scan — 21c/125h transitive CVEs
patch speed
0.50 / 0.5
⚠ Estimated — no CVE patch history
kev exposure
-1.50 / 1.5
KEV exposure detected
supply chain risk
-1.50 / 10.0
Risk 100.0/100
Score breakdown
schema v2Vulnerability posture
vulnerability posture
0.0
25%
direct cves: clear
cve scan: estimated
Release responsiveness
release responsiveness
10.0
5%
patch speed days: no_history
Dependency exposure
dependency exposure
0.0
10%
supply chain risk: 100.0
transitive cves: 21c/125h
Provenance trust
provenance trust
3.8
40%
scorecard score: 3.8
openssf badge: none
Maintainer health
maintainer health
10.0
10%
activity freshness: 0d
Operational risk
operational risk
0.0
10%
kev exposure: detected
epss max: 0.832
How is this calculated?
The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.
Supply Chain Risk
Risk 100.0/100
21
Transitive critical CVEs
1
KEV-transitive CVEs
45%
Dependency freshness
Scorecard
Scorecard 3.8/10OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.
| Check | Score | Reason |
|---|---|---|
| Code-Review | 10 | all changesets reviewed |
| Maintained | 10 | 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
| Packaging | -1 | packaging workflow not detected |
| CII-Best-Practices | 0 | no effort to earn an OpenSSF best practices badge detected |
| Dangerous-Workflow | 0 | dangerous workflow patterns detected |
| Token-Permissions | 0 | detected GitHub workflow tokens with excessive permissions |
| License | 9 | license file detected |
| Branch-Protection | 3 | branch protection is not maximal on development and all release branches |
| Signed-Releases | -1 | no releases found |
| Security-Policy | 0 | security policy file not detected |
| Binary-Artifacts | 4 | binaries present in source code |
| SAST | 0 | SAST tool is not run on all commits -- score normalized to 0 |
| Fuzzing | 10 | project is fuzzed |
| Pinned-Dependencies | 0 | dependency not pinned by hash detected -- score normalized to 0 |
OpenSSF Badge
OpenSSF none
Badge indicates adherence to open-source best practices.
CVE Patch History
Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.
CVEs Patched by Year
Critical
High
Medium
Low
2026
1
| CVE | Severity | EPSS | Disclosed | Fixed in | Days to fix | vs Ecosystem Median | KEV |
|---|---|---|---|---|---|---|---|
| CVE-2025-31125 | MEDIUM | 99%ile | — | v2025.2.3.0 | — | — | KEV |
KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.
Dependency Vulnerabilities
5103 dependencies scanned
View full dependency list →
Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.
Critical
21
High
125
Medium
128
Low
27
Unknown
22
1 dependency vulnerabilities are in KEV.
CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.
Critical
21
High
125
Medium
128
Low
27
Unknown
22
| CVE | Severity | KEV | Dependency | Affected version | Cleared in release |
|---|---|---|---|---|---|
| CVE-2012-0805 | critical | — | sqlalchemy | — | v2025.2.3.0 |
| CVE-2017-16082 | critical | — | pg | 6.0.0 | v2025.2.3.0 |
| CVE-2018-17190 | critical | — | org.apache.spark:spark-core_2.11 | 2.4.8 | v2025.2.3.0 |
| CVE-2019-7164 | critical | — | sqlalchemy | — | v2025.2.3.0 |
| CVE-2019-7548 | critical | — | sqlalchemy | — | v2025.2.3.0 |
| CVE-2020-17446 | critical | — | asyncpg | — | v2025.2.3.0 |
| CVE-2021-23436 | critical | — | immer | 8.0.4 | v2025.2.3.0 |
| CVE-2021-44906 | critical | — | minimist | 0.0.8 | v2025.2.3.0 |
| CVE-2022-42889 | critical | — | org.apache.commons:commons-text | — | v2025.2.3.0 |
| CVE-2023-22946 | critical | — | org.apache.spark:spark-core_2.12 | 3.3.1 | v2025.2.3.0 |
| CVE-2023-46308 | critical | — | plotly.js | 1.54.1 | v2025.2.3.0 |
| CVE-2024-1597 | critical | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2024-21534 | critical | — | jsonpath-plus | 4.0.0 | v2025.2.3.0 |
| CVE-2024-33663 | critical | — | python-jose | 3.3.0 | v2025.2.3.0 |
| CVE-2024-45337 | critical | — | golang.org/x/crypto | 0.0.0-20220722155217-630584e8d5aa | v2025.2.3.0 |
| CVE-2024-47561 | critical | — | org.apache.avro:avro | 1.11.0 | v2025.2.3.0 |
| CVE-2025-64712 | critical | — | unstructured | — | v2025.2.3.0 |
| CVE-2025-68428 | critical | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2025-68664 | critical | — | langchain-core | — | v2025.2.3.0 |
| CVE-2026-31938 | critical | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-33186 | critical | — | google.golang.org/grpc | v1.77.0 | v2025.2.3.0 |
| CVE-2012-1618 | high | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2016-4970 | high | — | io.netty:netty-handler | — | v2025.2.3.0 |
| CVE-2017-12612 | high | — | org.apache.spark:spark-core_2.11 | — | v2025.2.3.0 |
| CVE-2018-11804 | high | — | org.apache.spark:spark-core_2.11 | — | v2025.2.3.0 |
| CVE-2019-10099 | high | — | org.apache.spark:spark-core_2.11 | — | v2025.2.3.0 |
| CVE-2019-16869 | high | — | io.netty:netty-all | — | v2025.2.3.0 |
| CVE-2019-18874 | high | — | psutil | — | v2025.2.3.0 |
| CVE-2020-11612 | high | — | io.netty:netty-handler | — | v2025.2.3.0 |
| CVE-2020-13692 | high | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2020-7238 | high | — | io.netty:netty-handler | — | v2025.2.3.0 |
| CVE-2020-8203 | high | — | lodash.set | 4.3.2 | v2025.2.3.0 |
| CVE-2021-22569 | high | — | com.google.protobuf:protobuf-java | — | v2025.2.3.0 |
| CVE-2021-23406 | high | — | pac-resolver | 4.2.0 | v2025.2.3.0 |
| CVE-2021-23406 | high | — | degenerator | 2.2.0 | v2025.2.3.0 |
| CVE-2021-3757 | high | — | immer | 8.0.4 | v2025.2.3.0 |
| CVE-2022-0144 | high | — | shelljs | 0.7.8 | v2025.2.3.0 |
| CVE-2022-0235 | high | — | node-fetch | 2.6.1 | v2025.2.3.0 |
| CVE-2022-21724 | high | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2022-24785 | high | — | moment | 2.26.0 | v2025.2.3.0 |
| CVE-2022-25647 | high | — | com.google.code.gson:gson | — | v2025.2.3.0 |
| CVE-2022-28948 | high | — | gopkg.in/yaml.v3 | v3.0.0 | v2025.2.3.0 |
| CVE-2022-31129 | high | — | moment | 2.26.0 | v2025.2.3.0 |
| CVE-2022-31197 | high | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2022-3509 | high | — | com.google.protobuf:protobuf-java | — | v2025.2.3.0 |
| CVE-2022-3510 | high | — | com.google.protobuf:protobuf-java | — | v2025.2.3.0 |
| CVE-2022-40897 | high | — | setuptools | 59.6.0 | v2025.2.3.0 |
| CVE-2022-40898 | high | — | wheel | — | v2025.2.3.0 |
| CVE-2022-45688 | high | — | org.json:json | 20180130 | v2025.2.3.0 |
| CVE-2023-1428 | high | — | io.grpc:grpc-protobuf | — | v2025.2.3.0 |
| CVE-2023-26133 | high | — | progressbar.js | 1.1.0 | v2025.2.3.0 |
| CVE-2023-32731 | high | — | io.grpc:grpc-protobuf | — | v2025.2.3.0 |
| CVE-2023-34455 | high | — | org.xerial.snappy:snappy-java | — | v2025.2.3.0 |
| CVE-2023-39410 | high | — | org.apache.avro:avro | 1.11.0 | v2025.2.3.0 |
| CVE-2023-43642 | high | — | org.xerial.snappy:snappy-java | — | v2025.2.3.0 |
| CVE-2023-43804 | high | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2023-5072 | high | — | org.json:json | 20180130 | v2025.2.3.0 |
| CVE-2023-52428 | high | — | com.nimbusds:nimbus-jose-jwt | 9.31 | v2025.2.3.0 |
| CVE-2023-6378 | high | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2023-6378 | high | — | ch.qos.logback:logback-classic | 1.2.10 | v2025.2.3.0 |
| CVE-2024-22421 | high | — | jupyterlab | — | v2025.2.3.0 |
| CVE-2024-24762 | high | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2024-24762 | high | — | fastapi | 0.104.1 | v2025.2.3.0 |
| CVE-2024-27289 | high | — | github.com/jackc/pgx/v4 | 4.7.1 | v2025.2.3.0 |
| CVE-2024-27304 | high | — | github.com/jackc/pgproto3 | 1.1.0 | v2025.2.3.0 |
| CVE-2024-27304 | high | — | github.com/jackc/pgx/v4 | 4.7.1 | v2025.2.3.0 |
| CVE-2024-29415 | high | — | ip | 1.1.9 | v2025.2.3.0 |
| CVE-2024-39008 | high | — | fast-loops | 1.1.3 | v2025.2.3.0 |
| CVE-2024-4068 | high | — | braces | 3.0.2 | v2025.2.3.0 |
| CVE-2024-43805 | high | — | jupyterlab | — | v2025.2.3.0 |
| CVE-2024-45296 | high | — | path-to-regexp | 1.8.0 | v2025.2.3.0 |
| CVE-2024-47068 | high | — | rollup | 2.79.1 | v2025.2.3.0 |
| CVE-2024-47554 | high | — | commons-io:commons-io | — | v2025.2.3.0 |
| CVE-2024-53981 | high | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2024-5998 | high | — | langchain-community | — | v2025.2.3.0 |
| CVE-2024-6345 | high | — | setuptools | 59.6.0 | v2025.2.3.0 |
| CVE-2024-7254 | high | — | com.google.protobuf:protobuf-java | — | v2025.2.3.0 |
| CVE-2025-12183 | high | — | org.lz4:lz4-java | — | v2025.2.3.0 |
| CVE-2025-12758 | high | — | validator | 11.1.0 | v2025.2.3.0 |
| CVE-2025-1302 | high | — | jsonpath-plus | 4.0.0 | v2025.2.3.0 |
| CVE-2025-22869 | high | — | golang.org/x/crypto | 0.0.0-20220722155217-630584e8d5aa | v2025.2.3.0 |
| CVE-2025-24970 | high | — | io.netty:netty-handler | — | v2025.2.3.0 |
| CVE-2025-25977 | high | — | canvg | 4.0.2 | v2025.2.3.0 |
| CVE-2025-27152 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2025-2828 | high | — | langchain-community | — | v2025.2.3.0 |
| CVE-2025-29907 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2025-47273 | high | — | setuptools | 59.6.0 | v2025.2.3.0 |
| CVE-2025-49146 | high | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2025-54920 | high | — | org.apache.spark:spark-core_2.12 | 3.3.1 | v2025.2.3.0 |
| CVE-2025-54920 | high | — | org.apache.spark:spark-core_2.11 | 2.4.8 | v2025.2.3.0 |
| CVE-2025-57810 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2025-65106 | high | — | langchain-core | — | v2025.2.3.0 |
| CVE-2025-66418 | high | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2025-66471 | high | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2025-66566 | high | — | org.lz4:lz4-java | — | v2025.2.3.0 |
| CVE-2025-6984 | high | — | langchain-community | — | v2025.2.3.0 |
| CVE-2025-6985 | high | — | langchain-text-splitters | — | v2025.2.3.0 |
| CVE-2026-21441 | high | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2026-24049 | high | — | wheel | — | v2025.2.3.0 |
| CVE-2026-24133 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-24486 | high | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2026-24737 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-25535 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-25639 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-25755 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-25940 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-26996 | high | — | minimatch | 3.1.2 | v2025.2.3.0 |
| CVE-2026-27148 | high | — | storybook | 8.6.15 | v2025.2.3.0 |
| CVE-2026-27606 | high | — | rollup | 2.79.1 | v2025.2.3.0 |
| CVE-2026-27903 | high | — | minimatch | 3.1.2 | v2025.2.3.0 |
| CVE-2026-27904 | high | — | minimatch | 3.1.2 | v2025.2.3.0 |
| CVE-2026-29063 | high | — | immutable | 5.1.4 | v2025.2.3.0 |
| CVE-2026-29074 | high | — | svgo | 2.8.0 | v2025.2.3.0 |
| CVE-2026-31812 | high | — | quinn-proto | 0.11.10 | v2025.2.3.0 |
| CVE-2026-31898 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-32141 | high | — | flatted | 3.3.3 | v2025.2.3.0 |
| CVE-2026-32286 | high | — | github.com/jackc/pgproto3/v2 | v2.3.3 | v2025.2.3.0 |
| CVE-2026-32829 | high | — | lz4_flex | 0.11.3 | v2025.2.3.0 |
| CVE-2026-33228 | high | — | flatted | 3.3.3 | v2025.2.3.0 |
| CVE-2026-33671 | high | — | picomatch | 4.0.3 | v2025.2.3.0 |
| CVE-2026-34070 | high | — | langchain-core | — | v2025.2.3.0 |
| CVE-2026-35554 | high | — | org.apache.kafka:kafka-clients | 2.8.1 | v2025.2.3.0 |
| CVE-2026-39363 | high | — | vite | 6.4.1 | v2025.2.3.0 |
| CVE-2026-40171 | high | — | jupyterlab | — | v2025.2.3.0 |
| CVE-2026-41676 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-41678 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-41681 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-41898 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-42033 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42035 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42043 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42198 | high | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2026-42266 | high | — | jupyterlab | — | v2025.2.3.0 |
| CVE-2026-42327 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-42557 | high | — | jupyterlab | — | v2025.2.3.0 |
| CVE-2026-42561 | high | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2026-44728 | high | — | @babel/plugin-transform-modules-systemjs | 7.28.5 | v2025.2.3.0 |
| CVE-2026-4800 | high | — | lodash-es | 4.17.21 | v2025.2.3.0 |
| CVE-2026-4800 | high | — | lodash | 4.17.21 | v2025.2.3.0 |
| CVE-2026-4867 | high | — | path-to-regexp | 0.1.12 | v2025.2.3.0 |
| CVE-2026-6321 | high | — | fast-uri | 3.1.0 | v2025.2.3.0 |
| CVE-2026-6322 | high | — | fast-uri | 3.1.0 | v2025.2.3.0 |
| GHSA-36jr-mh4h-2g58 | high | — | d3-color | 1.4.1 | v2025.2.3.0 |
| GHSA-5c6j-r48x-rmvq | high | — | serialize-javascript | 6.0.2 | v2025.2.3.0 |
| GHSA-82j2-j2ch-gfr8 | high | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| GHSA-x9hc-rw35-f44h | high | — | static-eval | 0.2.4 | v2025.2.3.0 |
| CVE-2014-0193 | medium | — | io.netty:netty-all | — | v2025.2.3.0 |
| CVE-2014-3488 | medium | — | io.netty:netty-handler | — | v2025.2.3.0 |
| CVE-2017-16226 | medium | — | static-eval | 0.2.4 | v2025.2.3.0 |
| CVE-2017-7678 | medium | — | org.apache.spark:spark-core_2.11 | — | v2025.2.3.0 |
| CVE-2018-10237 | medium | — | com.google.guava:guava | — | v2025.2.3.0 |
| CVE-2018-11770 | medium | — | org.apache.spark:spark-core_2.11 | — | v2025.2.3.0 |
| CVE-2018-1334 | medium | — | org.apache.spark:spark-core_2.11 | — | v2025.2.3.0 |
| CVE-2018-8024 | medium | — | org.apache.spark:spark-core_2.11 | — | v2025.2.3.0 |
| CVE-2019-20445 | medium | — | io.netty:netty-handler | — | v2025.2.3.0 |
| CVE-2020-15250 | medium | — | junit:junit | 4.13 | v2025.2.3.0 |
| CVE-2020-7598 | medium | — | minimist | 0.0.8 | v2025.2.3.0 |
| CVE-2021-23398 | medium | — | react-bootstrap-table | 4.3.1 | v2025.2.3.0 |
| CVE-2021-23807 | medium | — | jsonpointer | 4.1.0 | v2025.2.3.0 |
| CVE-2021-29425 | medium | — | commons-io:commons-io | — | v2025.2.3.0 |
| CVE-2021-32797 | medium | — | jupyterlab | — | v2025.2.3.0 |
| CVE-2021-3765 | medium | — | validator | 11.1.0 | v2025.2.3.0 |
| CVE-2022-29526 | medium | — | golang.org/x/sys | 0.0.0-20210615035016-665e8c7367d1 | v2025.2.3.0 |
| CVE-2022-3171 | medium | — | com.google.protobuf:protobuf-java | — | v2025.2.3.0 |
| CVE-2022-31777 | medium | — | org.apache.spark:spark-core_2.11 | 2.4.8 | v2025.2.3.0 |
| CVE-2022-33987 | medium | — | got | 9.6.0 | v2025.2.3.0 |
| CVE-2022-41946 | medium | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2023-2976 | medium | — | com.google.guava:guava | — | v2025.2.3.0 |
| CVE-2023-32732 | medium | — | io.grpc:grpc-protobuf | — | v2025.2.3.0 |
| CVE-2023-34453 | medium | — | org.xerial.snappy:snappy-java | — | v2025.2.3.0 |
| CVE-2023-34454 | medium | — | org.xerial.snappy:snappy-java | — | v2025.2.3.0 |
| CVE-2023-34462 | medium | — | io.netty:netty-handler | — | v2025.2.3.0 |
| CVE-2023-45803 | medium | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2023-45857 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2023-48795 | medium | — | golang.org/x/crypto | 0.0.0-20220722155217-630584e8d5aa | v2025.2.3.0 |
| CVE-2024-10940 | medium | — | langchain-core | — | v2025.2.3.0 |
| CVE-2024-12798 | medium | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2024-1455 | medium | — | langchain-core | — | v2025.2.3.0 |
| CVE-2024-22195 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2024-22420 | medium | — | jupyterlab | — | v2025.2.3.0 |
| CVE-2024-28849 | medium | — | follow-redirects | 1.15.4 | v2025.2.3.0 |
| CVE-2024-2965 | medium | — | langchain-community | — | v2025.2.3.0 |
| CVE-2024-3095 | medium | — | langchain-community | — | v2025.2.3.0 |
| CVE-2024-31141 | medium | — | org.apache.kafka:kafka-clients | 2.8.1 | v2025.2.3.0 |
| CVE-2024-33664 | medium | — | python-jose | 3.3.0 | v2025.2.3.0 |
| CVE-2024-34064 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2024-35195 | medium | — | requests | 2.31.0 | v2025.2.3.0 |
| CVE-2024-3651 | medium | — | idna | 3.4 | v2025.2.3.0 |
| CVE-2024-37891 | medium | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2024-4067 | medium | — | micromatch | 4.0.5 | v2025.2.3.0 |
| CVE-2024-46455 | medium | — | unstructured | — | v2025.2.3.0 |
| CVE-2024-47081 | medium | — | requests | 2.31.0 | v2025.2.3.0 |
| CVE-2024-53382 | medium | — | prismjs | 1.29.0 | v2025.2.3.0 |
| CVE-2024-55565 | medium | — | nanoid | 2.1.11 | v2025.2.3.0 |
| CVE-2024-56201 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2024-56326 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2024-6485 | medium | — | bootstrap | 3.4.1 | v2025.2.3.0 |
| CVE-2025-11226 | medium | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2025-13465 | medium | — | lodash-es | 4.17.21 | v2025.2.3.0 |
| CVE-2025-13465 | medium | — | lodash | 4.17.21 | v2025.2.3.0 |
| CVE-2025-15599 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2025-1647 | medium | — | bootstrap | 3.4.1 | v2025.2.3.0 |
| CVE-2025-24010 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-26791 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2025-27516 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2025-27789 | medium | — | @babel/runtime | 7.23.8 | v2025.2.3.0 |
| CVE-2025-27789 | medium | — | @babel/helpers | 7.23.7 | v2025.2.3.0 |
| CVE-2025-30208 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-31125 | medium | KEV | vite | 4.5.5 | v2025.2.3.1 |
| CVE-2025-31486 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-32395 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-46565 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-47914 | medium | — | golang.org/x/crypto | v0.36.0 | v2025.2.3.0 |
| CVE-2025-48924 | medium | — | org.apache.commons:commons-lang3 | — | v2025.2.3.0 |
| CVE-2025-50181 | medium | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2025-53864 | medium | — | com.nimbusds:nimbus-jose-jwt | 9.31 | v2025.2.3.0 |
| CVE-2025-56200 | medium | — | validator | 11.1.0 | v2025.2.3.0 |
| CVE-2025-58181 | medium | — | golang.org/x/crypto | v0.36.0 | v2025.2.3.0 |
| CVE-2025-62522 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-62718 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2025-64718 | medium | — | js-yaml | 4.1.0 | v2025.2.3.0 |
| CVE-2025-69873 | medium | — | ajv | 6.12.6 | v2025.2.3.0 |
| CVE-2025-71176 | medium | — | pytest | 7.4.3 | v2025.2.3.0 |
| CVE-2025-8916 | medium | — | org.bouncycastle:bcpkix-jdk15on | — | v2025.2.3.0 |
| CVE-2026-0540 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2026-24040 | medium | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-24043 | medium | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-25541 | medium | — | bytes | 1.10.1 | v2025.2.3.0 |
| CVE-2026-25645 | medium | — | requests | 2.31.0 | v2025.2.3.0 |
| CVE-2026-25727 | medium | — | time | 0.3.41 | v2025.2.3.0 |
| CVE-2026-2739 | medium | — | bn.js | 4.12.0 | v2025.2.3.0 |
| CVE-2026-2950 | medium | — | lodash-es | 4.17.21 | v2025.2.3.0 |
| CVE-2026-2950 | medium | — | lodash | 4.17.21 | v2025.2.3.0 |
| CVE-2026-3219 | medium | — | pip | 26.0.1 | v2025.2.3.0 |
| CVE-2026-33055 | medium | — | tar | 0.4.44 | v2025.2.3.0 |
| CVE-2026-33056 | medium | — | tar | 0.4.44 | v2025.2.3.0 |
| CVE-2026-33532 | medium | — | yaml | 2.8.2 | v2025.2.3.0 |
| CVE-2026-33558 | medium | — | org.apache.kafka:kafka-clients | 2.8.1 | v2025.2.3.0 |
| CVE-2026-33672 | medium | — | picomatch | 4.0.3 | v2025.2.3.0 |
| CVE-2026-33750 | medium | — | brace-expansion | 1.1.12 | v2025.2.3.0 |
| CVE-2026-34043 | medium | — | serialize-javascript | 6.0.2 | v2025.2.3.0 |
| CVE-2026-39365 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2026-40087 | medium | — | langchain-core | — | v2025.2.3.0 |
| CVE-2026-40175 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-40347 | medium | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2026-41239 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2026-41240 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2026-41305 | medium | — | postcss | 8.5.6 | v2025.2.3.0 |
| CVE-2026-41481 | medium | — | langchain-text-splitters | — | v2025.2.3.0 |
| CVE-2026-42034 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42036 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42038 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42039 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42041 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42042 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42338 | medium | — | ip-address | 8.1.0 | v2025.2.3.0 |
| CVE-2026-43868 | medium | — | thrift | 0.17.0 | v2025.2.3.0 |
| CVE-2026-44662 | medium | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-5588 | medium | — | org.bouncycastle:bcpkix-jdk15on | — | v2025.2.3.0 |
| CVE-2026-5758 | medium | — | protocol-buffers-schema | 3.6.0 | v2025.2.3.0 |
| CVE-2026-6357 | medium | — | pip | 26.0.1 | v2025.2.3.0 |
| GHSA-39q2-94rc-95cp | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| GHSA-64g7-mvw6-v9qj | medium | — | shelljs | 0.7.8 | v2025.2.3.0 |
| GHSA-673j-qm5f-xpv8 | medium | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| GHSA-67mh-4wv8-2f99 | medium | — | esbuild | 0.18.20 | v2025.2.3.0 |
| GHSA-72hv-8253-57qq | medium | — | com.fasterxml.jackson.core:jackson-core | 2.19.2 | v2025.2.3.0 |
| GHSA-7wwv-vh3v-89cq | medium | — | highlight.js | 9.18.2 | v2025.2.3.0 |
| GHSA-cj63-jhhr-wcxv | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| GHSA-cjmm-f4jc-qw8r | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| GHSA-h8r8-wccr-v5f2 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| GHSA-pwjx-qhcg-rvj4 | medium | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| GHSA-q2qq-hmj6-3wpp | medium | — | hickory-proto | 0.24.4 | v2025.2.3.0 |
| GHSA-r4q5-vmmm-2653 | medium | — | follow-redirects | 1.15.11 | v2025.2.3.0 |
| GHSA-xx4c-jj58-r7x6 | medium | — | validator | 11.1.0 | v2025.2.3.0 |
| CVE-2020-8908 | low | — | com.google.guava:guava | — | v2025.2.3.0 |
| CVE-2022-26520 | low | — | org.postgresql:postgresql | — | v2025.2.3.0 |
| CVE-2024-12801 | low | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2024-27088 | low | — | es5-ext | 0.10.62 | v2025.2.3.0 |
| CVE-2024-28088 | low | — | langchain-core | — | v2025.2.3.0 |
| CVE-2024-39689 | low | — | certifi | 2023.7.22 | v2025.2.3.0 |
| CVE-2024-8309 | low | — | langchain-community | — | v2025.2.3.0 |
| CVE-2025-46392 | low | — | commons-configuration:commons-configuration | 1.10 | v2025.2.3.0 |
| CVE-2025-58160 | low | — | tracing-subscriber | 0.3.19 | v2025.2.3.0 |
| CVE-2025-58751 | low | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-58752 | low | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-5889 | low | — | brace-expansion | 1.1.11 | v2025.2.3.0 |
| CVE-2025-59842 | low | — | jupyterlab | — | v2025.2.3.0 |
| CVE-2026-1225 | low | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2026-2391 | low | — | qs | 6.14.1 | v2025.2.3.0 |
| CVE-2026-26013 | low | — | langchain-core | — | v2025.2.3.0 |
| CVE-2026-3449 | low | — | @tootallnate/once | 1.1.2 | v2025.2.3.0 |
| CVE-2026-41488 | low | — | langchain-openai | — | v2025.2.3.0 |
| CVE-2026-41677 | low | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-41889 | low | — | github.com/jackc/pgx/v4 | v4.18.3 | v2025.2.3.0 |
| CVE-2026-42040 | low | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-4539 | low | — | pygments | 2.15.0 | v2025.2.3.0 |
| GHSA-965h-392x-2mh5 | low | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| GHSA-cq8v-f236-94qc | low | — | rand | 0.9.0 | v2025.2.3.0 |
| GHSA-g59m-gf8j-gjf5 | low | — | aws-sdk-sts | 1.62.0 | v2025.2.3.0 |
| GHSA-g98v-hv3f-hcfr | low | — | atty | 0.2.14 | v2025.2.3.0 |
| GHSA-xgp8-3hg3-c2mh | low | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| CVE-2020-8911 | unknown | — | github.com/aws/aws-sdk-go | v1.55.5 | v2025.2.3.0 |
| CVE-2020-8912 | unknown | — | github.com/aws/aws-sdk-go | v1.55.5 | v2025.2.3.0 |
| CVE-2022-40896 | unknown | — | pygments | 2.15.0 | v2025.2.3.0 |
| CVE-2025-47911 | unknown | — | golang.org/x/net | v0.38.0 | v2025.2.3.0 |
| CVE-2025-47913 | unknown | — | golang.org/x/crypto | v0.36.0 | v2025.2.3.0 |
| CVE-2025-58190 | unknown | — | golang.org/x/net | v0.38.0 | v2025.2.3.0 |
| CVE-2026-33814 | unknown | — | golang.org/x/net | v0.38.0 | v2025.2.3.0 |
| RUSTSEC-2021-0127 | unknown | — | serde_cbor | 0.11.2,< 0.12.0 | v2025.2.3.0 |
| RUSTSEC-2021-0145 | unknown | — | atty | 0.2.14 | v2025.2.3.0 |
| RUSTSEC-2024-0320 | unknown | — | yaml-rust | 0.4.5 | v2025.2.3.0 |
| RUSTSEC-2024-0375 | unknown | — | atty | 0.2.14 | v2025.2.3.0 |
| RUSTSEC-2024-0384 | unknown | — | instant | 0.1.13 | v2025.2.3.0 |
| RUSTSEC-2024-0436 | unknown | — | paste | 1.0.0,< 2.0.0 | v2025.2.3.0 |
| RUSTSEC-2025-0056 | unknown | — | adler | 1.0.2 | v2025.2.3.0 |
| RUSTSEC-2025-0134 | unknown | — | rustls-pemfile | 2.2.0 | v2025.2.3.0 |
| RUSTSEC-2025-0141 | unknown | — | bincode | 1.3.3 | v2025.2.3.0 |
| RUSTSEC-2026-0049 | unknown | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| RUSTSEC-2026-0097 | unknown | — | rand | 0.9.0 | v2025.2.3.0 |
| RUSTSEC-2026-0098 | unknown | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| RUSTSEC-2026-0099 | unknown | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| RUSTSEC-2026-0104 | unknown | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| RUSTSEC-2026-0119 | unknown | — | hickory-proto | 0.24.4 | v2025.2.3.0 |
Showing 323 of 323