Security Deep Dive
yugabyte-db
Security posture and CVE patch evidence from tracked releases.
1 actively-exploited dependency CVE affects v2024.2.9.1.
KEV-listed CVEs are confirmed exploited in the wild — patch urgently.
Versions by Severity
CVEs are attributed to tracked releases published before the patch release.
| Version | Published | C | H | M | L | KEV | Notes |
|---|---|---|---|---|---|---|---|
| v2024.2.9.1 | 2026-06-03 | — | — | — | — | — |
Latest
|
| v2025.2.3.1 | 2026-06-02 | — | — | — | — | — |
—
|
| v2025.2.3.0 | 2026-05-14 | — | — | — | — | — |
Patches
CVE-2025-31125
|
| v2024.2.9.0 | 2026-04-29 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.4.0 | 2026-04-20 | — | — | 1 | — | KEV 1 |
—
|
| v2025.2.2.2 | 2026-04-07 | — | — | 1 | — | KEV 1 |
—
|
| v2025.2.2.1 | 2026-03-23 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.3.2 | 2026-02-26 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.8.0 | 2026-02-23 | — | — | 1 | — | KEV 1 |
—
|
| v2025.2.1.0 | 2026-02-12 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.3.1 | 2026-02-06 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.7.3 | 2026-02-03 | — | — | 1 | — | KEV 1 |
—
|
| v2025.2.0.1 | 2026-01-27 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.7.2 | 2026-01-16 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.3.0 | 2026-01-16 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.7.1 | 2025-12-31 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.7.0 | 2025-12-30 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.6.2 | 2025-12-22 | — | — | 1 | — | KEV 1 |
—
|
| v2025.1.2.2 | 2025-12-17 | — | — | 1 | — | KEV 1 |
—
|
| v2024.2.4.2 | 2025-12-16 | — | — | 1 | — | KEV 1 |
—
|
— Signed
— SLSA
— SBOM
✗ Security policy
Weekly cadence · 10d median
Active maintainer
Trust Signals — 2 of 9 Present
Evidence already collected from releases and repository metadata.
2/9
Present
Signed releases
Unknown
Latest release artifact signature
Latest release
—
SLSA provenance
Unknown
Attestation predicate level
Latest release
—
SBOM published
Unknown
GitHub SBOM API
Latest release
—
SECURITY.md
Absent
GitHub repository metadata
Repository policy
Checked: 22d ago
Release cadence: weekly
Present
10d median over recent releases
Release history
Latest release: today
Maintainer active
Present
Recent commit activity
Repository
Last commit: 1d ago
Checksums (SHA256SUMS)
Not active yet
SHA256SUMS or equivalent
Release asset
Latest release: today
GitHub Actions attestation
Not active yet
actions/attest-build-provenance
Workflow file
Latest release: today
Signing assets
Not active yet
.sig, .crt, cosign.pub, or similar
Release asset
Latest release: today
0.0/10
Security Score
3.8/10
Scorecard
Dependency Exposure
231 transitive dependency
CVEs found in the latest SBOM.
12 critical.
Security Score
A composite score aggregating Scorecard performance, CVE patch history, OpenSSF badge tier, and dependency vulnerability exposure. Score ≥ 7.0 is healthy; < 4.0 warrants attention.
epss
0.00 / 0.5
Max EPSS 0.832
freshness
1.00 / 1.0
Up to date
scorecard
1.52 / 4.0
Score 3.8/10
cve health
0.00 / 2.5
⚠ No direct scan — 21c/125h transitive CVEs
patch speed
0.50 / 0.5
⚠ Estimated — no CVE patch history
kev exposure
-1.50 / 1.5
KEV exposure detected
supply chain risk
-1.50 / 10.0
Risk 100.0/100
Score breakdown
schema v2Vulnerability posture
vulnerability posture
0.0
25%
direct cves: clear
cve scan: estimated
Release responsiveness
release responsiveness
10.0
5%
patch speed days: no_history
Dependency exposure
dependency exposure
0.0
10%
supply chain risk: 100.0
transitive cves: 21c/125h
Provenance trust
provenance trust
3.8
40%
scorecard score: 3.8
openssf badge: none
Maintainer health
maintainer health
10.0
10%
activity freshness: 0d
Operational risk
operational risk
0.0
10%
kev exposure: detected
epss max: 0.832
How is this calculated?
The six dimensions group the legacy score signals into weighted categories: direct vulnerability status, patch responsiveness, dependency exposure, provenance checks, maintainer activity, and exploitability risk. The flat component values above remain available for compatibility.
Supply Chain Risk
Risk 100.0/100
12
Transitive critical CVEs
1
KEV-transitive CVEs
45%
Dependency freshness
Scorecard
Scorecard 3.8/10OpenSSF Scorecard evaluates supply-chain security practices automatically. Score ≥ 6 is passing; ≥ 8 is excellent.
| Check | Score | Reason |
|---|---|---|
| Code-Review | 10 | all changesets reviewed |
| Maintained | 10 | 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
| Packaging | -1 | packaging workflow not detected |
| CII-Best-Practices | 0 | no effort to earn an OpenSSF best practices badge detected |
| Dangerous-Workflow | 0 | dangerous workflow patterns detected |
| Token-Permissions | 0 | detected GitHub workflow tokens with excessive permissions |
| License | 9 | license file detected |
| Branch-Protection | 3 | branch protection is not maximal on development and all release branches |
| Signed-Releases | -1 | no releases found |
| Security-Policy | 0 | security policy file not detected |
| Binary-Artifacts | 4 | binaries present in source code |
| SAST | 0 | SAST tool is not run on all commits -- score normalized to 0 |
| Fuzzing | 10 | project is fuzzed |
| Pinned-Dependencies | 0 | dependency not pinned by hash detected -- score normalized to 0 |
OpenSSF Badge
OpenSSF none
Badge indicates adherence to open-source best practices.
CVE Patch History
Tracks CVEs that were addressed in tagged releases. Shorter gap between disclosure and patch = faster response. EPSS = predicted probability of exploitation in next 30 days (FIRST.org); colored at ≥90%ile and ≥50%ile.
CVEs Patched by Year
Critical
High
Medium
Low
2026
1
| CVE | Severity | EPSS | Disclosed | Fixed in | Days to fix | vs Ecosystem Median | KEV |
|---|---|---|---|---|---|---|---|
| CVE-2025-31125 | MEDIUM | 99%ile | — | v2025.2.3.0 | — | — | KEV |
KEV = CISA Known Exploited Vulnerabilities catalog — actively exploited in the wild.
Dependency Vulnerabilities
5103 dependencies scanned
View full dependency list →
Scanning the SBOM (Software Bill of Materials) of the latest release for known vulnerabilities in transitive dependencies.
Critical
12
High
83
Medium
99
Low
18
Unknown
19
1 dependency vulnerabilities are in KEV.
CISA confirmed these vulnerabilities are actively exploited. Treat as critical priority.
Critical
12
High
83
Medium
99
Low
18
Unknown
19
| CVE | Severity | KEV | Dependency | Affected version | Cleared in release |
|---|---|---|---|---|---|
| CVE-2018-17190 | critical | — | org.apache.spark:spark-core_2.11 | 2.4.8 | v2025.2.3.0 |
| CVE-2021-23436 | critical | — | immer | 8.0.4 | v2025.2.3.0 |
| CVE-2021-44906 | critical | — | minimist | 0.0.8 | v2025.2.3.0 |
| CVE-2023-22946 | critical | — | org.apache.spark:spark-core_2.12 | 3.3.1 | v2025.2.3.0 |
| CVE-2023-46308 | critical | — | plotly.js | 1.54.1 | v2025.2.3.0 |
| CVE-2024-21534 | critical | — | jsonpath-plus | 4.0.0 | v2025.2.3.0 |
| CVE-2024-33663 | critical | — | python-jose | 3.3.0 | v2025.2.3.0 |
| CVE-2024-45337 | critical | — | golang.org/x/crypto | 0.0.0-20220722155217-630584e8d5aa | v2025.2.3.0 |
| CVE-2024-47561 | critical | — | org.apache.avro:avro | 1.11.0 | v2025.2.3.0 |
| CVE-2025-68428 | critical | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-31938 | critical | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-33186 | critical | — | google.golang.org/grpc | v1.77.0 | v2025.2.3.0 |
| CVE-2020-8203 | high | — | lodash.set | 4.3.2 | v2025.2.3.0 |
| CVE-2021-23406 | high | — | pac-resolver | 4.2.0 | v2025.2.3.0 |
| CVE-2021-23406 | high | — | degenerator | 2.2.0 | v2025.2.3.0 |
| CVE-2021-3757 | high | — | immer | 8.0.4 | v2025.2.3.0 |
| CVE-2022-0144 | high | — | shelljs | 0.7.8 | v2025.2.3.0 |
| CVE-2022-0235 | high | — | node-fetch | 2.6.1 | v2025.2.3.0 |
| CVE-2022-24785 | high | — | moment | 2.26.0 | v2025.2.3.0 |
| CVE-2022-28948 | high | — | gopkg.in/yaml.v3 | v3.0.0 | v2025.2.3.0 |
| CVE-2022-31129 | high | — | moment | 2.26.0 | v2025.2.3.0 |
| CVE-2022-40897 | high | — | setuptools | 59.6.0 | v2025.2.3.0 |
| CVE-2023-26133 | high | — | progressbar.js | 1.1.0 | v2025.2.3.0 |
| CVE-2023-39410 | high | — | org.apache.avro:avro | 1.11.0 | v2025.2.3.0 |
| CVE-2023-43804 | high | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2023-52428 | high | — | com.nimbusds:nimbus-jose-jwt | 9.31 | v2025.2.3.0 |
| CVE-2023-6378 | high | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2023-6378 | high | — | ch.qos.logback:logback-classic | 1.2.10 | v2025.2.3.0 |
| CVE-2024-24762 | high | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2024-24762 | high | — | fastapi | 0.104.1 | v2025.2.3.0 |
| CVE-2024-27289 | high | — | github.com/jackc/pgx/v4 | 4.7.1 | v2025.2.3.0 |
| CVE-2024-27304 | high | — | github.com/jackc/pgproto3 | 1.1.0 | v2025.2.3.0 |
| CVE-2024-27304 | high | — | github.com/jackc/pgx/v4 | 4.7.1 | v2025.2.3.0 |
| CVE-2024-29415 | high | — | ip | 1.1.9 | v2025.2.3.0 |
| CVE-2024-39008 | high | — | fast-loops | 1.1.3 | v2025.2.3.0 |
| CVE-2024-4068 | high | — | braces | 3.0.2 | v2025.2.3.0 |
| CVE-2024-45296 | high | — | path-to-regexp | 1.8.0 | v2025.2.3.0 |
| CVE-2024-47068 | high | — | rollup | 2.79.1 | v2025.2.3.0 |
| CVE-2024-53981 | high | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2024-6345 | high | — | setuptools | 59.6.0 | v2025.2.3.0 |
| CVE-2025-12758 | high | — | validator | 11.1.0 | v2025.2.3.0 |
| CVE-2025-1302 | high | — | jsonpath-plus | 4.0.0 | v2025.2.3.0 |
| CVE-2025-22869 | high | — | golang.org/x/crypto | 0.0.0-20220722155217-630584e8d5aa | v2025.2.3.0 |
| CVE-2025-25977 | high | — | canvg | 4.0.2 | v2025.2.3.0 |
| CVE-2025-27152 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2025-29907 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2025-47273 | high | — | setuptools | 59.6.0 | v2025.2.3.0 |
| CVE-2025-54920 | high | — | org.apache.spark:spark-core_2.12 | 3.3.1 | v2025.2.3.0 |
| CVE-2025-54920 | high | — | org.apache.spark:spark-core_2.11 | 2.4.8 | v2025.2.3.0 |
| CVE-2025-57810 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2025-66418 | high | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2025-66471 | high | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2026-21441 | high | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2026-24133 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-24486 | high | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2026-24737 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-25535 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-25639 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-25755 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-25940 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-26996 | high | — | minimatch | 3.1.2 | v2025.2.3.0 |
| CVE-2026-27148 | high | — | storybook | 8.6.15 | v2025.2.3.0 |
| CVE-2026-27606 | high | — | rollup | 2.79.1 | v2025.2.3.0 |
| CVE-2026-27903 | high | — | minimatch | 3.1.2 | v2025.2.3.0 |
| CVE-2026-27904 | high | — | minimatch | 3.1.2 | v2025.2.3.0 |
| CVE-2026-29063 | high | — | immutable | 5.1.4 | v2025.2.3.0 |
| CVE-2026-29074 | high | — | svgo | 2.8.0 | v2025.2.3.0 |
| CVE-2026-31812 | high | — | quinn-proto | 0.11.10 | v2025.2.3.0 |
| CVE-2026-31898 | high | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-32141 | high | — | flatted | 3.3.3 | v2025.2.3.0 |
| CVE-2026-32286 | high | — | github.com/jackc/pgproto3/v2 | v2.3.3 | v2025.2.3.0 |
| CVE-2026-32829 | high | — | lz4_flex | 0.11.3 | v2025.2.3.0 |
| CVE-2026-33228 | high | — | flatted | 3.3.3 | v2025.2.3.0 |
| CVE-2026-33671 | high | — | picomatch | 4.0.3 | v2025.2.3.0 |
| CVE-2026-35554 | high | — | org.apache.kafka:kafka-clients | 2.8.1 | v2025.2.3.0 |
| CVE-2026-39363 | high | — | vite | 6.4.1 | v2025.2.3.0 |
| CVE-2026-41676 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-41678 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-41681 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-41898 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-42033 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42035 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42043 | high | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42327 | high | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-42561 | high | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2026-44728 | high | — | @babel/plugin-transform-modules-systemjs | 7.28.5 | v2025.2.3.0 |
| CVE-2026-4800 | high | — | lodash-es | 4.17.21 | v2025.2.3.0 |
| CVE-2026-4800 | high | — | lodash | 4.17.21 | v2025.2.3.0 |
| CVE-2026-4867 | high | — | path-to-regexp | 0.1.12 | v2025.2.3.0 |
| CVE-2026-6321 | high | — | fast-uri | 3.1.0 | v2025.2.3.0 |
| CVE-2026-6322 | high | — | fast-uri | 3.1.0 | v2025.2.3.0 |
| GHSA-36jr-mh4h-2g58 | high | — | d3-color | 1.4.1 | v2025.2.3.0 |
| GHSA-5c6j-r48x-rmvq | high | — | serialize-javascript | 6.0.2 | v2025.2.3.0 |
| GHSA-82j2-j2ch-gfr8 | high | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| GHSA-x9hc-rw35-f44h | high | — | static-eval | 0.2.4 | v2025.2.3.0 |
| CVE-2017-16226 | medium | — | static-eval | 0.2.4 | v2025.2.3.0 |
| CVE-2020-15250 | medium | — | junit:junit | 4.13 | v2025.2.3.0 |
| CVE-2020-7598 | medium | — | minimist | 0.0.8 | v2025.2.3.0 |
| CVE-2021-23398 | medium | — | react-bootstrap-table | 4.3.1 | v2025.2.3.0 |
| CVE-2021-23807 | medium | — | jsonpointer | 4.1.0 | v2025.2.3.0 |
| CVE-2021-3765 | medium | — | validator | 11.1.0 | v2025.2.3.0 |
| CVE-2022-29526 | medium | — | golang.org/x/sys | 0.0.0-20210615035016-665e8c7367d1 | v2025.2.3.0 |
| CVE-2022-31777 | medium | — | org.apache.spark:spark-core_2.11 | 2.4.8 | v2025.2.3.0 |
| CVE-2022-33987 | medium | — | got | 9.6.0 | v2025.2.3.0 |
| CVE-2023-45803 | medium | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2023-45857 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2023-48795 | medium | — | golang.org/x/crypto | 0.0.0-20220722155217-630584e8d5aa | v2025.2.3.0 |
| CVE-2024-12798 | medium | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2024-22195 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2024-28849 | medium | — | follow-redirects | 1.15.4 | v2025.2.3.0 |
| CVE-2024-31141 | medium | — | org.apache.kafka:kafka-clients | 2.8.1 | v2025.2.3.0 |
| CVE-2024-33664 | medium | — | python-jose | 3.3.0 | v2025.2.3.0 |
| CVE-2024-34064 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2024-35195 | medium | — | requests | 2.31.0 | v2025.2.3.0 |
| CVE-2024-3651 | medium | — | idna | 3.4 | v2025.2.3.0 |
| CVE-2024-37891 | medium | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2024-4067 | medium | — | micromatch | 4.0.5 | v2025.2.3.0 |
| CVE-2024-47081 | medium | — | requests | 2.31.0 | v2025.2.3.0 |
| CVE-2024-53382 | medium | — | prismjs | 1.29.0 | v2025.2.3.0 |
| CVE-2024-55565 | medium | — | nanoid | 2.1.11 | v2025.2.3.0 |
| CVE-2024-56201 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2024-56326 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2024-6485 | medium | — | bootstrap | 3.4.1 | v2025.2.3.0 |
| CVE-2025-11226 | medium | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2025-13465 | medium | — | lodash-es | 4.17.21 | v2025.2.3.0 |
| CVE-2025-13465 | medium | — | lodash | 4.17.21 | v2025.2.3.0 |
| CVE-2025-15599 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2025-1647 | medium | — | bootstrap | 3.4.1 | v2025.2.3.0 |
| CVE-2025-24010 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-26791 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2025-27516 | medium | — | jinja2 | 3.1.2 | v2025.2.3.0 |
| CVE-2025-27789 | medium | — | @babel/runtime | 7.23.8 | v2025.2.3.0 |
| CVE-2025-27789 | medium | — | @babel/helpers | 7.23.7 | v2025.2.3.0 |
| CVE-2025-30208 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-31125 | medium | KEV | vite | 4.5.5 | v2025.2.3.1 |
| CVE-2025-31486 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-32395 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-46565 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-47914 | medium | — | golang.org/x/crypto | v0.36.0 | v2025.2.3.0 |
| CVE-2025-50181 | medium | — | urllib3 | 1.26.14 | v2025.2.3.0 |
| CVE-2025-53864 | medium | — | com.nimbusds:nimbus-jose-jwt | 9.31 | v2025.2.3.0 |
| CVE-2025-56200 | medium | — | validator | 11.1.0 | v2025.2.3.0 |
| CVE-2025-58181 | medium | — | golang.org/x/crypto | v0.36.0 | v2025.2.3.0 |
| CVE-2025-62522 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-62718 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2025-64718 | medium | — | js-yaml | 4.1.0 | v2025.2.3.0 |
| CVE-2025-69873 | medium | — | ajv | 6.12.6 | v2025.2.3.0 |
| CVE-2025-71176 | medium | — | pytest | 7.4.3 | v2025.2.3.0 |
| CVE-2026-0540 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2026-24040 | medium | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-24043 | medium | — | jspdf | 2.5.1 | v2025.2.3.0 |
| CVE-2026-25541 | medium | — | bytes | 1.10.1 | v2025.2.3.0 |
| CVE-2026-25645 | medium | — | requests | 2.31.0 | v2025.2.3.0 |
| CVE-2026-25727 | medium | — | time | 0.3.41 | v2025.2.3.0 |
| CVE-2026-2739 | medium | — | bn.js | 4.12.0 | v2025.2.3.0 |
| CVE-2026-2950 | medium | — | lodash-es | 4.17.21 | v2025.2.3.0 |
| CVE-2026-2950 | medium | — | lodash | 4.17.21 | v2025.2.3.0 |
| CVE-2026-3219 | medium | — | pip | 26.0.1 | v2025.2.3.0 |
| CVE-2026-33055 | medium | — | tar | 0.4.44 | v2025.2.3.0 |
| CVE-2026-33056 | medium | — | tar | 0.4.44 | v2025.2.3.0 |
| CVE-2026-33532 | medium | — | yaml | 2.8.2 | v2025.2.3.0 |
| CVE-2026-33558 | medium | — | org.apache.kafka:kafka-clients | 2.8.1 | v2025.2.3.0 |
| CVE-2026-33672 | medium | — | picomatch | 4.0.3 | v2025.2.3.0 |
| CVE-2026-33750 | medium | — | brace-expansion | 1.1.12 | v2025.2.3.0 |
| CVE-2026-34043 | medium | — | serialize-javascript | 6.0.2 | v2025.2.3.0 |
| CVE-2026-39365 | medium | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2026-40175 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-40347 | medium | — | python-multipart | 0.0.6 | v2025.2.3.0 |
| CVE-2026-41239 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2026-41240 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| CVE-2026-41305 | medium | — | postcss | 8.5.6 | v2025.2.3.0 |
| CVE-2026-42034 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42036 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42038 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42039 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42041 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42042 | medium | — | axios | 0.21.3 | v2025.2.3.0 |
| CVE-2026-42338 | medium | — | ip-address | 8.1.0 | v2025.2.3.0 |
| CVE-2026-43868 | medium | — | thrift | 0.17.0 | v2025.2.3.0 |
| CVE-2026-44662 | medium | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-5758 | medium | — | protocol-buffers-schema | 3.6.0 | v2025.2.3.0 |
| CVE-2026-6357 | medium | — | pip | 26.0.1 | v2025.2.3.0 |
| GHSA-39q2-94rc-95cp | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| GHSA-64g7-mvw6-v9qj | medium | — | shelljs | 0.7.8 | v2025.2.3.0 |
| GHSA-67mh-4wv8-2f99 | medium | — | esbuild | 0.18.20 | v2025.2.3.0 |
| GHSA-72hv-8253-57qq | medium | — | com.fasterxml.jackson.core:jackson-core | 2.19.2 | v2025.2.3.0 |
| GHSA-7wwv-vh3v-89cq | medium | — | highlight.js | 9.18.2 | v2025.2.3.0 |
| GHSA-cj63-jhhr-wcxv | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| GHSA-cjmm-f4jc-qw8r | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| GHSA-h8r8-wccr-v5f2 | medium | — | dompurify | 2.5.8 | v2025.2.3.0 |
| GHSA-pwjx-qhcg-rvj4 | medium | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| GHSA-q2qq-hmj6-3wpp | medium | — | hickory-proto | 0.24.4 | v2025.2.3.0 |
| GHSA-r4q5-vmmm-2653 | medium | — | follow-redirects | 1.15.11 | v2025.2.3.0 |
| GHSA-xx4c-jj58-r7x6 | medium | — | validator | 11.1.0 | v2025.2.3.0 |
| CVE-2024-12801 | low | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2024-27088 | low | — | es5-ext | 0.10.62 | v2025.2.3.0 |
| CVE-2025-46392 | low | — | commons-configuration:commons-configuration | 1.10 | v2025.2.3.0 |
| CVE-2025-58160 | low | — | tracing-subscriber | 0.3.19 | v2025.2.3.0 |
| CVE-2025-58751 | low | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-58752 | low | — | vite | 4.5.5 | v2025.2.3.0 |
| CVE-2025-5889 | low | — | brace-expansion | 1.1.11 | v2025.2.3.0 |
| CVE-2026-1225 | low | — | ch.qos.logback:logback-core | 1.2.10 | v2025.2.3.0 |
| CVE-2026-2391 | low | — | qs | 6.14.1 | v2025.2.3.0 |
| CVE-2026-3449 | low | — | @tootallnate/once | 1.1.2 | v2025.2.3.0 |
| CVE-2026-41677 | low | — | openssl | 0.10.72 | v2025.2.3.0 |
| CVE-2026-41889 | low | — | github.com/jackc/pgx/v4 | v4.18.3 | v2025.2.3.0 |
| CVE-2026-42040 | low | — | axios | 0.21.3 | v2025.2.3.0 |
| GHSA-965h-392x-2mh5 | low | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| GHSA-cq8v-f236-94qc | low | — | rand | 0.9.0 | v2025.2.3.0 |
| GHSA-g59m-gf8j-gjf5 | low | — | aws-sdk-sts | 1.62.0 | v2025.2.3.0 |
| GHSA-g98v-hv3f-hcfr | low | — | atty | 0.2.14 | v2025.2.3.0 |
| GHSA-xgp8-3hg3-c2mh | low | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| CVE-2020-8911 | unknown | — | github.com/aws/aws-sdk-go | v1.55.5 | v2025.2.3.0 |
| CVE-2020-8912 | unknown | — | github.com/aws/aws-sdk-go | v1.55.5 | v2025.2.3.0 |
| CVE-2025-47911 | unknown | — | golang.org/x/net | v0.38.0 | v2025.2.3.0 |
| CVE-2025-47913 | unknown | — | golang.org/x/crypto | v0.36.0 | v2025.2.3.0 |
| CVE-2025-58190 | unknown | — | golang.org/x/net | v0.38.0 | v2025.2.3.0 |
| CVE-2026-33814 | unknown | — | golang.org/x/net | v0.38.0 | v2025.2.3.0 |
| RUSTSEC-2021-0145 | unknown | — | atty | 0.2.14 | v2025.2.3.0 |
| RUSTSEC-2024-0320 | unknown | — | yaml-rust | 0.4.5 | v2025.2.3.0 |
| RUSTSEC-2024-0375 | unknown | — | atty | 0.2.14 | v2025.2.3.0 |
| RUSTSEC-2024-0384 | unknown | — | instant | 0.1.13 | v2025.2.3.0 |
| RUSTSEC-2025-0056 | unknown | — | adler | 1.0.2 | v2025.2.3.0 |
| RUSTSEC-2025-0134 | unknown | — | rustls-pemfile | 2.2.0 | v2025.2.3.0 |
| RUSTSEC-2025-0141 | unknown | — | bincode | 1.3.3 | v2025.2.3.0 |
| RUSTSEC-2026-0049 | unknown | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| RUSTSEC-2026-0097 | unknown | — | rand | 0.9.0 | v2025.2.3.0 |
| RUSTSEC-2026-0098 | unknown | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| RUSTSEC-2026-0099 | unknown | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| RUSTSEC-2026-0104 | unknown | — | rustls-webpki | 0.103.1 | v2025.2.3.0 |
| RUSTSEC-2026-0119 | unknown | — | hickory-proto | 0.24.4 | v2025.2.3.0 |
Showing 231 of 323