github.com/Egonex-AI/Understand-Anything
Submitted 8/4/2026, 10:25:56 AM · Status: ok
Risk grade
F
100 / 100
Findings
137
1 critical35 high96 medium5 low0 info0 on CISA KEV0ATT&CK
Showing 137 of 137 findings
Findings
- When Vitest UI server is listening, arbitrary file can be read and executedgrypeCVE-2026-47429EPSS 1.0%
- Astro: Host header SSRF in prerendered error page fetchgrypeCVE-2026-54299EPSS 0.3%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsgrypeCVE-2026-13149EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashgrypeCVE-2026-14257EPSS 0.3%
- fast-uri vulnerable to host confusion via literal backslash authority delimitergrypeCVE-2026-16221EPSS 0.2%
- js-yaml: YAML merge-key chains can force quadratic CPU consumptiongrypeCVE-2026-59869EPSS 0.4%
- Picomatch has a ReDoS vulnerability via extglob quantifiersgrypeCVE-2026-33671EPSS 0.4%
- Picomatch has a ReDoS vulnerability via extglob quantifiersgrypeCVE-2026-33671EPSS 0.4%
- PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsgrypeCVE-2026-45623EPSS 0.5%
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosuregrype
- sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591grype
- Svelte devalue: DoS via sparse array deserializationgrypeCVE-2026-42570EPSS 0.4%
- SVGO removeScripts plugin leaves some executable scripts intactgrype
- Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocketgrypeCVE-2026-39363EPSS 3.3%
- Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocketgrypeCVE-2026-39363EPSS 3.3%
- vite: `server.fs.deny` bypass on Windows alternate pathsgrypeCVE-2026-53571EPSS 0.6%
- vite: `server.fs.deny` bypass on Windows alternate pathsgrypeCVE-2026-53571EPSS 0.6%
- vite: `server.fs.deny` bypass on Windows alternate pathsgrypeCVE-2026-53571EPSS 0.6%
- vite: `server.fs.deny` bypass on Windows alternate pathsgrypeCVE-2026-53571EPSS 0.6%
- Vite: `server.fs.deny` bypassed with queriesgrypeCVE-2026-39364EPSS 2.1%
- Astro: Host header SSRF in prerendered error page fetchAstro is a web framework. Prior to 6.4.6, Astro SSR apps with prerendered error pages (/404 or /500 using export const prerender = true) fetch those pages over HTTP at runtime when an error occurs. The URL for this fetch is derived from request.url, which in turn gets its origin …trivyCVE-2026-54299
- devalue: devalue: Excessive memory consumption via deserialization of sparse arraysSvelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than w…trivyCVE-2026-42570
- js-yaml: js-yaml: Denial of Service via crafted YAML documentsjs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This i…trivyCVE-2026-59869
- picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patternsPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when c…trivyCVE-2026-33671
- picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patternsPicomatch is a glob matcher written JavaScript. Versions prior to 4.0.4, 3.0.2, and 2.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing crafted extglob patterns. Certain patterns using extglob quantifiers such as `+()` and `*()`, especially when c…trivyCVE-2026-33671
- PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure## Vulnerability Details **File**: `lib/previous-map.js` **Line**: 87-98 (`loadFile`), 129-144 (`loadMap`) ### Root Cause PostCSS auto-detects a `/*# sourceMappingURL=... */` comment inside the CSS text it is asked to parse and, unless the caller explicitly passes `map: false`…trivy
- postcss: PostCSS: Information disclosure and denial of service via crafted CSS inputPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferen…trivyCVE-2026-45623
- sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency. Those processing untrusted input with versions of sharp prior to 0.35.0 are affected. ### Patches #### Using prebuilt binaries…trivy
- SVGO removeScripts plugin leaves some executable scripts intact### Summary SVGO's removeScripts plugin (disabled by default) removes scripts from the SVG, however executable scripts were left intact in some cases. If a consumer relied on this plugin for sanitization and served them to users, these SVGs could open up doors to XSS. ### Detai…trivy
- vite: `server.fs.deny` bypass on Windows alternate pathsVite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be returned to the browser on Windows. Vite’s dev server denies direct access to sensitive files through server.fs.deny, includin…trivyCVE-2026-53571
This report is public.