CWE-1395 Dependency on Vulnerable Third-Party Component
Description
The product has a dependency on a third-party component that contains one or more known vulnerabilities.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-1395 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-788w-68h3-cvxp | CVE-2026-105642 | HIGH |
Ghost: Remote Code Execution via Bookmark Card Images |
2026-10-07 | |
| GHSA-wq5f-xc86-pv6w | - | HIGH |
sharp : Vulnerability in librsvg dependency CVE-2026-96889 |
2026-10-06 | |
| GHSA-vcvr-r3jv-pc5j | - | CRITICAL |
Next.js: Remote Code Execution in next/og ImageResponse |
2026-09-30 | |
| GHSA-2xp9-vwfh-vxw4 | - | CRITICAL |
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
2026-09-08 | |
| GHSA-2gh6-wc3m-g37f | - | CRITICAL |
hermes-management is vulnerable to RCE due to Apache commons-jxpath |
2026-08-31 | |
| GHSA-wchh-9x6h-7f6p | - | MODERATE |
olm dependency deprecation: CVE-2022-39255 and CVE-2024-45193 |
2026-07-29 | |
| GHSA-f88m-g3jw-g9cj | - | HIGH |
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
2026-07-21 | |
| GHSA-6vxv-wg6j-5qwp | - | HIGH |
Gogs: XSS in .ipynb files renderer due to outdated notebookjs |
2026-06-19 | |
| GHSA-q7j3-v8qv-22vq | - | HIGH |
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL |
2026-06-19 | |
| GHSA-537c-gmf6-5ccf | - | HIGH |
Vulnerable OpenSSL included in cryptography wheels |
2026-06-15 | |
| GHSA-g9pc-8g42-g6vq | CVE-2025-22871 | CRITICAL | - |
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency |
2026-05-13 |
| GHSA-39h7-pwv7-rc3x | - | MODERATE |
Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) |
2026-04-24 | |
| GHSA-hw5x-4r37-72w7 | - | LOW |
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses |
2026-04-14 | |
| GHSA-658g-p7jg-wx5g | CVE-2026-34841 | CRITICAL |
Axios npm Supply Chain Incident Impacting @usebruno/cli |
2026-04-06 | |
| GHSA-3hfp-gqgh-xc5g | - | CRITICAL |
Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios versions |
2026-04-02 | |
| GHSA-w2fm-25vw-vh7f | - | HIGH |
mcp-handler has a tool response leak across concurrent client sessions ('Race Condition') |
2026-04-01 | |
| GHSA-32wq-ppwg-3w4m | - | HIGH |
EnhancedLinq.Async is Vulnerable to Denial of Service via Transitive Dependency Microsoft.Bcl.Memory |
2026-04-01 | |
| GHSA-46wh-3698-f2cx | - | HIGH |
Traefik: Deny Rule Bypass via Unauthenticated Malicious gRPC Requests in gRPC-Go Dependency (CVE-2026-33186) |
2026-03-29 | |
| GHSA-vj2p-7pgw-g2wf | - | HIGH |
Postiz App has a High-Severity SSRF Vulnerability via Next.js |
2026-03-27 | |
| GHSA-wcjx-v2wj-xg87 | - | HIGH |
C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922) |
2026-03-26 | |
| GHSA-h8w2-rv57-vc6f | - | CRITICAL |
splunk-otel-javaagent: Unsafe deserialization in RMI instrumentation may lead to Remote Code Execution |
2026-03-26 | |
| GHSA-g3qj-j598-cxmq | - | HIGH |
fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsing |
2026-03-24 | |
| GHSA-2mhw-8qcg-gr96 | - | HIGH |
skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version |
2026-03-19 | |
| GHSA-q382-vc8q-7jhj | - | HIGH |
Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk |
2026-03-19 | |
| GHSA-594f-3595-c47v | - | MODERATE |
Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121 |
2026-03-18 |