Vulnerabilities/CGA-CX74-VPRM-JW6X

CGA-CX74-VPRM-JW6X: wazuh-dashboard-plugins-fips Chainguard

SSVC · Estimated by CveMateTrackHandle in routine patching. CISA has no entry yet, so CveMate computed this from CVSS and exploit data. It is replaced when CISA publishes.

ExploitationNone (derived)

AutomatableNo (derived)

Technical impactPartial (derived)

Mission & well-beingHigh (assumed)

Source: CveMate estimate, same decision tree as CISA.CISA publishes the first three inputs. Mission & well-being depends on your environment, so it is assumed at its highest: the decision is a worst case.

Unknown

Published Date unknownLast modified Date unknown

Status not reported

The data service did not report a status for this record. Only the available sections are shown.

On this page

Summary Advisory lineage Timeline Description CVSS metrics EPSS trend Known exploited Public exploits Weaknesses Affected systems References

Key information

PublishedDate unknown

ModifiedDate unknown

SourceOSV · Chainguard

CVSS2.3

EPSSNot scored

KEV0

Exploits0

Vulnerability summary

CGA-CX74-VPRM-JW6X is a low (CVSS 2.3) vulnerability in wazuh-dashboard-plugins-fips Chainguard.

Overall risk

9/100

0100

Minimal · default modelHow is this calculated?

SSVC · Estimated by CveMateTrackHandle in routine patching. CISA has no entry yet, so CveMate computed this from CVSS and exploit data. It is replaced when CISA publishes.

ExploitationNone (derived)

AutomatableNo (derived)

Technical impactPartial (derived)

Mission & well-beingHigh (assumed)

CVSS score

2.3/10

010

Low · v4.0 (OSV · Chainguard), selected by version preference

EPSS scoreNot scoredRisk metrics not yet published.

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 1 · Downstream 0

GHSA-P98J-92PF-MC4P

Timeline

No timeline events recorded.

Description

No description has been published for this record.

CVSS metrics

1 score · 1 source · 1 version

v4.02.3

Low 2.3Preferred score · OSV · Chainguard (Ecosystem advisory) · calculated from vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SourcesSingle source

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Chainguard1 product

wazuh-dashboard-plugins-fips< 4.14.8-r6

1 vendor · 1 product

References

5 links

github.com/cure53/DOMPurify/security/advisories/GHSA-p98j-92pf-mc4pWEB
github.com/cure53/DOMPurify/pull/1636WEB
github.com/cure53/DOMPurify/commit/b9b9d80f7e401771c2ccaef5f45def7eec8f27d7WEB
github.com/cure53/DOMPurifyPACKAGE
github.com/cure53/DOMPurify/releases/tag/3.4.16WEB

Related vulnerabilities

LowCVE-2025-5889chainguard · airflow-2 +228 more1y agojuliangruber brace-expansion index.js expand redosA vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.12, 2.0.2, 3.0.1 and 4.0.1 is able to address this issue. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to upgrade the affected component.EPSS0.59%LowCVE-2025-69873ajv.js · ajv +142 more8mo agoajv.js ajvajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.EPSS0.55%HighCVE-2026-13149chainguard · airflow-2 +163 more3mo agochainguard airflow-2brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.EPSS0.36%MediumCVE-2026-84363chainguard · commercial-gitlab-rails-ee-19.1 +39 more1mo agoHono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentialsHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.EPSS0.45%MediumCVE-2026-84364chainguard · commercial-gitlab-rails-ee-19.1 +39 more1mo agoHono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustionHono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5.EPSS0.53%MediumCVE-2026-84365chainguard · commercial-gitlab-rails-ee-19.1 +39 more1mo agoHono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directoryHono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5.EPSS0.44%