{"schemaVersion":3,"id":"CVE-2026-44290","aliases":["CGA-2r3m-h544-xhr6","CGA-3rc4-78j3-4439","CGA-5cjf-g92j-4xfx","CGA-7qx6-fxf6-3f6p","CGA-gvcm-6pm8-v74c","CGA-j69v-cwq3-77jq","CGA-j9ph-8ch2-m8jx","CGA-phjp-6v22-wjg7","CGA-w9q7-8753-v6jq","CGA-wq72-c588-8cr8","GHSA-jvwf-75h9-cwgg","CGA-22jm-6979-vm7f","CGA-25rr-2332-8q26","CGA-26h5-4mrp-wxrj","CGA-27g2-hrj7-79g2","CGA-2f6c-9ww4-rmjf","CGA-2qjx-x6v4-wr2w","CGA-2r4x-mq32-43hg","CGA-3962-8f7r-pw4j","CGA-3c4j-3pqc-vh3p","CGA-3xp7-fwj7-7w9p","CGA-4236-8qj9-qv3c","CGA-44ww-3mj4-5f9c","CGA-47gh-49rm-4qgq","CGA-4q59-gqgp-h3rh","CGA-5424-9jm7-q6r9","CGA-5fq8-f9r9-q828","CGA-5fqw-c6r9-j474","CGA-5qpw-fqf9-cm5f","CGA-69mw-qw66-ppfj","CGA-6grr-wf8j-32qr","CGA-6h3p-mh75-phwm","CGA-6hc8-3pp8-c9c5","CGA-6mhg-96gh-m4qx","CGA-74fc-86wg-6pp7","CGA-78gm-9phh-f83q","CGA-7vrp-gw5f-hr42","CGA-886f-rw7r-x2pj","CGA-89hp-wjvq-c52h","CGA-8fm2-3rx4-9vvj","CGA-8j66-26x8-r9cw","CGA-8m89-89x8-q9gp","CGA-8q93-8xh6-fxv7","CGA-8r7h-5vvf-7qxv","CGA-93x6-hp66-f458","CGA-9766-w45c-555m","CGA-997q-vvv5-prx5","CGA-9c62-9jxp-fv49","CGA-9xvq-qwcr-75pv","CGA-c4p8-8h32-fwqr","CGA-f3j9-26hf-8gpg","CGA-f4qm-6cpx-ccm5","CGA-f54w-qxw6-6m6w","CGA-f5xw-mg8g-9wc4","CGA-f7f4-7qpw-6r55","CGA-ff2r-r69w-q347","CGA-ffhj-9mrh-v46v","CGA-fgg7-29r3-fgm9","CGA-fh3r-ccvm-3c98","CGA-fpqf-fp94-c6qq","CGA-fqj9-hh2x-m3qp","CGA-g29h-wxqw-m637","CGA-gc5h-85vf-8hv3","CGA-ghfj-x8w9-6mfr","CGA-gvgp-3wg3-9fw3","CGA-gvm6-mqqm-4787","CGA-gw39-4cc7-cfgw","CGA-gwhj-qv73-w4x9","CGA-h3r9-mmp8-h427","CGA-h768-2pq7-q7j7","CGA-hgxq-9wr4-qm8p","CGA-hm7h-m2j4-6qfw","CGA-hpv4-pfcm-585g","CGA-hqqf-qjx8-3h64","CGA-j62p-cqq8-rjcf","CGA-j98g-hgjc-hmpx","CGA-jf8w-4fmq-92gr","CGA-jr26-jx85-m523","CGA-m6pw-gr7r-mxgv","CGA-m8qj-5jqv-j3jv","CGA-m928-rxfq-qm2x","CGA-m9p3-54ch-c96h","CGA-mf88-fhpc-879g","CGA-mj2f-32w5-pw6g","CGA-mjw5-wg6j-hpcj","CGA-p829-hvpr-x8jg","CGA-pp3f-33gf-2p44","CGA-q6w8-7v43-33mq","CGA-qr7x-ccjv-p92v","CGA-r632-h96h-qj7c","CGA-rcpj-p4v2-79x5","CGA-rv37-fwg4-r9h9","CGA-rwq9-7w5j-h5x9","CGA-rx8r-2phv-pp9w","CGA-v292-9pww-2jqg","CGA-v824-q87q-8fq9","CGA-vc5f-gpgc-xcx4","CGA-vm49-3cjp-4ph9","CGA-w7pr-p9rx-qw7r","CGA-w9q4-m27q-59cr","CGA-wcp3-rc7w-x22c","CGA-wmq3-hj5h-g2g4","CGA-wrmg-7xxr-p8fg","CGA-wrrx-h6f3-rrqm","CGA-wvj2-qwm3-3qgf","CGA-x34x-qxr6-jphq","CGA-x7hr-44hr-5xw9","CGA-x7v8-25jc-q5r8","CGA-x7w7-h26v-cghc","CGA-x8fv-9j52-xr27","CGA-xfv2-cfx7-524v","CGA-xfvv-q7hr-jxmv","CGA-xg86-8f24-fjg9","CGA-xj25-xhw7-wr5v","CGA-xp23-pqjw-c58c","CGA-xpq6-hj28-23mv","CGA-xq2w-6p55-cg74","CGA-xr25-6f76-g66g"],"status":"published","duplicateOf":null,"title":null,"description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs allowed certain schema option paths to traverse through inherited object properties while applying options. A crafted protobuf schema or JSON descriptor could cause option handling to write to properties on global JavaScript constructors, corrupting process-wide built-in functionality. This vulnerability is fixed in 7.5.6 and 8.0.2.","dates":{"published":"2026-05-13T14:41:15.312Z","modified":"2026-05-14T13:45:12.701Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00497,"percentile":0.41393,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.12299999999999997,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00374},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00497,"percentile":0.41393}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00374,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00497,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00497,"percentile":0.41393}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","description":"The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1321.html"}],"affected":[{"vendor":"chainguard","product":"cadence-web","name":"cadence-web","label":"cadence-web","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cadence-web","purlType":"apk","versions":[{"text":"< 4.0.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.15-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gemini-cli","name":"gemini-cli","label":"gemini-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gemini-cli","purlType":"apk","versions":[{"text":"< 0.44.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 1.13.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.4-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.4-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.4-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.4-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.2-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 9.4.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r2 | < 9.4.2-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.2-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 9.4.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r0 | < 9.4.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r21","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152","name":"langfuse-fips-3.152","label":"langfuse-fips-3.152","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152-worker","name":"langfuse-fips-3.152-worker","label":"langfuse-fips-3.152-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152-worker","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.4-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.4-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"< 2.7.3-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.3-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentelemetry-auto-instrumentations-node","name":"opentelemetry-auto-instrumentations-node","label":"opentelemetry-auto-instrumentations-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentelemetry-auto-instrumentations-node","purlType":"apk","versions":[{"text":"< 0.76.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.76.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.237.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.237.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/renovate","purlType":"apk","versions":[{"text":"< 43.170.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.170.15-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.4-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r21","eol":null,"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.237.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.237.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/renovate","purlType":"apk","versions":[{"text":"< 43.170.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.170.15-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.4-r5","eol":null,"hubHref":null},{"vendor":"Npm","product":"protobufjs","name":"protobufjs","label":"protobufjs","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/protobufjs","purlType":"npm","versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":null},{"vendor":"protobufjs_project","product":"protobufjs","name":"protobufjs","label":"protobufjs","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":"/vendor/protobufjs_project/protobufjs"},{"vendor":"protobufjs","product":"protobuf.js","name":"protobuf.js","label":"protobuf.js","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":"/vendor/protobufjs/protobufjs"}],"affectedCount":32,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg","label":"github.com/protobufjs/protobuf.js/security/advisories/GHSA-jvwf-75h9-cwgg","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Mitigation","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44290.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44290.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44290","label":"nvd.nist.gov/vuln/detail/CVE-2026-44290","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","label":"github.com/protobufjs/protobuf.js","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","label":"github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","label":"github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-6C4G-3PRF-2C75"]},"timeline":[{"kind":"published","date":"2026-05-13T14:41:15.312Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-14T13:45:12.701Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":30,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:14:32.979Z","stale":false,"partial":false}}