{"schemaVersion":3,"id":"CVE-2026-44292","aliases":["CGA-3v24-2v8c-jhcw","CGA-5m2j-jfg9-cw57","CGA-632v-9fcv-jhhh","CGA-cmj8-rw3f-4pvc","CGA-g9gp-93r9-jpvv","CGA-m634-2fwf-6c3j","CGA-q42q-v3h4-pvf9","CGA-qrcx-86m2-8wf8","CGA-wh87-h2w4-jwr3","CGA-xv9w-9362-h7v4","GHSA-fx83-v9x8-x52w","CGA-265f-xp6m-fm8p","CGA-29wf-fwc9-2vfj","CGA-2gr7-48rj-wrx3","CGA-2h56-cg2w-4j7v","CGA-2jxg-vhc9-x4f7","CGA-2m25-q5pj-vrv4","CGA-2qq7-qf68-83hx","CGA-2rp8-4hf5-g432","CGA-2v7f-7hmh-rx4m","CGA-2x2h-6hq2-hjxf","CGA-33hg-xfqg-4xfh","CGA-3c2m-vc6p-p37x","CGA-3vqv-69hp-738p","CGA-4287-4vmx-r6mq","CGA-44xj-9v78-x4x5","CGA-45pw-pfcm-vwr2","CGA-478j-gvmm-p4f8","CGA-4cm8-grh3-mp77","CGA-4h3m-qpm7-69pg","CGA-4w25-p2pw-xx8r","CGA-52rr-w665-vjhf","CGA-56wf-vqc3-j4jq","CGA-57fc-qqjj-2gf3","CGA-5hq8-w4rm-9pr2","CGA-64mp-q4wj-v3hr","CGA-67xq-h4p2-x9wj","CGA-6f53-c45f-6q9q","CGA-6gh5-m375-675r","CGA-6mm3-m2vw-9jj3","CGA-6rq9-fg37-7c9g","CGA-6w2r-9vfr-7qhp","CGA-7gjc-h8rw-8rh4","CGA-7pq6-pm59-vh6w","CGA-7rpf-c8rw-64mm","CGA-7rvf-9crf-xmcf","CGA-7xmm-3vxv-q2pq","CGA-83q5-mv66-4mfh","CGA-8447-fqj9-485p","CGA-8f44-4hrj-xgr7","CGA-8mv4-69jq-gxhp","CGA-8pwf-jpp9-p2r3","CGA-9234-jmhm-9mwx","CGA-936v-2cjr-x54v","CGA-96v4-r8qf-x5r3","CGA-97ff-7pfq-7mp5","CGA-99pw-r6vw-5m9v","CGA-9f27-qjqc-4gcq","CGA-ch27-28wf-9mrw","CGA-cpf3-xv9g-6cfx","CGA-cpp7-jvj6-ph58","CGA-crm8-gphg-p3qg","CGA-f2wv-gx8r-4cw5","CGA-fwpv-m22m-6jrc","CGA-g78h-hf7g-wh2w","CGA-g9mj-9xcc-3fjh","CGA-g9vm-7jr3-5qgp","CGA-g9xr-c275-4g7c","CGA-gfvq-qcp9-pcv8","CGA-hr53-8rmc-686f","CGA-hrgp-93fc-8w36","CGA-j2cm-mf4h-jr6j","CGA-j3r2-5p6m-725j","CGA-jq4g-mpx8-x69f","CGA-m64f-356h-gh66","CGA-m7f8-fcq7-qq7v","CGA-mgjh-mjj4-2595","CGA-mqm2-hrj8-j395","CGA-mrx6-qmc4-5vjv","CGA-mxpm-rqc4-w3mp","CGA-mxvh-fp29-h9w8","CGA-p4rf-xch2-7vpq","CGA-pcm5-8q33-f88m","CGA-ph4q-h39r-8xm4","CGA-pp58-m872-9qxg","CGA-pq4j-r85c-qvjh","CGA-pqwj-6v2m-wqgw","CGA-q3jh-4g55-x26r","CGA-q4f2-8c4g-f3xw","CGA-q687-h74v-q5pp","CGA-qg22-6j4f-qg4w","CGA-r4hx-458c-3778","CGA-rc5r-46x5-3c42","CGA-rgx5-m2r7-mphf","CGA-rmh6-466m-8c8h","CGA-v5wf-m4xq-9p38","CGA-v928-r54p-m4cg","CGA-vc3c-xw6r-4hxx","CGA-vprg-5fx5-rgpq","CGA-w267-wvpg-4gg3","CGA-w7jf-95v4-8xxg","CGA-wcgj-5gxg-58xq","CGA-wp53-g89p-8m9w","CGA-wpgx-8crc-pmq9","CGA-wpp5-55c8-x583","CGA-wq55-qmc8-fmj9","CGA-wqx6-65m4-29w4","CGA-wv25-fx27-p8mp","CGA-wv3p-p8g4-6vmf","CGA-x4xj-qchx-rw5q","CGA-xfv2-ch9h-jhr3","CGA-xhf8-858w-565j","CGA-xhg3-hm9v-qx82","CGA-xjcx-wjrg-h7vg","CGA-xpmc-q634-xrjj","CGA-xq93-95xv-p9jf","CGA-xqh9-368x-32g4","CGA-xwcx-rgvq-x739"],"status":"published","duplicateOf":null,"title":null,"description":"protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.5.6 and 8.0.2, protobufjs generated message constructors copied enumerable properties from a provided properties object without filtering the __proto__ key. If an application constructed a message from an attacker-controlled plain object, an own enumerable __proto__ property could alter the prototype of that individual message instance. This vulnerability is fixed in 7.5.6 and 8.0.2.","dates":{"published":"2026-05-13T14:42:55.155Z","modified":"2026-05-18T14:01:31.297Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00335,"percentile":0.25471,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.07100000000000001,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00264},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00335,"percentile":0.25471}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00264,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00335,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00335,"percentile":0.25471}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","description":"The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1321.html"}],"affected":[{"vendor":"chainguard","product":"cadence-web","name":"cadence-web","label":"cadence-web","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/cadence-web","purlType":"apk","versions":[{"text":"< 4.0.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.0.15-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gemini-cli","name":"gemini-cli","label":"gemini-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gemini-cli","purlType":"apk","versions":[{"text":"< 0.44.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.44.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"homepage","name":"homepage","label":"homepage","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/homepage","purlType":"apk","versions":[{"text":"< 1.13.1-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.13.1-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.15-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.15-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r29","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r29","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r18","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r18","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.4-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.4-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.4-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.4-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.2-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 9.4.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r2 | < 9.4.2-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.2-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 9.4.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r0 | < 9.4.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r21","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152","name":"langfuse-fips-3.152","label":"langfuse-fips-3.152","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3.152-worker","name":"langfuse-fips-3.152-worker","label":"langfuse-fips-3.152-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3.152-worker","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.4-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.4-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nemo","name":"nemo","label":"nemo","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nemo","purlType":"apk","versions":[{"text":"< 2.7.3-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.7.3-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opentelemetry-auto-instrumentations-node","name":"opentelemetry-auto-instrumentations-node","label":"opentelemetry-auto-instrumentations-node","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opentelemetry-auto-instrumentations-node","purlType":"apk","versions":[{"text":"< 0.76.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.76.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.237.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.237.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/renovate","purlType":"apk","versions":[{"text":"< 43.170.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.170.15-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-22","name":"vitess-22","label":"vitess-22","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-22","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.4-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-centraldashboard","name":"kubeflow-centraldashboard","label":"kubeflow-centraldashboard","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-centraldashboard","purlType":"apk","versions":[{"text":"< 1.10.0-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.10.0-r21","eol":null,"hubHref":null},{"vendor":"wolfi","product":"pulumi-language-nodejs","name":"pulumi-language-nodejs","label":"pulumi-language-nodejs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/pulumi-language-nodejs","purlType":"apk","versions":[{"text":"< 3.237.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.237.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/renovate","purlType":"apk","versions":[{"text":"< 43.170.15-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.170.15-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-23","name":"vitess-23","label":"vitess-23","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-23","purlType":"apk","versions":[{"text":"< 23.0.4-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 23.0.4-r5","eol":null,"hubHref":null},{"vendor":"Npm","product":"protobufjs","name":"protobufjs","label":"protobufjs","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/protobufjs","purlType":"npm","versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":null},{"vendor":"protobufjs_project","product":"protobufjs","name":"protobufjs","label":"protobufjs","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":"/vendor/protobufjs_project/protobufjs"},{"vendor":"protobufjs","product":"protobuf.js","name":"protobuf.js","label":"protobuf.js","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.5.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.5.6 | ≥ 8.0.0, < 8.0.2","eol":null,"hubHref":"/vendor/protobufjs/protobufjs"}],"affectedCount":32,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w","label":"github.com/protobufjs/protobuf.js/security/advisories/GHSA-fx83-v9x8-x52w","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Mitigation","Vendor Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44292.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44292.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44292","label":"nvd.nist.gov/vuln/detail/CVE-2026-44292","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/protobufjs/protobuf.js","label":"github.com/protobufjs/protobuf.js","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","label":"github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.5.6","hostname":"github.com","tags":["WEB"]},{"url":"https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","label":"github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.0.2","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-PX6F-WMH3-99XQ"]},"timeline":[{"kind":"published","date":"2026-05-13T14:42:55.155Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-18T14:01:31.297Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T16:25:04.247Z","stale":false,"partial":false}}