Daily digest
Saturday 27 June 2026
A quiet day: only 3 new CVEs against a recent average of about 104. Severity skewed high: 3 high, 100% of the total. pnpm was the most-affected vendor with 3.
3
New CVEs
0
Critical
0
KEV additions
0
Records changed
New this day, ranked by depth score
The 3 that matter most of the 3 published.
GHSA-qrv3-253h-g69cHigh· 8.2pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
▾ Twilightpnpm · pnpmvia GHSA
GHSA-fr4h-3cph-29xvHigh· 7.1pnpm: Hoisted install imports lockfile alias outside node_modules
pnpm: Hoisted install imports lockfile alias outside node_modules
▾ Twilightpnpm · pnpmvia GHSA
GHSA-72r4-9c5j-mj57High· 7.1pnpm: `patch-remove` could delete project-selected files outside the patches directory
pnpm: `patch-remove` could delete project-selected files outside the patches directory
▾ Twilightpnpm · pnpmvia GHSA
Most-affected vendors
By CVEs published in the period.