Skip to content
patchdrift.
snapshot 2026-09-07

Package added to advisory

What a record said when it was published, what it says now, and the commit that changed it.

1,695 advisory changes · newest first · grouped by day

SinceClear all
ChangedSourceRows
Counted changes of "Package added to advisory", newest first, one line per change to a GHSA advisory, or per run of identical changes collapsed into one line.
Changed on, The day the change first became visible in the catalog's public history. Not the day the record was amended, which is earlier by an unknown margin.Advisory, Which advisory was edited, by its GHSA id.Package, The package the advisory names, and the registry it comes from.What changedDays to revision, The earlier stated value's interval. For a version boundary, it ends at the first replacement of that value; the reported current value may appear later. Starting points differ by kind: record publication, advisory publication, or the observed introduction of a KEV field value. Intervals are not directly comparable across kinds. Missing dates mean unknown, never zero. This does not date when a value became wrong.
Tue 1 Sep 2026· 2 changes
2026-09-01published 2026-06-16GHSA-5r4w-85f3-pw66CVE-2026-48491
go
high		not named as affected when the advisory was published, now names github.com/traefik/traefik/v2Time to revision 77 days
2026-09-01published 2026-06-16GHSA-5r4w-85f3-pw66CVE-2026-48491
go
high		not named as affected when the advisory was published, now names github.com/traefik/traefik/v3Time to revision 77 days
Mon 31 Aug 2026· 1 change
2026-08-31published 2026-05-12GHSA-r29c-68gh-xp6xCVE-2026-41293
maven
critical		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteTime to revision 111 days
Fri 14 Aug 2026· 2 changes
2026-08-14published 2026-02-19GHSA-p6jf-79j3-33f3CVE-2025-13590
maven
critical		not named as affected when the advisory was published, now names org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1Time to revision 176 days
2026-08-14published 2026-04-29GHSA-w22p-4x9f-486vCVE-2026-42523
maven
critical		not named as affected when the advisory was published, now names com.coravy.hudson.plugins.github:githubTime to revision 107 days
Tue 4 Aug 2026· 2 changes
2026-08-04published 2026-06-03GHSA-2j2x-hqr9-3h42CVE-2026-40181
npm
moderate		not named as affected when the advisory was published, now names @remix-run/routerTime to revision 62 days
2026-08-04published 2026-07-21GHSA-w5pg-649r-p6ggCVE-2026-58439
go
high		not named as affected when the advisory was published, now names code.gitea.io/giteaTime to revision 13 days
Fri 31 Jul 2026· 1 change
2026-07-31published 2026-07-21GHSA-m4p7-r5rc-7g4jCVE-2026-59884
pypi
high		not named as affected when the advisory was published, now names pyasn1Time to revision 10 days
Thu 30 Jul 2026· 2 changes
2026-07-30published 2025-05-13GHSA-qqcr-9jfc-35c4CVE-2024-56526
packagist
high		not named as affected when the advisory was published, now names oxid-esales/oxideshop-metapackage-ceTime to revision 443 days
2026-07-30published 2025-05-13GHSA-qqcr-9jfc-35c4CVE-2024-56526
packagist
high		not named as affected when the advisory was published, now names oxid-esales/smarty-componentTime to revision 443 days
Fri 24 Jul 2026· 1 change
2026-07-24published 2026-05-06GHSA-rwm7-x88c-3g2pCVE-2026-42577
maven
high		not named as affected when the advisory was published, now names io.netty:netty-transport-classes-epollTime to revision 79 days
Tue 21 Jul 2026· 3 changes
2026-07-21published 2026-05-07GHSA-g924-cjx7-2rjwCVE-2026-42597
go
moderate		not named as affected when the advisory was published, now names github.com/gotenberg/gotenberg/v7Time to revision 76 days
2026-07-21published 2026-04-14GHSA-2hx3-vp6r-mg3fCVE-2026-41134
nuget
high		not named as affected when the advisory was published, now names microsoft.openapi.kiotaTime to revision 98 days
2026-07-21published 2026-04-14GHSA-2hx3-vp6r-mg3fCVE-2026-41134
nuget
high		not named as affected when the advisory was published, now names microsoft.openapi.kiota.builderTime to revision 98 days
Thu 16 Jul 2026· 1 change
2026-07-16published 2024-05-30GHSA-22q7-cg4r-p9mx
packagist
moderate		not named as affected when the advisory was published, now names typo3/cms-fluidTime to revision 777 days
Wed 15 Jul 2026· 1 change
2026-07-15published 2025-12-01GHSA-rcmh-qjqh-p98vCVE-2025-14874
maven
high		not named as affected when the advisory was published, now names org.webjars.npm:nodemailerTime to revision 226 days
Tue 7 Jul 2026· 1 change
2026-07-07published 2026-05-08GHSA-mx76-r943-rf8gCVE-2026-8149
maven
moderate		not named as affected when the advisory was published, now names org.bouncycastle:bcprov-lts8onTime to revision 61 days
Mon 6 Jul 2026· 15 changes
2026-07-06published 2026-06-18GHSA-jc38-x7x8-2xc8
packagist
high		not named as affected when the advisory was published, now names web-token/jwt-bundleTime to revision 18 days
2026-07-06published 2026-06-18GHSA-jc38-x7x8-2xc8
packagist
high		not named as affected when the advisory was published, now names web-token/jwt-experimentalTime to revision 18 days
2026-07-06published 2026-06-26GHSA-6q7j-xr26-3h2c
nuget
moderate		not named as affected when the advisory was published, now names scriban.signedTime to revision 10 days
2026-07-06published 2026-03-24GHSA-xw6w-9jjh-p9cr
nuget
moderate		not named as affected when the advisory was published, now names scriban.signedTime to revision 104 days
2026-07-06published 2026-03-24GHSA-m2p3-hwv5-xpqw
nuget
moderate		not named as affected when the advisory was published, now names scriban.signedTime to revision 104 days
2026-07-06published 2026-03-24GHSA-xcx6-vp38-8hr5
nuget
high		not named as affected when the advisory was published, now names scriban.signedTime to revision 104 days
2026-07-06published 2026-03-24GHSA-v66j-x4hw-fv9g
nuget
high		not named as affected when the advisory was published, now names scriban.signedTime to revision 104 days
2026-07-06published 2026-03-24GHSA-5wr9-m6jw-xx44
nuget
critical		not named as affected when the advisory was published, now names scriban.signedTime to revision 104 days
2026-07-06published 2026-03-24GHSA-x6m9-38vm-2xhf
nuget
high		not named as affected when the advisory was published, now names scriban.signedTime to revision 104 days
2026-07-06published 2026-03-24GHSA-p6q4-fgr8-vx4p
nuget
high		not named as affected when the advisory was published, now names scriban.signedTime to revision 104 days
2026-07-06published 2026-03-19GHSA-5rpf-x9jg-8j5p
nuget
moderate		not named as affected when the advisory was published, now names scriban.signedTime to revision 109 days
2026-07-06published 2026-03-19GHSA-grr9-747v-xvcp
nuget
high		not named as affected when the advisory was published, now names scriban.signedTime to revision 109 days
2026-07-06published 2026-03-19GHSA-wgh7-7m3c-fx25
nuget
high		not named as affected when the advisory was published, now names scriban.signedTime to revision 109 days
2026-07-06published 2026-06-26GHSA-q6rr-fm2g-g5x8
nuget
moderate		not named as affected when the advisory was published, now names scriban.signedTime to revision 10 days
2026-07-06published 2026-03-24GHSA-c875-h985-hvrc
nuget
high		not named as affected when the advisory was published, now names scriban.signedTime to revision 104 days
Wed 1 Jul 2026· 5 changes
2026-07-01published 2024-11-07GHSA-7jqf-v358-p8g7CVE-2024-38286
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat.embed:tomcat-embed-coreTime to revision 601 days
2026-07-01published 2024-11-07GHSA-7jqf-v358-p8g7CVE-2024-38286
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteTime to revision 601 days
2026-07-01published 2025-08-13GHSA-23hv-mwm6-g8jfCVE-2025-55668
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat.embed:tomcat-embed-coreTime to revision 322 days
2026-07-01published 2025-07-10GHSA-4j3c-42xv-3f84CVE-2025-52434
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat.embed:tomcat-embed-coreTime to revision 356 days
2026-07-01published 2025-07-10GHSA-4j3c-42xv-3f84CVE-2025-52434
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteTime to revision 356 days
Mon 29 Jun 2026· 3 changes
2026-06-29published 2026-02-17GHSA-qq5r-98hh-rxc9CVE-2026-24733
maven
low		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteTime to revision 132 days
2026-06-29published 2026-05-19GHSA-24c8-4792-22hx
nuget
high		not named as affected when the advisory was published, now names scriban.signedTime to revision 41 days
2026-06-29published 2019-10-11GHSA-p979-4mfw-53vgCVE-2019-16869
maven
high		not named as affected when the advisory was published, now names io.netty:nettyDuration unknown
Fri 26 Jun 2026· 2 changes
2026-06-26published 2026-05-29GHSA-6x26-5727-rrm9CVE-2026-47268
go
moderate		not named as affected when the advisory was published, now names github.com/naiba/nezhaTime to revision 28 days
2026-06-26published 2026-06-10GHSA-8h84-fhqq-q58vCVE-2026-48025
go
moderate		not named as affected when the advisory was published, now names github.com/forgekeep/nebula-meshTime to revision 16 days
Thu 18 Jun 2026· 7 changes
2026-06-18published 2024-01-19GHSA-f4qf-m5gf-8jm8CVE-2024-21733
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat.experimental:tomcat-embed-programmaticTime to revision 881 days
2026-06-18published 2026-04-09GHSA-x4m4-345f-5h5gCVE-2026-34487
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-tribesTime to revision 70 days
2026-06-18published 2024-11-18GHSA-f632-9449-3j4wCVE-2024-52318
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat.embed:tomcat-embed-jasperTime to revision 577 days
2026-06-18published 2024-11-18GHSA-f632-9449-3j4wCVE-2024-52318
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcatTime to revision 577 days
2026-06-18published 2023-02-20GHSA-hfrx-6qgj-fp6cCVE-2023-24998
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-catalinaTime to revision 1,214 days
2026-06-18published 2019-05-30GHSA-jjpq-gp5q-8q6wCVE-2019-0221
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcatDuration unknown
2026-06-18published 2019-05-30GHSA-jjpq-gp5q-8q6wCVE-2019-0221
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-catalinaDuration unknown
Fri 12 Jun 2026· 4 changes
2026-06-12published 2023-10-10GHSA-r6j3-px5g-cq3xCVE-2023-45648
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteTime to revision 976 days
2026-06-12published 2023-10-10GHSA-g8pj-r55q-5c2vCVE-2023-42795
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-catalinaTime to revision 976 days
2026-06-12published 2023-10-10GHSA-g8pj-r55q-5c2vCVE-2023-42795
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-utilTime to revision 976 days
2026-06-12published 2026-02-17GHSA-fpj8-gq4v-p354CVE-2025-66614
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteTime to revision 115 days
Thu 11 Jun 2026· 4 changes
2026-06-11published 2026-05-07GHSA-2mh5-3cw6-hrrqCVE-2026-40981
maven
high		not named as affected when the advisory was published, now names org.springframework.cloud:spring-cloud-config-serverTime to revision 35 days
2026-06-11published 2022-02-08GHSA-m7jv-hq7h-mq7cCVE-2020-13935
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat.embed:tomcat-embed-websocketDuration unknown
2026-06-11published 2022-02-08GHSA-m7jv-hq7h-mq7cCVE-2020-13935
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-websocketDuration unknown
2026-06-11published 2022-02-09GHSA-53hp-jpwq-2jgqCVE-2020-11996
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat.embed:tomcat-embed-coreDuration unknown
Tue 9 Jun 2026· 1 change
2026-06-09published 2026-06-01GHSA-q53q-5r4j-5729CVE-2026-47425
pypi
moderate		not named as affected when the advisory was published, now names py-rattlerTime to revision 8 days
Mon 8 Jun 2026· 4 changes
2026-06-08published 2026-05-15GHSA-w42g-jj8w-fj77
packagist
high		not named as affected when the advisory was published, now names thorsten/phpmyfaqTime to revision 24 days
2026-06-08published 2021-04-13GHSA-3pcr-4982-548m
packagist
moderate		not named as affected when the advisory was published, now names shopware/shopwareDuration unknown
2026-06-08published 2025-10-15GHSA-6p6v-m64v-jx8qCVE-2025-55039
pypi
low		not named as affected when the advisory was published, now names pysparkTime to revision 236 days
2026-06-08published 2026-03-25GHSA-7h8w-hj9j-8rjwCVE-2026-33718
pypi
high		not named as affected when the advisory was published, now names openhands-aiTime to revision 75 days
Fri 5 Jun 2026· 4 changes
2026-06-05published 2023-08-25GHSA-q3mw-pvr8-9ggcCVE-2023-41080
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-catalinaTime to revision 1,015 days
2026-06-05published 2021-06-16GHSA-j39c-c8hj-x4j3CVE-2021-25122
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteDuration unknown
2026-06-05published 2026-04-18GHSA-w9r4-94fj-xp69CVE-2026-32690
pypi
low		not named as affected when the advisory was published, now names apache-airflowTime to revision 48 days
2026-06-05published 2025-09-24GHSA-776q-jw43-fhjxCVE-2025-48459
pypi
critical		not named as affected when the advisory was published, now names apache-iotdbTime to revision 254 days
Mon 1 Jun 2026· 2 changes
2026-06-01published 2026-05-18GHSA-v549-xx3c-6pc8CVE-2026-3637
go
moderate		not named as affected when the advisory was published, now names github.com/mattermost/mattermost-serverTime to revision 14 days
2026-06-01published 2026-05-18GHSA-v549-xx3c-6pc8CVE-2026-3637
go
moderate		not named as affected when the advisory was published, now names github.com/mattermost/mattermost/server/v8Time to revision 14 days
Fri 29 May 2026· 1 change
2026-05-29published 2026-04-22GHSA-ffq5-qpvf-xq7xCVE-2026-42086
pypi
moderate		not named as affected when the advisory was published, now names openc3Time to revision 37 days
Wed 20 May 2026· 8 changes
2026-05-20published 2023-06-14GHSA-5wfc-hjrc-gq87CVE-2023-34620
go
high		not named as affected when the advisory was published, now names github.com/hjson/hjson-go/v4Time to revision 1,071 days
2026-05-20published 2023-06-14GHSA-5wfc-hjrc-gq87CVE-2023-34620
packagist
high		not named as affected when the advisory was published, now names laktak/hjsonTime to revision 1,071 days
2026-05-20published 2026-04-09GHSA-69cc-cv78-qc8gCVE-2026-29129
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteTime to revision 41 days
2026-05-20published 2026-04-09GHSA-95jq-rwvf-vjx4CVE-2026-29145
maven
critical		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyote-ffmTime to revision 41 days
2026-05-20published 2024-12-17GHSA-653p-vg55-5652CVE-2024-54677
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcatTime to revision 519 days
2026-05-20published 2020-06-15GHSA-qcxh-w3j9-58qrCVE-2019-0199
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteDuration unknown
2026-05-20published 2026-04-09GHSA-24j9-x2wg-9qv6CVE-2026-34500
maven
moderate		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyote-ffmTime to revision 40 days
2026-05-20published 2026-03-31GHSA-rvhj-8chj-8v3cCVE-2026-0596
pypi
critical		not named as affected when the advisory was published, now names mlflowTime to revision 49 days
Thu 14 May 2026· 3 changes
2026-05-14published 2024-12-02GHSA-4cx5-89vm-833xCVE-2024-52800
maven
low		not named as affected when the advisory was published, now names org.verapdf:libraryTime to revision 528 days
2026-05-14published 2024-12-02GHSA-4cx5-89vm-833xCVE-2024-52800
maven
low		not named as affected when the advisory was published, now names org.verapdf:library-arlingtonTime to revision 528 days
2026-05-14published 2024-12-02GHSA-4cx5-89vm-833xCVE-2024-52800
maven
low		not named as affected when the advisory was published, now names org.verapdf:library-jakartaTime to revision 528 days
Thu 7 May 2026· 7 changes
2026-05-07published 2025-08-08GHSA-hj95-mhgf-jxc4CVE-2025-30404
swifturl
critical		not named as affected when the advisory was published, now names github.com/pytorch/executorchTime to revision 273 days
2026-05-07published 2025-08-08GHSA-xc7w-r669-48pfCVE-2025-54951
swifturl
critical		not named as affected when the advisory was published, now names github.com/pytorch/executorchTime to revision 273 days
2026-05-07published 2026-03-16GHSA-6jj5-j4j8-8473CVE-2026-28499
swifturl
moderate		not named as affected when the advisory was published, now names github.com/vapor/leaf-kitTime to revision 52 days
2026-05-07published 2025-08-08GHSA-84m3-f99p-cqx5CVE-2025-30405
swifturl
critical		not named as affected when the advisory was published, now names github.com/pytorch/executorchTime to revision 273 days
2026-05-07published 2025-08-08GHSA-9m39-3mf3-xwchCVE-2025-54949
swifturl
critical		not named as affected when the advisory was published, now names github.com/pytorch/executorchTime to revision 273 days
2026-05-07published 2025-08-08GHSA-f9hx-c6jf-3qxmCVE-2025-54950
swifturl
critical		not named as affected when the advisory was published, now names github.com/pytorch/executorchTime to revision 273 days
2026-05-07published 2025-07-11GHSA-h952-963h-rv99CVE-2025-30402
swifturl
high		not named as affected when the advisory was published, now names github.com/pytorch/executorchTime to revision 300 days
Wed 6 May 2026· 9 changes
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/auth-helpersTime to revision 174 days
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/aws-secrets-managerTime to revision 174 days
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/federated-authTime to revision 174 days
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/iamTime to revision 174 days
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/mysql-driverTime to revision 174 days
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/oktaTime to revision 174 days
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/otlpTime to revision 174 days
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/pgx-driverTime to revision 174 days
2026-05-06published 2025-11-13GHSA-7wq2-32h4-9hc9
go
high		not named as affected when the advisory was published, now names github.com/aws/aws-advanced-go-wrapper/xrayTime to revision 174 days
Tue 5 May 2026· 1 change
2026-05-05published 2025-09-03GHSA-qww7-89xh-x7m7CVE-2025-55747
maven
critical		not named as affected when the advisory was published, now names org.xwiki.platform:xwiki-platform-webjarsTime to revision 244 days
Tue 28 Apr 2026· 2 changes
2026-04-28published 2026-04-09GHSA-563x-q5rq-57qpCVE-2026-24880
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteTime to revision 18 days
2026-04-28published 2022-02-08GHSA-vf77-8h7g-gghpCVE-2020-13934
maven
high		not named as affected when the advisory was published, now names org.apache.tomcat:tomcat-coyoteDuration unknown
Wed 22 Apr 2026· 1 change
2026-04-22published 2026-02-19GHSA-4hfh-fch3-5q7pCVE-2026-27120
swifturl
moderate		not named as affected when the advisory was published, now names github.com/vapor/leaf-kitTime to revision 62 days

Counted in advisories, never added to the CVE and KEV figures. This kind is counted once per advisory and per package, so one advisory that named four further packages counts four times.

Use arrow keys to move between days, Home or End to reach either end, and Enter to open a day.
4,561 record edits in the 52 weeks to 2026-09-07. Scroll for earlier dates.fewermore

What this page cannot see

Not checked: A CVE record published before 2023, and a KEV listing added before 2025-01-27, were never seen changing. An absence here is not evidence that a record held.

A change shown here is a change to a public record, evidenced by a commit anyone can read in the publisher's own history. It is not an assertion of wrongdoing, negligence or bad faith by any publisher or vendor, not evidence that any fix was incomplete, and not a statement about anyone's systems.

The units, the refusals, the cut-offs and every source, in full →

Paste your closed CVE tickets and see which of these changes hit them →