Vulners
Lucene search
3 matches found
EUVD-2026-12107
In Bun before 1.3.5, the default trusted dependencies list aka trust allow list can be spoofed by a non-npm package in the case of a matching name for file, link, git, or github...
7.1CVSS5.8AI score0.00097EPSS
Exploits0References14
CVE-2026-24910
In Bun before 1.3.5, the default trusted dependencies list aka trust allow list can be spoofed by a non-npm package in the case of a matching name for file, link, git, or github...
5.9CVSS5.9AI score0.00003EPSS
Exploits0References4
CVE-2026-24910
In Bun before 1.3.5, the default trusted dependencies list aka trust allow list can be spoofed by a non-npm package in the case of a matching name for file, link, git, or github...
5.9CVSS0.00003EPSS
Exploits0References3
20