UN
Vendor
unjs
6
CVEs
0
On KEV
0
New 30D
Products
UN6.1
unhead
unjs
3 CVEs0 on KEV0 new
DE7.5
defu
unjs
1 CVEs0 on KEV0 new
IP9.8
ipx
unjs
1 CVEs0 on KEV0 new
NA9.8
Nanotar
Unjs
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-39315 | UN unhead unjs | 6.1 | Apr 9 | Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() |
| CVE-2026-35209 | DE defu unjs | 7.5 | Apr 6 | defu: Prototype pollution via `__proto__` key in defaults argument |
| CVE-2026-31873 | UN unhead unjs | 6.1 | Mar 12 | Unhead has a Bypass of URI Scheme Sanitization in makeTagSafe via Case-Sensitivity |
| CVE-2026-31860 | UN unhead unjs | 6.1 | Mar 12 | Unhead has a XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check |
| CVE-2025-69874 | NA Nanotar Unjs | 9.8 | Feb 11 | nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction… |
| CVE-2025-54387 | IP ipx unjs | 9.8 | Aug 5 | IPX is Vulnerable to Path Traversal via Prefix Matching Bypass |