Advisories scanners can’t match

WeGIA

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

3.2.9<

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

WeGIA␣

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

io.dataease

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

ChurchCRM/CRM

Scanners compare names exactly. Change it to churchcrm/crm.

ChurchCRM␣

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

CRM

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

github.com/siyuan-note/siyuan

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

https://github.com/siyuan-note/siyuan

Scanners compare names exactly. Change it to github.com/siyuan-note/siyuan.

siyuan

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

siyuan-note/siyuan

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

siyuan-note/siyuan

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

dev 52e2bcac5

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

master and dev

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

pinned-revision-8641553a1f07374001902d3ce773285db1292b2d

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= 3.8.1 (also present on dev v3.8.2-alpha)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= 3.8.1 (audited revision afa823b6b4e4f183511e0bc0a3be93caa94c7c97)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

bfe36100477b7bbd66db1a8b8cff5547b2ccdb59

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

eef10568 (master HEAD, v3.7.3) and dev HEAD dfc71589

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

eef105683 (master HEAD, v3.7.3) and dev 3a84ac08b

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

eef105683 and dev 98a4fb37b

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

master eef105683 and dev 98a4fb37b

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v3.8.1 and earlier versions retaining the case-sensitive guard

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v3.8.1 and earlier versions retaining this endpoint behavior

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v3.8.1 and earlier versions retaining this registry behavior

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v3.8.1 and earlier versions retaining this resolver/read sequence

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v3.8.1 and earlier versions retaining this throttle-map design

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v3.8.1 confirmed; historical range not yet established

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣github.com/siyuan-note/siyuan/kernel

Scanners compare names exactly. Change it to github.com/siyuan-note/siyuan/kernel.

siyuan-note

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

siyuan

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

bfe36100477b7bbd66db1a8b8cff5547b2ccdb59

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

fb3355f07d22bff36f1d785999fd5ded6a90d468

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

https://github.com/siyuan-note/siyuan

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

0.26.0-beta.1 .. 0.26.1

Written as A .. B, which tools read differently. Write >= 0.26.0-beta.1, < 0.26.1 if 0.26.1 is fixed, or >= 0.26.0-beta.1, <= 0.26.1 if 0.26.1 is affected.

0.26.0 .. 0.26.1

Written as A .. B, which tools read differently. Write >= 0.26.0, < 0.26.1 if 0.26.1 is fixed, or >= 0.26.0, <= 0.26.1 if 0.26.1 is affected.

v0.26.0-beta.1 .. v0.26.1

Written as A .. B, which tools read differently. Write >= v0.26.0-beta.1, < v0.26.1 if v0.26.1 is fixed, or >= v0.26.0-beta.1, <= v0.26.1 if v0.26.1 is affected.

0.25.0-alpha.3 .. 0.25.2

Written as A .. B, which tools read differently. Write >= 0.25.0-alpha.3, < 0.25.2 if 0.25.2 is fixed, or >= 0.25.0-alpha.3, <= 0.25.2 if 0.25.2 is affected.

0.26.0-alpha.1 .. 0.26.1

Written as A .. B, which tools read differently. Write >= 0.26.0-alpha.1, < 0.26.1 if 0.26.1 is fixed, or >= 0.26.0-alpha.1, <= 0.26.1 if 0.26.1 is affected.

v0.26.0 .. v0.26.1

Written as A .. B, which tools read differently. Write >= v0.26.0, < v0.26.1 if v0.26.1 is fixed, or >= v0.26.0, <= v0.26.1 if v0.26.1 is affected.

v0.20.1 .. v0.26.1

Written as A .. B, which tools read differently. Write >= v0.20.1, < v0.26.1 if v0.26.1 is fixed, or >= v0.20.1, <= v0.26.1 if v0.26.1 is affected.

v0.26.0-beta.1 .. 0.26.1

Written as A .. B, which tools read differently. Write >= v0.26.0-beta.1, < 0.26.1 if 0.26.1 is fixed, or >= v0.26.0-beta.1, <= 0.26.1 if 0.26.1 is affected.

0.1 .. 0.25.0-alpha.3

Written as A .. B, which tools read differently. Write >= 0.1, < 0.25.0-alpha.3 if 0.25.0-alpha.3 is fixed, or >= 0.1, <= 0.25.0-alpha.3 if 0.25.0-alpha.3 is affected.

0.24.0 .. 0.26.1

Written as A .. B, which tools read differently. Write >= 0.24.0, < 0.26.1 if 0.26.1 is fixed, or >= 0.24.0, <= 0.26.1 if 0.26.1 is affected.

0.25 .. 0.26.0-alpha.1

Written as A .. B, which tools read differently. Write >= 0.25, < 0.26.0-alpha.1 if 0.26.0-alpha.1 is fixed, or >= 0.25, <= 0.26.0-alpha.1 if 0.26.0-alpha.1 is affected.

0.25.0 .. 0.25.2

Written as A .. B, which tools read differently. Write >= 0.25.0, < 0.25.2 if 0.25.2 is fixed, or >= 0.25.0, <= 0.25.2 if 0.25.2 is affected.

0.25.0 .. 0.26.0-alpha.1

Written as A .. B, which tools read differently. Write >= 0.25.0, < 0.26.0-alpha.1 if 0.26.0-alpha.1 is fixed, or >= 0.25.0, <= 0.26.0-alpha.1 if 0.26.0-alpha.1 is affected.

0.25.0-alpha.1 .. 0.26.1

Written as A .. B, which tools read differently. Write >= 0.25.0-alpha.1, < 0.26.1 if 0.26.1 is fixed, or >= 0.25.0-alpha.1, <= 0.26.1 if 0.26.1 is affected.

0.25.0-alpha.3 .. 0.26.0-alpha.1

Written as A .. B, which tools read differently. Write >= 0.25.0-alpha.3, < 0.26.0-alpha.1 if 0.26.0-alpha.1 is fixed, or >= 0.25.0-alpha.3, <= 0.26.0-alpha.1 if 0.26.0-alpha.1 is affected.

0.26.0-beta.1 .. 0.26.1␣

Written as A .. B, which tools read differently. Write >= 0.26.0-beta.1, < 0.26.1 if 0.26.1 is fixed, or >= 0.26.0-beta.1, <= 0.26.1 if 0.26.1 is affected.

0.26.0-beta.1 ... 0.26.1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v0.24.0 .. v0.26.0-alpha.1

Written as A .. B, which tools read differently. Write >= v0.24.0, < v0.26.0-alpha.1 if v0.26.0-alpha.1 is fixed, or >= v0.24.0, <= v0.26.0-alpha.1 if v0.26.0-alpha.1 is affected.

v0.25.0 .. v0.25.2

Written as A .. B, which tools read differently. Write >= v0.25.0, < v0.25.2 if v0.25.2 is fixed, or >= v0.25.0, <= v0.25.2 if v0.25.2 is affected.

v0.25.0 .. v0.26.0-alpha.1

Written as A .. B, which tools read differently. Write >= v0.25.0, < v0.26.0-alpha.1 if v0.26.0-alpha.1 is fixed, or >= v0.25.0, <= v0.26.0-alpha.1 if v0.26.0-alpha.1 is affected.

v0.25.0 .. v0.26.1

Written as A .. B, which tools read differently. Write >= v0.25.0, < v0.26.1 if v0.26.1 is fixed, or >= v0.25.0, <= v0.26.1 if v0.26.1 is affected.

v0.25.0-alpha.1 ... 0.26.0-alpha.1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

openssl_encrypt

Scanners compare names exactly. Change it to openssl-encrypt.

>= aspen

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= aspen.1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= redwood

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= cypress

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

< master

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

< teak

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= master (all versions containing SAMLProviderDataViewSet.sync_provider_data)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= master (all versions containing the survey app)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= birch

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= ficus

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= ulmo

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>=sumac

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>maple

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

master, palm, olive, nutmeg, maple, lilac, koa, juniper

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

n/a

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

-1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

< 2024-01-08 03:00 UTC

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

RubyGems.org Service

Not a valid RubyGems package name. Use the gem name on rubygems.org.

awslabs.aws-api-mcp-server

Scanners compare names exactly. Change it to awslabs-aws-api-mcp-server.

awslabs.postgres-mcp-server

Scanners compare names exactly. Change it to awslabs-postgres-mcp-server.

awslabs.security-agent-mcp-server

Scanners compare names exactly. Change it to awslabs-security-agent-mcp-server.

awslabs.amazon-mq-mcp-server

Scanners compare names exactly. Change it to awslabs-amazon-mq-mcp-server.

awslabs.aws-healthomics-mcp-server

Scanners compare names exactly. Change it to awslabs-aws-healthomics-mcp-server.

awslabs.aws-serverless-mcp-server

Scanners compare names exactly. Change it to awslabs-aws-serverless-mcp-server.

awslabs.aws-transform-mcp-server

Scanners compare names exactly. Change it to awslabs-aws-transform-mcp-server.

awslabs.documentdb-mcp-server

Scanners compare names exactly. Change it to awslabs-documentdb-mcp-server.

awslabs.dynamodb-mcp-server

Scanners compare names exactly. Change it to awslabs-dynamodb-mcp-server.

awslabs.healthlake-mcp-server

Scanners compare names exactly. Change it to awslabs-healthlake-mcp-server.

awslabs.mysql-mcp-server

Scanners compare names exactly. Change it to awslabs-mysql-mcp-server.

>=4.0.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>=5.0.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>=4.9.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>=4.11.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>=4.6.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>=5.6.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

givanz/Vvveb

Scanners compare names exactly. Change it to givanz/vvveb.

␣givanz/vvveb

Scanners compare names exactly. Change it to givanz/vvveb.

Vvveb

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

<= latest

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

vvveb

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

Xibo CMS

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

xibo-cms

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

>=2.1.0,<3.3.12,<4.0.14

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

=>1.8.0,<3.3.12,<4.0.13

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

>=2.0.0

No upper bound, and the fixed field (“<=4.5.1”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

>=2.1.0,<3.3.12,<4.0.13

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

>=4.5.0

No upper bound, and the fixed field (“<4.5.2”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

xibosignage\xibo-cms

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

DIRAC

Scanners compare names exactly. Change it to dirac.

>= 6

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

Weblate

Scanners compare names exactly. Change it to weblate.

<2026.8,>4.11.1

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

org.hyperledger.besu/besu

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

rlpx

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

NONE

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

All

No upper bound, and the fixed version (v1.19.2) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< v1.19.2).

kyverno/kyverno, kyverno/policies, kyverno/website

Not a valid GitHub Actions package name. Use the action's owner/repo.

\>= 1.11.0, \<= 1.16.2

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

`<= v1.18.2`

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

main @ 21168fdf

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

kyverno

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

pkg/policy/generate/validate.go

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

UFO

Scanners compare names exactly. Change it to ufo.

microsoft/UFO

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

<= be75a7d

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

Other

Scanners compare names exactly. Change it to other.

␣github.com/rancher/rancher

Scanners compare names exactly. Change it to github.com/rancher/rancher.

InvoicePlane/InvoicePlane

Scanners compare names exactly. Change it to invoiceplane/invoiceplane.

application/modules/invoices/controllers/Invoices.php

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

application/modules/guest/controllers/View.php

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

application/modules/invoices/models/Mdl_invoices.php

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

minio

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

>= RELEASE.2019-09-25T18-25-51Z

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= RELEASE.2020-04-10T03-34-42Z

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= RELEASE.2020-07-24T22-43-05Z

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= RELEASE.2020-12-23T02-24-12Z

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= RELEASE.2021-12-09T06-19-41Z

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

RELEASE.2019-07-31T18-57-56Z

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

RELEASE.2021-08-31T05-46-54Z

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

RELEASE.2021-10-10T16-53-30Z

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

MinIO

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

>= 10.59

No upper bound, and the fixed version (10.98) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< 10.98).

>= 12.07

No upper bound, and the fixed version (12.08) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< 12.08).

>= 12.14

No upper bound, and the fixed version (12.15) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< 12.15).

>= 12.48

No upper bound, and the fixed version (12.49) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< 12.49).

>= 8.16

No upper bound, and the fixed version (12.15) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< 12.15).

>=11.90

No upper bound, and the fixed version (12.13) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< 12.13).

`latest (Docker/container deployments without 'file' binary)`

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v10.37 (confirmed on v10.37.0; earlier versions with the same export handlers likely affected — to be confirmed)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

apple/containerization

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

apple/container

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

com.arcadedb

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

␣com.arcadedb

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

CtrlPanel-gg/panel

Scanners compare names exactly. Change it to ctrlpanel-gg/panel.

Ctrlpanel-gg/panel

Scanners compare names exactly. Change it to ctrlpanel-gg/panel.

openreplay/openreplay

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

openreplay/ee-api

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

openreplay/spot

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

Sourcegraph

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

WWBN/AVideo-Encoder

Scanners compare names exactly. Change it to wwbn/avideo-encoder.

com.fit2cloud

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

versions: <= 1.0.2

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

versions: < 1.2.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

versions: < = 1.3.1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

versions: < = 1.4.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

versions: <= 1.3.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

apple/container

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

container

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

horilla/horilla-hr

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

`>= 1.0` (introduced with mail preview feature, commit `da12c9417`)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

https://github.com/langgenius/dify

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

>= 1.14.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>= 1.14.11

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>= 1.18.9

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>= 37.0.0rc1

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>= 38.0.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>=0.1.7

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

stirling-pdf

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

stirling-software/stirling-pdf

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

Wallos

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

Wallos

Scanners compare names exactly. Change it to wallos.

gtsteffaniak/filebrowser

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

filebrowser

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

https://github.com/gtsteffaniak/filebrowser/

Scanners compare names exactly. Change it to github.com/gtsteffaniak/filebrowser.

io.jans.jans-auth-server

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

FastGPT/sandbox

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

<= latest

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

FastGPT/service

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

fastgpt/service

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

␣lychee-org/lychee

Scanners compare names exactly. Change it to lychee-org/lychee.

>= 6.10.0

No upper bound, and the fixed field (“> 7.7.3”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

WsgiDAV

Scanners compare names exactly. Change it to wsgidav.

NamelessMC/Nameless

Scanners compare names exactly. Change it to namelessmc/nameless.

OpenEMR

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

Piwigo

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

Piwigo / Piwigo

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

Piwigo/Piwigo

Scanners compare names exactly. Change it to piwigo/piwigo.

< commit 0822030

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

< commit 36f70d1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

< commit a754b3d

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

< commit aea528198b3b226e0d20cce878551fd4c0e3d5d0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= commit f6fff7f3c33e0b4a8ed72acb4fc7888fbeb8e7fc

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= 2.0.0-rc.0, <= 1.20.1

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

<= 1.20.2, <= 2.0.0-rc.3

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

>=1.2.8, 2.0.0-rc.3

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

all versions prior to fix

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

Scrapy

Scanners compare names exactly. Change it to scrapy.

TriliumNext/Trilium

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

triliumnext/server

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

swift-nio-http2

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

␣<= main (rolling release)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= 0.23.8, rolling main through ebf75a2 (verified ebf75a267fd2113c1c1b881c04a58babdf4356d3)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

current main as of commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 (2026-07-31)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

urrent main as of commit bcf8754eef3a268ad82c3db4d81f7920c3c28b56 (2026-07-31)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

org.bahmni.module.bahmnicore-omod

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

ComfyUI

Scanners compare names exactly. Change it to comfyui.

dhis2-core

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

2.37, 2.38, 2.39, 2.40.x before 2.40.11.1/2.40.12, 2.41.x before 2.41.8.2, 2.42.x before 2.42.5.1, 2.43.0 before 2.43.0.1, 2.44 development branch before PR #24162

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

> v0.123.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

> v0.167.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

> v0.43

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

kkFileView

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

zstd-jni

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

␣com.github.luben:zstd-jni

Scanners compare names exactly. Change it to com.github.luben:zstd-jni.

metersphere

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

<=v2.10.1 LTS

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

framework/sdk-parent/sdk/src/main/java/io/metersphere/commons/utils/FileUtils.java

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

io.metersphere

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

␣io.modelcontextprotocol.sdk:mcp-core

Scanners compare names exactly. Change it to io.modelcontextprotocol.sdk:mcp-core.

>= 0.11.0, 0 < 0.18.5

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

`nono-proxy` component of `nono`

Not a valid crates.io package name. Use the crate name on crates.io.

>= 0.55.0

No upper bound, and the fixed field (“<0.81.0”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

>=0.65.0

No upper bound, and the fixed field (“<0.81.0”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

>=0.67.0

No upper bound, and the fixed field (“<0.72.0”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

>=0.73.0

No upper bound, and the fixed field (“Not yet”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

>= 4.0.0-canary.0, < 4.0.0-beta.7

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

ThinkInAIXYZ/deepchat

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

All current branches up to main (Incomplete fix for CVE-2025-55733)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

All untracked versions up to current standard.

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

ZoneMinder

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

watch.php

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

> 1.37.48, < 1.38.3

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

functions.php

Scanners compare names exactly. Change it to functions-php.

<= bf7e4d2 (main)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

ion-java

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

>= 44.2.0, < 47.7.6 OR >= 48.0.0, <= 48.5.2, 49.0.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= 47.0.0, < 47.7.6 OR >= 48.0.0, <= 48.5.2, 49.0.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= 31.1.0, < 47.7.6 OR >= 48.0.0, <= 48.5.2, 49.0.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= 41.4.1, < 47.7.6 OR >= 48.0.0, <= 48.5.2, 49.0.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

N/A

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

N/

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

org.coralprotocol.coralserver

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

emlog

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

emlog<=2.5.9

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

emlog

Not a valid GitHub Actions package name. Use the action's owner/repo.

FileRise

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

error311/FileRise

Scanners compare names exactly. Change it to error311/filerise.

error311/filerise␣

Scanners compare names exactly. Change it to error311/filerise.

System Wide

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

server/fm-modules/facileManager/ajax/processPost.php

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

server/fm-modules/facileManager/pages/admin-logs.php

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

tbd

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

freescout

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

freescout␣

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

freescout-help-desk

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

GitHub Workflow

Not a valid GitHub Actions package name. Use the action's owner/repo.

> v0.1.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

Bleve Library

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

WebOb

Scanners compare names exactly. Change it to webob.

>= 1f9a1a4 (next branch, unreleased, 2026-08-07 hardening pass)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= 849f710, <= 24809f0 (next branch, unreleased)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

All versions through commit 3b9fcdc

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

MatiasDesuu/ThinkDashboard

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

--split-exp

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣␣␣␣github.com/mikefarah/yq/v4

Scanners compare names exactly. Change it to github.com/mikefarah/yq/v4.

yqlib/encoder_shellvariables.go

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

> 3.0, <= 3.2.11

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

Glances

Scanners compare names exactly. Change it to glances.

oobabooga/text-generation-webui

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

OpenObserve

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

openobserve

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

All (before fix)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣io.openremote:openremote-manager

Scanners compare names exactly. Change it to io.openremote:openremote-manager.

Paymenter/Paymenter

Scanners compare names exactly. Change it to paymenter/paymenter.

plone.restapi

Scanners compare names exactly. Change it to plone-restapi.

pluginsGLPI/order

Scanners compare names exactly. Change it to pluginsglpi/order.

reachy_mini

Scanners compare names exactly. Change it to reachy-mini.

latest

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

reachy_mini_central_signalling

Scanners compare names exactly. Change it to reachy-mini-central-signalling.

<= v2.1.15, v2.1.16 (partial)␣

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

All versions containing the GraphQL Search extension prior to a fix

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

zot

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

␣github.com/rancher/fleet

Scanners compare names exactly. Change it to github.com/rancher/fleet.

<= f0de89b (main)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

solidtime

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

solidtime␣

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

Sparkle

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

sparkle-project/Sparkle

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

@sync-in/server␣

Scanners compare names exactly. Change it to @sync-in/server.

[github.com/theagentrouter/agent-router](https://github.com/theagentrouter/agent-router)

Scanners compare names exactly. Change it to github.com/theagentrouter/agent-router.

`v3.20.188-lts` and `v3.20.189-lts`

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

https://github.com/VictoriaMetrics/VictoriaMetrics

Scanners compare names exactly. Change it to github.com/VictoriaMetrics/VictoriaMetrics.

<7.0.10, 7.1-7.4.3, 8.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

WWBN/AVideo

Scanners compare names exactly. Change it to wwbn/avideo.

>= 1.0, >= 2.0, >= 3.0.3, <= 4.0.5

Several lower bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

>= 3.0.0, <= 3.0.6 | >= 4.0.0, <= 4.0.4

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

mail-mime-parser

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

>= 2.0.0

No upper bound, and the fixed version (v2.10.6-lts) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< v2.10.6-lts).

OpenEXR

Scanners compare names exactly. Change it to openexr.

<= 5.0.17 - 6.0.0-Beta1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

admidio

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

ajenti.plugin.core

Scanners compare names exactly. Change it to ajenti-plugin-core.

anzory/vscode-gppl-ide

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

@apify/actors-mcp-server (apify/apify-mcp-server)

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

swift-crypto

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

app/server/appsmith-interfaces/src/main/java/com/appsmith/util/WebClientUtils.java

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

app/server/appsmith-server/src/main/java/com/appsmith/server/controllers/ce/UserControllerCE.java

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

Authlib

Scanners compare names exactly. Change it to authlib.

software.amazon.jdbc.aws-advanced-jdbc-wrapper

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

bfd757708cd50745306f083f5de9d2d3fcfc88c2

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣baserproject/basercms␣

Scanners compare names exactly. Change it to baserproject/basercms.

`baserproject/basercms`

Scanners compare names exactly. Change it to baserproject/basercms.

Frigate

Scanners compare names exactly. Change it to frigate.

blakeblackshear/frigate

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

capgo

Not a valid GitHub Actions package name. Use the action's owner/repo.

@capgo/capgo (capgo.app self-hosted backend)

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

Cloud Hypervisor

Not a valid crates.io package name. Use the crate name on crates.io.

https://github.com/contribsys/faktory

Scanners compare names exactly. Change it to github.com/contribsys/faktory.

␣dev.dsf:dsf-fhir-server

Scanners compare names exactly. Change it to dev.dsf:dsf-fhir-server.

NA

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<0.11.14 and <1.12.3

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

>= 0.1.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>= 0.2.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

␣org.dspace:dspace-api

Scanners compare names exactly. Change it to org.dspace:dspace-api.

eduMFA

Scanners compare names exactly. Change it to edumfa.

<= 5.6.12 (current master)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= 6.0.0-alpha4 , <= 5.6.12

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

Started in commit 26db8cba32e77050f177e8cb0f879614c57bc5f2

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

e6858ea1279d3f32cf21e911ccca37bc013bb6c8

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

arduino-esp32

Not a valid GitHub Actions package name. Use the action's owner/repo.

0.10.1 until 0.19.2

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

providers/v1/onepasswordsdk

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

< 1.5.10.1796, < 1.6.0-beta.2275

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

<= 1.5.10.2215, <= 1.6.0-beta.3184

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

FreshRSS

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

freshrss

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

<= current

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<=current

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

HiEventsDev/Hi.Events/

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

hievents

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

⁠<= 1.0.1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

package mcp-contextforge-gateway

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

https://github.com/IceWhaleTech/ZimaOS

Scanners compare names exactly. Change it to github.com/IceWhaleTech/ZimaOS.

ZimaOS <= 1.4.1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

ZimaOS <= v1.4.1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<=latest

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>2.6.2

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

groupoffice

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

org.jeecg.modules.system.controller.SysDepartPermissionController

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

org.jeecgframework.boot

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

koko

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

<= 3.5.5, 3.6.x <= 3.6.4

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

com.provectus.kafka.ui

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

io.kafbat.ui.kafbat-ui

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

https://github.com/kubernetes-sigs/aws-load-balancer-controller

Scanners compare names exactly. Change it to github.com/kubernetes-sigs/aws-load-balancer-controller.

␣components/apiserver-proxy/internal/proxy

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

components/apiserver-proxy/internal/proxy

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

older than commit 78873fa, inclusive

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

older than commit fcba413, inclusive

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

close_low_effort_issues.yml

Not a valid GitHub Actions package name. Use the action's owner/repo.

release_update.yml

Not a valid GitHub Actions package name. Use the action's owner/repo.

current dev-v2

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

latest

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

release-preparation.yml

Not a valid GitHub Actions package name. Use the action's owner/repo.

<= 5.5.3 - #218

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= 5.5.3 - 170

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣dataclasses-avroschema

Scanners compare names exactly. Change it to dataclasses-avroschema.

org.matrix.MatrixSDK

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

pyHanko

Scanners compare names exactly. Change it to pyhanko.

maximhq/bifrost

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

med-united/epa4all

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

[,2.5.307), [3.0,3.1.11)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

[2.1.115, 2.5.305), [3.0, 3.1.10)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= v25.0.18, > v26.0.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

␣github.com/moby/moby/v2

Scanners compare names exactly. Change it to github.com/moby/moby/v2.

nanbingxyz/5ire

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

c1585401a3f1b7977781549a882943e55127af55

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

db633d1bdf2ab36eb28343ae91bb0775ceaa1919

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

Versions with disc.yml in them

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

monorepo

Not a valid GitHub Actions package name. Use the action's owner/repo.

io.openaev

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

openaev

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

opencast

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

search-service-impl

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

openclaw

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

> 2026.4.20, < 2026.5.28

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

org.openmrs.api

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

org.openmrs.module.fhir2-api

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

> 3.4.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

opensourcepos

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

All versions prior to the fix (including current 20.0 Alpha)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

> v0.40.1

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

␣github.com/pocket-id/pocket-id/backend

Scanners compare names exactly. Change it to github.com/pocket-id/pocket-id/backend.

main

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

CI

Not a valid GitHub Actions package name. Use the action's owner/repo.

Pillow

Scanners compare names exactly. Change it to pillow.

https://github.com/reactive-firewall/multicast#egg=multicast

Scanners compare names exactly. Change it to multicast.

https://github.com/reactive-firewall/multicast.git#egg=multicast

Scanners compare names exactly. Change it to multicast.

Ree6

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

All versions as of 2026-09-06

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

quickdrop

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

hap-wi/roxy-wi

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

roxy-wi␣

Scanners compare names exactly. Change it to roxy-wi.

<3.4.5, 3.3.*

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

rundeck.war, rundeckpro-enterprise.war

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

rundeckpro-enterprise.war

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

<latest

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= 4.05, <= 4.47 (the latest release), plus master.

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

seaweedfs/seaweedfs

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

Tophat

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

confirmed at commit `12aa90c4895436c4762de547b1c1f5a8a27d43d4`

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

recipes

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= 4.2.0-alpha.2 (including 4.1.8)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= 4.2.0-alpha

No upper bound, and the fixed version (4.1.7) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< 4.1.7).

thorsten/phpMyFAQ

Scanners compare names exactly. Change it to thorsten/phpmyfaq.

ca06099466ba587a5e2381c95804e040bad5fa73

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

github.com/tinyauthapp/tinyauth␣

Scanners compare names exactly. Change it to github.com/tinyauthapp/tinyauth.

v0.5.0>=, <v6.23.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

v3.23.0>=, <v6.23.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

[4.0.0,4.5.29],[5.0.0,5.1.4]

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

[4.0.0,4.5.35]

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

[5.0.0,5.2.2]

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

io.vertx.ext.web.client

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

<b851c3ec08152257564e3b6bdee4ca7b395c7b44

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

e76fa1a06

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

KUNO

Not a valid GitHub Actions package name. Use the action's owner/repo.

␣com.xwiki.pro:xwiki-pro-macros

Scanners compare names exactly. Change it to com.xwiki.pro:xwiki-pro-macros.

1Panel

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

xshop

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

[,1.3.86)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

AdGuardHome

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

> v0.45.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

ag-psd␣

Scanners compare names exactly. Change it to ag-psd.

> 1.0.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

>= v1.5.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

␣alchemy_cms

Scanners compare names exactly. Change it to alchemy_cms.

Altair desktop clients (macOS, linux, windows)

Not a valid GitHub Actions package name. Use the action's owner/repo.

org.altcha/altcha

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

<=v11.1.1 (the latest release), >= 8.5.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

amir20/dozzle

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

org.dromara.hertzbeat

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

swift-nio

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

apptainer

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

< v 0.15.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣docsgpt

Scanners compare names exactly. Change it to docsgpt.

ArduinoCreateAgent

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

`<= 6.8.4

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

commits prior to 751c0e58369e784f6a924347e381a705ea8133fe

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

github.com/astronomer/dag-factory

Scanners compare names exactly. Change it to astronomer/dag-factory.

com.auth0:java-jwt␣␣

Scanners compare names exactly. Change it to com.auth0:java-jwt.

>= 2.1.0; 3.0.0 to 3.2.1; 4.0.0 to 4.0.2

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

aws-cdk.aws-redshift-alpha

Scanners compare names exactly. Change it to aws-cdk-aws-redshift-alpha.

> 1.10.73

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

com.amazonaws.services.cloudfront

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

software.amazon.kinesis:amazon-kinesis-producer␣

Scanners compare names exactly. Change it to software.amazon.kinesis:amazon-kinesis-producer.

>= af7b7f35971493d67a9c1cdfb496c3b11f8a6ffe

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

shields

Not a valid GitHub Actions package name. Use the action's owner/repo.

all versions prior to the fix commit (2026-09-03)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

gpt_academic/shared_utils /handle_upload.py

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

< v-9.11.3

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

`bbot/modules/github_workflows.py`, `bbot/modules/gitlab_onprem.py`␣␣

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

bluenviron/mediamtx

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

/ bubka/2fauth

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

bugsink/bugsink

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

ConfigArgParse

Scanners compare names exactly. Change it to configargparse.

bytecodealliance/preview3-shim

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

>3.0.0, <3.3.7

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

>4.0.0, <4.2.1

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

-

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

current

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

casgate/casgate

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

cc.tweaked:cc-tweaked-*-core

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

https://github.com/centrifugal/centrifugo

Scanners compare names exactly. Change it to github.com/centrifugal/centrifugo.

2.0.0 RC2

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

4.9.0 (latest version)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

widget_chat.py, ConversationChat.vue, WidgetBuilder.vue

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

whodb

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

None

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

de.codecentric.spring-boot-admin-server-ui

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

@codidact/qpixel

Not a valid RubyGems package name. Use the gem name on rubygems.org.

Composer-Setup.exe

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

0.4.1 <=

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

< v0.57.0 > v0.40.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

amazon-corretto-crypto-provider

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

>= 4.0.0

No upper bound, and the fixed field lists several versions. Add the package once per release line, each with >= start, < fix.

>1.36.0, < 1.37.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

0.104.0 >= 1.67.0

Mixes exact versions with bounds. Give exact versions and ranges as separate entries.

metadata-ingestion/src/datahub/ingestion/source/ldap.py

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

qtiworks-engine

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

<= 0.7.6-Beta, <= 0.7.6b0

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

PostQuantum-Feldman-VSS

Scanners compare names exactly. Change it to postquantum-feldman-vss.

<=1 .0.0-M2.1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

.env

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

https://github.com/denpiligrim/3dp-manager

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

0.54.1 through 0.55.7 (latest), default config.

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

auth/pwdless/logintoken.go

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

have not checked, `main` is affected

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

DRACOON for iOS

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

sftpgo

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

https://github.com/dvsekhvalnov/jose2go

Scanners compare names exactly. Change it to github.com/dvsekhvalnov/jose2go.

org.biscuitsec.biscuit

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

N/A

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

[4.0.0,4.5.29],[5.0.0,5.1.4]

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣io.vertx:vertx-pg-client

Scanners compare names exactly. Change it to io.vertx:vertx-pg-client.

< bd80ba833b9023d39ca22e29874296c8729dd53b

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

Element Desktop

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

im.vector.app

Not a valid SwiftURL package name. Use the package's Git URL without the scheme, e.g. github.com/owner/repo.

>= V1

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣github.com/enchant97/note-mark/backend

Scanners compare names exactly. Change it to github.com/enchant97/note-mark/backend.

https://github.com/envoyproxy/gateway

Scanners compare names exactly. Change it to github.com/envoyproxy/gateway.

git-tag-annotation-action

Not a valid GitHub Actions package name. Use the action's owner/repo.

com.erudika.scoold

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

commit 48d76b947d1f3185b3a7a9af4cdcaf02c263d938, server release line v137 as present in server/release.go

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

ESPAsyncWebServer

Not a valid GitHub Actions package name. Use the action's owner/repo.

espocrm

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

faction

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

>= 2.19.0 (2.x branch, fix not backported as of 2026-07-17)

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

FearlessCMS

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

latest

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

lxml_html_clean

Scanners compare names exactly. Change it to lxml-html-clean.

/Finsys/dockhand

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

ShaneIsrael/fireshare

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

source>=4aec19d

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

MirahezeBot-Plugins

Scanners compare names exactly. Change it to mirahezebot-plugins.

free5gc

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

grpcurl

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

BabelDOC

Scanners compare names exactly. Change it to babeldoc.

chuanhuchatgpt

Not a valid GitHub Actions package name. Use the action's owner/repo.

0.23.x/current

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

df11a650c650ff895977c5440427c239671ee649

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

GeoTools

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

GeoWebCache

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

grav

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

GetSimpleCMS-CE

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

>= 1.1.0

No upper bound, and the fixed field (“> Build 1151”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

gitea.dev␣␣␣

Scanners compare names exactly. Change it to gitea.dev.

mod_wsgi

Scanners compare names exactly. Change it to mod-wsgi.

mod_wsgi-standalone

Scanners compare names exactly. Change it to mod-wsgi-standalone.

netmaker

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

1.0.0, release/0.2.153

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

<= 3.0.0 (verified 66de740, tag 3.0.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

ChatterBot

Scanners compare names exactly. Change it to chatterbot.

<=␣

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

com.twelvemonkeys.imageio:imageio-psd / imageio-tga / imageio-pnm

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

< c52f07c

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

> 2.0.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

nanobot (bridge)

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

< September 5, 2023

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

org.http4k:http4k-template-thymeleaf

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

ng-antd-admin nestjsapi

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

informalsystems/tendermint

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

inspektor-gadget

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

>=24.03

No upper bound, and the fixed field (“<26.05”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

All versions containing the affected GitHub Actions workflows

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

istio.io/ztunnel

Not a valid crates.io package name. Use the crate name on crates.io.

pcapture

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

org.jeecgframework.jimureport:jimureport-spring-boot3-starter␣

Scanners compare names exactly. Change it to org.jeecgframework.jimureport:jimureport-spring-boot3-starter.

drawio

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

␣main branch snapshot (package.json version 9.3.0); exact released version range to be confirmed

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= v1.2.1-beta.1

No upper bound, and the fixed field (“<= v1.3.1-beta.1”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

github.com/julien040/anyquery␣␣

Scanners compare names exactly. Change it to github.com/julien040/anyquery.

extension-template

Not a valid GitHub Actions package name. Use the action's owner/repo.

Kareadita/Kavita

Not a valid NuGet package name. Use the package ID on nuget.org.

␣kata-containers

Scanners compare names exactly. Change it to kata-containers.

e2e tests

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

> 0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

workflow-files

Not a valid GitHub Actions package name. Use the action's owner/repo.

main

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

com.googlecode.aviator

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

knadh/listmonk

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

Whatsapp-Chat-Exporter

Scanners compare names exactly. Change it to whatsapp-chat-exporter.

github.com/komari-monitor/komari␣

Scanners compare names exactly. Change it to github.com/komari-monitor/komari.

pkg/apiserver/domain/service/authentication.go

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

< current

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= 1.3.0

No upper bound, and the fixed field (“> 1.14.2”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

langbot_plugin

Scanners compare names exactly. Change it to langbot-plugin.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

current dev

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

lam

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

␣lemmy_server

Scanners compare names exactly. Change it to lemmy_server.

lemon8866/StreamVault

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

3.2.0 + 3.2.1 and current main

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

< edge-24.6.2

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>=v1.40.1

No upper bound, and the fixed version (v1.41.0) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< v1.41.0).

dendrite

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

Mautic

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

1.2.0 – 2.0.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣github.com/mayswind/ezbookkeeping

Scanners compare names exactly. Change it to github.com/mayswind/ezbookkeeping.

benchmarks.yml

Not a valid GitHub Actions package name. Use the action's owner/repo.

>2.5.3

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

>1.7.0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

directxtk_desktop_win10␣

Scanners compare names exactly. Change it to directxtk_desktop_win10.

>= 2.0.0-*, < 2.0.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

li.cil.oc:OpenComputers:MC1.7.10-1.5.+:api

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

␣miraheze/ts-portal

Scanners compare names exactly. Change it to miraheze/ts-portal.

io.modelcontextprotocol:kotlin-sdk-client (and umbrella kotlin-sdk)

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

␣go.mongodb.org/mongo-driver/bson

Scanners compare names exactly. Change it to go.mongodb.org/mongo-driver/bson.

␣go.mongodb.org/mongo-driver/v2/bson

Scanners compare names exactly. Change it to go.mongodb.org/mongo-driver/v2/bson.

*

No upper bound, and the fixed version (592ce1becb9b6824badc14a803bcd9268cbea382) doesn't close the range. Check both fields: the fix should be inside the range's release line, and the range can end at it (< 592ce1becb9b6824badc14a803bcd9268cbea382).

All versions up to and including the current `master` branch as of 2026-06-24

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

current main branch, commit bd0e9bf385c7a0e27dcd17c356155dde148bf27c (2026-07-11) as of this report

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

NASA-AMMOS/AIT-Core

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

skills-service

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

> 0

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

workflow-files

Not a valid GitHub Actions package name. Use the action's owner/repo.

notrinos/NotrinosERP

Scanners compare names exactly. Change it to notrinos/notrinoserp.

N/A

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

N/A

Not a valid NuGet package name. Use the package ID on nuget.org.

4.5.06, 4.5.11, 4.6.00, 4.6.01, branch nukeviet4.6 at commit 00740113b0946542f997b2da63832754bae2efb8.

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

NVIDIA Neural Modules 1.22.0

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

NVIDIA Neural Modules

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

HEAD

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣oneuptime

Scanners compare names exactly. Change it to oneuptime.

onlaj/Piano-LED-Visualizer

Not a valid PyPI package name. Use the project name on PyPI, e.g. requests.

opentelemetry-helpers-sql-processor v0.4.0 and v0.5.0 (latest, tag opentelemetry-helpers-sql-processor/v0.5.0 = da6ede8; unchanged on main ded9432), file helpers/sql-processor/lib/opentelemetry/helpers/sql_processor/commenter.rb, introduced in commit 3a39a448 (#1818).

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

opentelemetry-helpers-sql-processor (consumed by opentelemetry-instrumentation-pg/mysql2/trilogy)

Not a valid RubyGems package name. Use the gem name on rubygems.org.

OpenAgentPlatform/Dive

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

editor

Not a valid GitHub Actions package name. Use the action's owner/repo.

opencats/OpenCATS

Scanners compare names exactly. Change it to opencats/opencats.

opencloud

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

< 2.46.4 < 2.40.5

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

>8.0.0-preview.1.26302.68, <8.0.0-preview.4.26456.66

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

f0fc8fa9f2a14eff70750aa81005076fe96e861b

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>= 10.5.4

No upper bound, and the fixed field (“<= 20.2.5”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

cups

Not a valid GitHub Actions package name. Use the action's owner/repo.

␣RIAServices.Server

Scanners compare names exactly. Change it to RIAServices.Server.

> 0.20.3

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.

<=1.3.4 and <=2.2.0

Several upper bounds in one range. Add the package once per release line, each with its own range, e.g. >= 2.0.0, < 2.0.3.

/dashboards-reports/public/components/main/main_utils.tsx

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

latest

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

"Analysis - SonarCloud" workflow

Not a valid GitHub Actions package name. Use the action's owner/repo.

https://github.com/oras-project/oras

Scanners compare names exactly. Change it to github.com/oras-project/oras.

< 0.10.1; >= 0.11.0, < 0.11.1; and >= 0.12.0, < 0.12.1.

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

pdovhomilja/nextcrm-app

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

Pelican Platform Client

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

personnummer

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

Pex

Scanners compare names exactly. Change it to pex.

pg_query_go

Not a valid Go package name. Use the module path from go.mod, e.g. github.com/owner/repo or github.com/owner/repo/v2.

de.themoep.inventorygui

Not a valid Maven package name. Use groupId:artifactId, e.g. org.example:library.

querybook

Not a valid GitHub Actions package name. Use the action's owner/repo.

OpenUSD

Not a valid GitHub Actions package name. Use the action's owner/repo.

plait-board/drawnix

Not a valid npm package name. Use the package name on npmjs.com, e.g. lodash or @scope/name.

Products.CMFPlone

Scanners compare names exactly. Change it to products-cmfplone.

2.10.2 / 2.9.19

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

pluginsGLPI/escalade

Scanners compare names exactly. Change it to pluginsglpi/escalade.

pluginsGLPI/fields

Scanners compare names exactly. Change it to pluginsglpi/fields.

none

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

␣com.powsybl:powsybl-computation-local

Scanners compare names exactly. Change it to com.powsybl:powsybl-computation-local.

ee4a754

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

>=3.9.0, <=3.9.9; 3.9.9 tested

Not a range scanners can read. Use constraints such as >= 1.0.0, < 1.2.3, one range per release line. If every version is affected and there's no fix yet, >= 0.

PrivateBin

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

ProcessMaker

Not a valid Packagist package name. Use vendor/package as on Packagist, in lower case.

>= 0

No upper bound, and the fixed field (“<= 1.6.1”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

OrcaStatLLM-Researcher

Scanners compare names exactly. Change it to orcastatllm-researcher.

>=0.24.0

No upper bound, and the fixed field (“no security support”) isn't a version. Put the first fixed version in the fixed field, or end the range with < fix.

> 3.34.0, < 3.40.1.2

Uses >, an exclusive lower bound OSV can't express. Use >= with the first affected version.