{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"10.0.1"}],"component":"@haxtheweb/open-apis","cve_ids":["CVE-2025-48996"],"ecosystem":"npm","epss":0.00357,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fvx2-x7ff-fc56","id":"tcs_01M5KFPCSMPW1K5YMGDS5RSGNW","modified_at":"2025-06-05T01:07:47Z","published_at":"2025-06-05T01:07:47Z","references":["https://osv.dev/vulnerability/GHSA-fvx2-x7ff-fc56","https://github.com/haxtheweb/issues/security/advisories/GHSA-fvx2-x7ff-fc56","https://nvd.nist.gov/vuln/detail/CVE-2025-48996","https://github.com/haxtheweb/open-apis/commit/06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7","https://github.com/haxtheweb/issues"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-fvx2-x7ff-fc56","url":"https://osv.dev/vulnerability/GHSA-fvx2-x7ff-fc56"}],"summary":"Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint"}