update core index.json (#1499)

* vuln: update core index.json

* vuln: update core index.json

* vuln: update core index.json

* vuln: update core index.json

---------

Co-authored-by: Create or Update Pull Request Action <[email protected]>
Co-authored-by: Rafael Gonzaga <[email protected]>

Author: 3 people

vuln/core/index.json

@@ -1883,7 +1883,7 @@
   },
   "141": {
     "cve": [
-      "CVE-2024-27982"
+      "CVE-2024-27980"
     ],
     "vulnerable": "18.x || 20.x || 21.x",
     "patched": "^18.20.2 || ^20.12.2 || ^21.7.3",
@@ -2061,5 +2061,33 @@
       "all"
     ],
     "severity": "medium"
+  },
+  "154": {
+    "cve": [
+      "CVE-2025-27210"
+    ],
+    "vulnerable": "20.x || 22.x || 24.x",
+    "patched": "^20.19.4 || ^22.17.1 || ^24.4.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/",
+    "description": "Windows Device Names (CON, PRN, AUX) Bypass Path Traversal Protection in path.normalize()",
+    "overview": "An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX. \n\nThis vulnerability affects Windows users of `path.join` API.",
+    "affectedEnvironments": [
+      "win32"
+    ],
+    "severity": "high"
+  },
+  "155": {
+    "cve": [
+      "CVE-2025-27209"
+    ],
+    "vulnerable": "24.x",
+    "patched": "^24.4.1",
+    "ref": "https://nodejs.org/en/blog/vulnerability/july-2025-security-releases/",
+    "description": "HashDoS in V8",
+    "overview": "The V8 release used in Node.js v24.0.0 has changed how string hashes are computed using rapidhash. This implementation re-introduces the HashDoS vulnerability as an attacker who can control the strings to be hashed can generate many hash collisions - an attacker can generate collisions even without knowing the hash-seed.\n\n* This vulnerability affects Node.js v24.x users.",
+    "affectedEnvironments": [
+      "all"
+    ],
+    "severity": "high"
   }
 }