All pull requests

Pull requests

• [GHSA-gm2x-2g9h-ccm8] go-git missing validation decoding Index v4 files leads to panic

  #10533·ranjiGT opened Oct 24, 2026·

  ·
  2

• [GHSA-wxhm-2mq7-7697] Prompty: Arbitrary file read via file reference expansion

  #10532·ranjiGT opened Oct 24, 2026·

  ·
  3

• [GHSA-crwc-vw2r-qr6m] OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies

  #10531·hoeselvank-web opened Oct 24, 2026·

  ·
  1

• [GHSA-9v8h-qqgm-4m35] Brotli: Out-of-bounds write in the Brotli decoder ("Node2Shell") also affects the PyPI Brotli package

  #10530·6mile opened Oct 23, 2026·

  ·

• Add affected npm package and version range to three MCP advisories (affected: [])

  #10529·stillmarcus24 opened Oct 23, 2026·

  ·

• [GHSA-6q48-6c7w-9gw2] certifi bundles emSign root CAs with compromised intermediate CA keys

  #10528·lazgeo opened Oct 23, 2026·

  ·
  3

• [GHSA-hhxg-rvc9-8726] camaleon_cms affected by cross site scripting

  #10527·jasnow opened Oct 23, 2026·

  ·

• [GHSA-jw5g-f64p-6x78] Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

  #10526·jasnow opened Oct 23, 2026·

  ·

• [GHSA-cv5g-jv44-53r2] In JetBrains Exposed before 1.5.1 sQL injection was...

  #10525·fabrizioMicrodevice opened Oct 23, 2026·

  ·

• [GHSA-cg2g-xh64-v4q7] DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes

  #10524·cure53 opened Oct 23, 2026·

  ·
  1

• [GHSA-mrv2-3pqr-j5jr] DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)

  #10523·cure53 opened Oct 23, 2026·

  ·
  1

• [GHSA-5q2g-877c-9cwh] A missing critical step in authentication vulnerability...

  #10522·kaito-yamaguchi-assured opened Oct 23, 2026·

  ·
  1

• [GHSA-64hx-4gc9-f6v4] Buffer under-read vulnerability in Apache Tomcat meant...

  #10521·kaito-yamaguchi-assured opened Oct 23, 2026·

  ·
  1

• [GHSA-f6r2-3pj4-jmqq] Incomplete cleanup vulnerability in Apache Tomcat allowed...

  #10520·kaito-yamaguchi-assured opened Oct 23, 2026·

  ·
  1

• [GHSA-38jj-69cp-9wgc] Not Failing Securely ('Failing Open') vulnerability in...

  #10519·kaito-yamaguchi-assured opened Oct 23, 2026·

  ·
  1

• [GHSA-2464-fhr4-w9xw] Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

  #10517·yusuke-koyoshi opened Oct 23, 2026·

  ·
  3

• [GHSA-x7hc-r9m3-67vr] Improperly Controlled Modification of Dynamically...

  #10516·Rudloff opened Oct 23, 2026·

  ·

• [GHSA-9c24-g32g-35rj] Drupal PECL YAML parser unsafe object handling

  #10515·Rudloff opened Oct 23, 2026·

  ·

• [GHSA-3m36-mjwj-352c] Drupal core Cross-site Scripting (XSS) vulnerability

  #10514·Rudloff opened Oct 23, 2026·

  ·

• [GHSA-2w6h-6wr9-m5r8] Incomplete cleanup vulnerability in Apache Tomcat could...

  #10513·keita-chiba opened Oct 23, 2026·

  ·
  1

• [GHSA-2hg3-hfj5-cq2f] Execution After Redirect (EAR) vulnerability in Apache...

  #10512·keita-chiba opened Oct 23, 2026·

  ·
  1

• [GHSA-wv4g-r8pf-3wmw] Time-of-check time-of-use (TOCTOU) race condition...

  #10511·taishikitamura opened Oct 23, 2026·

  ·
  1

• [GHSA-w9r8-5j45-v8mg] Incorrect object recycling and re-use vulnerability in...

  #10510·yusuke-koyoshi opened Oct 23, 2026·

  ·
  1

• [GHSA-ggqh-85g7-w56q] Cruise Control's Jetty ConstraintSecurityHandler...

  #10509·cedricbu opened Oct 23, 2026·

  ·

• [GHSA-7pwq-q9jf-539h] kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

  #10508·ranjiGT opened Oct 23, 2026·

  ·
  4