Tagged “ghsa”
CVEs tagged ghsa, newest first.
5304 CVEsRSS
GHSA-f897-62hf-6gxqHigh· 7.5MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
CVE-2026-116683High· 7.1CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
GHSA-wf6j-7hvr-gr93High· 7.8Hydra legacy target blacklist permits unsafe PyYAML loading
Hydra legacy target blacklist permits unsafe PyYAML loading
CVE-2026-116587High· 7.5Go JOSE: DoS when parsing JWKs that contain RSA keys
Go JOSE: DoS when parsing JWKs that contain RSA keys
CVE-2026-27975Critical· 9.8Ajenti has potential Remote Code Execution
Ajenti has potential Remote Code Execution
CVE-2026-34157HighPoCWails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins
CVE-2026-33944High· 8.8Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
CVE-2026-46350Lowdcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
CVE-2026-48705Critical· 9.3MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
CVE-2026-49272High· 8.5OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
GHSA-q84f-53jg-9ppmHigh· 8.1better-auth: Device login approval does not show the requesting client or permissions
better-auth: Device login approval does not show the requesting client or permissions
GHSA-j456-xh4h-cpf2High· 8.6NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
GHSA-4g23-2xm8-66gcMedium· 5.9Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
GHSA-g73g-hqqh-jr95Medium· 5.3Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
GHSA-4ffr-jq9g-5ffxMedium· 5.9Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
GHSA-m64x-33q8-m5h7HighGitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
GHSA-w8jc-g24h-crhwHigh· 7.5GitPython command wrappers omit unsafe protocol and option checks
GitPython command wrappers omit unsafe protocol and option checks
GHSA-fx3j-rwgx-fr94Medium· 6.5GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
GHSA-gq48-pqfc-9p58MediumGitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
GHSA-f9j4-qggq-h239High· 8.1GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
GHSA-23mf-xhv8-69c2HighGitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
GHSA-hhww-mrg2-969hMedium· 6.8LiteLLM vulnerable to reflected XSS in /sso/debug/callback
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
GHSA-r4xp-prcw-77qfHigh· 7.4better-auth: OAuth Proxy lets an attacker sign in as another user
better-auth: OAuth Proxy lets an attacker sign in as another user
GHSA-44jh-23m7-hpcfLow· 3.7@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
GHSA-g5ff-637f-6q2mHigh· 8.1LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
CVE-2026-116590Medium· 5.9snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
GHSA-763v-5pjm-fx36MediumStrands Agents: Default FileSessionManager storage is world-readable on shared systems
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
GHSA-3w55-933p-8pv5High· 7.1Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
CVE-2026-116589High· 8.2Datadog dd-trace-py: IAST instrumentation can lead to application DOS
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
CVE-2026-116588High· 8.7Datadog dd-trace-py: ReDoS in URL query string obfuscation
Datadog dd-trace-py: ReDoS in URL query string obfuscation