Tagged “ghsa”
CVEs tagged ghsa, newest first.
5692 CVEsRSS
CVE-2026-69192High· 8.6ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, an…
GHSA-3f7w-8rr8-f37fHigh· 8.1GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
GHSA-539m-9xh6-q6rrMedium· 6.5GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
GHSA-p538-c434-8v24Medium· 5.4GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
CVE-2026-69185High· 7.5Socket.IO enables bidirectional and low-latency communication for every platform
Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, w…
CVE-2026-16728Medium· 4.8undici vulnerable to downstream response desynchronization via retry interceptor
undici vulnerable to downstream response desynchronization via retry interceptor
CVE-2026-69152High· 7.5brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152)
A flaw was found in the brace-expansion library. The `expand()` function does not apply `maxLength` when constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block …
CVE-2026-69153High· 7.5postcss: PostCSS: Information disclosure via crafted sourceMappingURL (CVE-2026-69153)
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and exp…
CVE-2026-68930Medium· 6.5Russh is a Rust SSH client & server library
Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, server_read_authenticated, an…
CVE-2026-68945High· 8.2@angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache (CVE-2026-68945)
A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically dif…
CVE-2026-69149HighAngular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)
CVE-2026-69151HighAngular i18n: Cross-Site Scripting (XSS) via event-handler attributes
Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes
CVE-2026-8763High· 7.4In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI
In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.…
CVE-2026-48031Critical· 9.1go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL
go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded to the known string "random", letting any attacker who reads the public …
CVE-2026-48061Medium· 5.9Litestar is an Asynchronous Server Gateway Interface (ASGI) framework
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whiteli…
CVE-2026-48063CriticalBaileys is a cocket-based TS/JavaScript API for WhatsApp Web
Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event…
CVE-2026-48113HighChisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH
Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The …
GHSA-9jrx-vmh8-c6xwHigh· 8.1Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
GHSA-p4r4-8cxw-pjx7Critical· 6.5Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2026-68582Medium· 6.5PoCVikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks)
Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the requested project view f…
CVE-2026-68581High· 8.1Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management
Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID() interface, a lin…
GHSA-6r2r-ww24-7h52High· 8.8Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
Duplicate Advisory: GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist
GHSA-3mcp-22mf-vrw3Medium· 7.5Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken
Duplicate Advisory: Axios form serializer maxDepth bypass via {} metatoken
GHSA-m4f3-g4cq-hqrxHigh· 7.5Duplicate Advisory: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
Duplicate Advisory: GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
GHSA-cw2r-r7mw-j3hcCritical· 9.8Duplicate Advisory: GitPython unsafe clone option gate bypass through joined short options
Duplicate Advisory: GitPython unsafe clone option gate bypass through joined short options
GHSA-4vpg-pfj8-m33qHigh· 8.4Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
GHSA-32rq-jhr7-m3hhMedium· 5.3Duplicate Advisory: Guzzle: Proxy-Authorization headers can be sent to origin servers
Duplicate Advisory: Guzzle: Proxy-Authorization headers can be sent to origin servers
GHSA-3fvr-2jw6-crq4Medium· 5.3Duplicate Advisory: Guzzle: Unbounded response cookies risk denial of service
Duplicate Advisory: Guzzle: Unbounded response cookies risk denial of service
GHSA-mqq9-gxg5-m58gHigh· 5.9Duplicate Advisory: Guzzle: URI fragments disclosed in redirect Referer headers
Duplicate Advisory: Guzzle: URI fragments disclosed in redirect Referer headers
GHSA-mjrx-74jh-7xgwHigh· 5.9Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved
Duplicate Advisory: Guzzle: Host-only cookie scope is not preserved