Tagged “ghsa”
CVEs tagged ghsa, newest first.
5691 CVEsRSS
CVE-2026-53669Medium· 5.4react-router: React Router: Open Redirect vulnerability via backslashes in navigation components (CVE-2026-53669)
A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the <Link> or useNavigate components. This could lead …
CVE-2026-45623High· 7.5postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can l…
CVE-2026-64648High· 7.5next: Next.js: Information disclosure via server-side fetch cache (CVE-2026-64648)
A flaw was found in Next.js. A remote attacker could exploit a vulnerability in the server-side fetch mechanism, where a request with a body might receive a cached response intended for a different request to the same URL but different bod…
CVE-2026-64649High· 8.2next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions (CVE-2026-64649)
A flaw was found in Next.js, a framework for building web applications. A remote attacker can exploit this vulnerability by manipulating Host-associated headers when a Server Action forwards or redirects a request. This can lead to Server-…
CVE-2026-64641High· 7.5next: Next.js: Denial of Service via crafted requests to App Router with Server Actions (CVE-2026-64641)
A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usa…
CVE-2026-64642High· 8.2next: Next.js: Authentication bypass leading to unauthorized access (CVE-2026-64642)
A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerabi…
CVE-2026-64645High· 8.2next: Next.js: Server-Side Request Forgery vulnerability (CVE-2026-64645)
A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) or Open Redirect attacks. When a `rewrites()` or `redirects()` rule con…
CVE-2026-64646High· 7.5next: Next.js: Denial of Service via excessive memory consumption in Server Actions (CVE-2026-64646)
A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a…
GHSA-jxrp-r7gx-q4j8Medium· 6.1Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
CVE-2026-66004Medium· 5.3BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes
BlenderMCP path traversal in download_polyhaven_asset allows arbitrary file writes
CVE-2026-66010Medium· 6.1PoCdompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass (CVE-2026-66010)
A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cr…
CVE-2026-66007Medium· 6.5PoCdatasets: Datasets: Information disclosure via path traversal vulnerability (CVE-2026-66007)
A flaw was found in datasets. This path traversal vulnerability allows a remote attacker to read arbitrary local files. By providing specially crafted file names in the metadata, an attacker can trick the system into including sensitive lo…
GHSA-jpcw-4wr7-c3vqMedium· 5.3kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
GHSA-8q49-2h5h-434xMedium· 5.9FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
GHSA-6vch-q96h-7gc3Highetcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
GHSA-pvcr-8mvp-w8qrHigh· 7.7Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
GHSA-cr7p-cr3q-h5cmMedium· 5.3Budibase: Account Enumeration via Login Lockout Response Differential
Budibase: Account Enumeration via Login Lockout Response Differential
GHSA-pmpg-2mxq-6xwrHigh· 7.1Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
GHSA-v42f-v8xc-j435High· 8.5Budibase: SSRF via DNS rebinding in the REST datasource integration
Budibase: SSRF via DNS rebinding in the REST datasource integration
GHSA-hfhx-w8p8-4hc7MediumBudibase: SSRF via bare fetch() in uploadUrl during AI table generation
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
GHSA-94p4-4cq8-9g67High· 7.5GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
GHSA-g3hq-hphg-8fhhHigh· 8.8Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
GHSA-68r5-9hpg-7qw9Critical· 9.4OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
GHSA-p279-2cqp-84jgCritical· 9.6OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
GHSA-c534-2w9c-x7fmMedium· 6.5Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources
Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources
GHSA-g5vv-q72c-7j78High· 7.5@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
GHSA-26gq-p25f-99cpHighfrp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow
GHSA-f45q-w629-wr25MediumHubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
GHSA-qqc3-94qv-7fw3MediumHubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
GHSA-2625-rw7m-5q5xLowHubuum client library (Rust): Sensitive data may be exposed through default diagnostics
Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics