Tagged “ghsa”
CVEs tagged ghsa, newest first.
5692 CVEsRSS
GHSA-p5rm-jg5c-8c77MediumMicrosoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
Microsoft Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
GHSA-53g2-mvcc-q9x3Medium· 4.6Trix: Stored XSS via HTMLParser attribute injection on paste
Trix: Stored XSS via HTMLParser attribute injection on paste
CVE-2026-61632Medium· 5.3PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path
CVE-2026-62343Medium· 4.7ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
ImageMagick: Heap Buffer Over-Write in morphology operation when an invalid kernel is provided
CVE-2026-62363Medium· 5.0ImageMagick: Heap Buffer Over-Write in fx operation
ImageMagick: Heap Buffer Over-Write in fx operation
CVE-2026-62946Medium· 5.1ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds
GHSA-38hq-7x33-php4Medium· 4.7@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
GHSA-7gfh-x38p-prh3Critical· 9.8Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)
GHSA-3rp5-jjmw-4wv2High· 7.0GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)
GHSA-664h-wqgq-64gwMedium· 6.5Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
GHSA-w28w-gp39-m4p6Critical· 10.0Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
GHSA-r28c-9q8g-f849High· 7.5PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure
GHSA-r292-9mhp-454mMedium· 5.3node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
node-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
GHSA-qvxh-prvr-85w2Low· 3.7ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails
ImageMagick: Use-After-Free in FormatMagickCaption when memory allocation fails
GHSA-hwf3-r46v-5ggxLow· 2.9ImageMagick: Information Disclosure when printing profiles with debug enabled
ImageMagick: Information Disclosure when printing profiles with debug enabled
GHSA-6vxp-gfwf-hcr9Low· 2.9ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.
ImageMagick: Memory Leak in TIFF encoder when a temporary file could not be created.
GHSA-7c7m-fpjw-gwcqLow· 2.9ImageMagick: Memory Leak in color transformation to log colorspace when operation fails
ImageMagick: Memory Leak in color transformation to log colorspace when operation fails
GHSA-j8rh-v2r8-v94xLow· 2.9ImageMagick: Memory Leak in hough lines operation when an operation fails
ImageMagick: Memory Leak in hough lines operation when an operation fails
GHSA-99w9-hv66-rfv7Low· 2.9ImageMagick: Memory Leak in JNG encoder when a blob could not be opened
ImageMagick: Memory Leak in JNG encoder when a blob could not be opened
GHSA-jfq9-q63x-rc63Low· 2.9ImageMagick: Memory Leak in TIFF encoder when an allocation fails
ImageMagick: Memory Leak in TIFF encoder when an allocation fails
GHSA-h7f2-f9cc-h2gvLow· 3.7ImageMagick: Memory Leak in YUV decoder when opening of blob fails
ImageMagick: Memory Leak in YUV decoder when opening of blob fails
GHSA-r628-69v2-2f9cLow· 2.9ImageMagick: Memory Leak in MIFF encoder when allocaton fails
ImageMagick: Memory Leak in MIFF encoder when allocaton fails
GHSA-m596-67p7-69whLow· 2.9ImageMagick: Memory leak in VIFF encoder when allocation fails
ImageMagick: Memory leak in VIFF encoder when allocation fails
GHSA-h58x-r7f7-rh84Low· 3.7ImageMagick: Memory Leak in ICON decoder when allocation fails
ImageMagick: Memory Leak in ICON decoder when allocation fails
GHSA-h5r4-w88w-7ccrLow· 2.5ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified
ImageMagick: Memory Leak in TIFF encoder when invalid tiff:tile-geometry is specified
CVE-2026-54672High· 7.8electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`
CVE-2026-54673Highelectron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`
CVE-2026-55510Medium· 5.5ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
ImageMagick: Use-After-Free in crafted 8BIM when identifying an image
CVE-2026-55575HighLiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
CVE-2026-55594Medium· 5.3ImageMagick: Stack Overflow in MVG decoder due to missing depth check.
ImageMagick: Stack Overflow in MVG decoder due to missing depth check.