Tagged “ghsa”
CVEs tagged ghsa, newest first.
5691 CVEsRSS
CVE-2026-55595Medium· 4.7ImageMagick: Infinite Loop in connected-components when providing invalid arguments
ImageMagick: Infinite Loop in connected-components when providing invalid arguments
CVE-2026-55597Medium· 5.5ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
ImageMagick: Heap Buffer Over-Write in JP2 encoder when due to incorrect handling of arguments
CVE-2026-55628Medium· 6.1ImageMagick: Policy Bypass in concatenate operation due to missing checks
ImageMagick: Policy Bypass in concatenate operation due to missing checks
GHSA-4w2j-m93h-cj5jHigh· 7.5Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
GHSA-rvhp-75f6-9jqhLow· 3.3ImageMagick: Policy Bypass possible with matrix-backed operations
ImageMagick: Policy Bypass possible with matrix-backed operations
GHSA-56m6-8q75-f2rwMedium· 4.7ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219
ImageMagick: Policy Bypass due to an incomplete fix of CVE-2026-49219
GHSA-hc76-7mpc-qjqhMedium· 5.7ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797
ImageMagick: Code injection in HTML encoder due to incomplete fix of CVE-2026-25797
GHSA-qh5g-q395-cx4jLow· 3.7ImageMagick: Heap-use-after-free via XMP profile could result in a crash
ImageMagick: Heap-use-after-free via XMP profile could result in a crash
GHSA-v3j6-27vc-7pw2Low· 3.3ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check
ImageMagick: Policy Bypass in APNG encoder and delegates due to a missing check
GHSA-vghg-5jrg-2398Low· 3.3ImageMagick: Policy Bypass in script operation due to missing checks
ImageMagick: Policy Bypass in script operation due to missing checks
GHSA-6jwg-7q3p-5fqmLow· 3.7ImageMagick: Use-After-Free when freetype initialization fails
ImageMagick: Use-After-Free when freetype initialization fails
GHSA-pp9r-ppc4-25w4High· 8.8Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
Duplicate Advisory: Grav: FlexDirectory::dynamicDataField() executes arbitrary callables from blueprint data with no validation
CVE-2026-65608High· 8.8PoCGrav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability
Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating on…
CVE-2026-14257High· 7.5brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function (CVE-2026-14257)
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) b…
CVE-2026-53467Medium· 5.3ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged
CVE-2026-53666Medium· 6.1React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration
CVE-2026-53667Medium· 6.9React Router: RSCErrorHandler Missing Protocol Validation (XSS)
React Router: RSCErrorHandler Missing Protocol Validation (XSS)
CVE-2026-53668Medium· 6.9React Router: Open redirect leading to XSS
React Router: Open redirect leading to XSS
CVE-2026-55223Mediumc3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
c3p0 can, in combination with other libraries, compose to a "sink" for deserialization gadgets
GHSA-x445-f3h2-j279Medium· 6.8Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them
GHSA-7rqj-j65f-68whCriticalAuth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass
GHSA-xmf8-cvqr-rfgjHigh· 7.5Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers
GHSA-8fpg-xm3f-6cx3CriticalAuth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)
CVE-2026-59931High· 7.7PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
CVE-2026-59932High· 7.5PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion
CVE-2026-59933High· 7.5PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
CVE-2026-65600Medium· 5.3⚖ disputedTraefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware
Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-contr…
CVE-2026-65602High· 8.8⚖ disputedTraefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references)
Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for HTTP serversTransport references). A …
CVE-2026-65601High· 8.8⚖ disputedTraefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider
Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespa…
GHSA-whvh-wf3x-g77jLowJupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)
JupyterLab: Allowlist/blocklist check in `PyPIExtensionManager.install()` not enforced for direct callers (missing `await`)