Tagged “ghsa”
CVEs tagged ghsa, newest first.
5662 CVEsRSS
CVE-2026-115778High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer
CVE-2026-115776High· 7.5Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and appl…
CVE-2026-115569Low· 3.3Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcar…
CVE-2026-115570High· 7.4Electron: Mitigation for compromised eMudhra intermediate certificates
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromi…
GHSA-xp3q-r38w-vgqmMedium· 5.8SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
CVE-2026-73049Medium· 5.8SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier docu…
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
CVE-2026-73630Medium· 5.8SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth co…
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
CVE-2026-115567Medium· 5.8Tokio: Race condition in `tokio::time::Interval`
Tokio is a runtime for writing applications with Rust. In 1.54.0, a race condition between tokio::time::Interval::poll_tick (including .tick().await) and the multi-threaded runtime's time driver could drop an internal timer entry without…
CVE-2026-106763High· 7.5An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.
An issue in @justice8096/sagemath-mcp-server 1.0.1 allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions.
CVE-2026-106765High· 7.5An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
CVE-2026-106764High· 7.5@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function
@rog0x/mcp-git-tools executes arbitrary code via the resolveBaseBranch function
CVE-2026-115478High· 7.1obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLi…
CVE-2026-115477High· 7.1PoCobsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form`…
CVE-2026-115730Low· 3.1PoCi18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protoco…
CVE-2026-113872High· 7.5PoCmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-111181High· 7.5body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
CVE-2026-114508Medium· 6.5Laravel relationship inclusion can trigger unauthorized data destruction
Laravel relationship inclusion can trigger unauthorized data destruction
CVE-2026-114437Medium· 4.8PoCchi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For
CVE-2026-114060Low· 4.7SvelteKit: URL redirection to untrusted site via enhanced form submission
SvelteKit: URL redirection to untrusted site via enhanced form submission
CVE-2026-114050Medium· 6.5vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine
CVE-2026-113713Medium· 4.4PoCvirtualenv: Temporary app-data can leave dangling seed package links
virtualenv: Temporary app-data can leave dangling seed package links
CVE-2026-113714Low· 2.3PoCvirtualenv: Downloaded wheel selection and caching precede verification
virtualenv: Downloaded wheel selection and caching precede verification
CVE-2026-113717Low· 2.3PoCvirtualenv: Pip seeding with download omits wheel digest verification
virtualenv: Pip seeding with download omits wheel digest verification
CVE-2026-113719Medium· 4.5PoCvirtualenv: Seed replacement does not contain metadata deletion paths
virtualenv: Seed replacement does not contain metadata deletion paths
CVE-2026-113715Low· 2.0PoCvirtualenv: Venv configuration readback can reinterpret path boundaries
virtualenv: Venv configuration readback can reinterpret path boundaries
CVE-2026-113720Medium· 4.4virtualenv: Seeded files retain permissions from an older cache
virtualenv: Seeded files retain permissions from an older cache
CVE-2026-113718High· 7.1PoCvirtualenv: Xonsh activation literals depend on the script decoding codec
virtualenv: Xonsh activation literals depend on the script decoding codec
CVE-2026-113723High· 7.1PoCvirtualenv: Bash prompt values can change meaning under older compatibility modes
virtualenv: Bash prompt values can change meaning under older compatibility modes
CVE-2026-112906Medium· 4.7PoCfilelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
CVE-2026-112914Medium· 5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the…
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory