Tagged “ghsa”
CVEs tagged ghsa, newest first.
5691 CVEsRSS
CVE-2026-57294Medium· 5.4Jenkins EC2 Fleet Plugin has a missing permission check
Jenkins EC2 Fleet Plugin has a missing permission check
CVE-2026-57293Medium· 4.3Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
CVE-2026-57292Medium· 5.4Jenkins Gitee Plugin has a cross-site request forgery vulnerability
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
CVE-2026-57290Medium· 4.3Jenkins Priority Sorter Plugin has a CSRF vulnerability
Jenkins Priority Sorter Plugin has a CSRF vulnerability
CVE-2026-57289Medium· 4.8Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
Jenkins Bitbucket Push and Pull Request Plugin unconditionally disables SSL/TLS certificate validation
CVE-2026-57298Medium· 5.4Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
Jenkins Contrast Continuous Application Security Plugin has a CSRF vulnerability
CVE-2026-57291Medium· 5.4Jenkins Gitee Plugin missing permission checks
Jenkins Gitee Plugin missing permission checks
CVE-2026-57280High· 8.8Jenkins Script Security Plugin sandbox bypass vulnerability
Jenkins Script Security Plugin sandbox bypass vulnerability
CVE-2026-57281High· 7.5Jenkins Script Security Plugin has a script security bypass vulnerability
Jenkins Script Security Plugin has a script security bypass vulnerability
CVE-2026-57286Medium· 4.3Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
CVE-2026-57284Medium· 4.3Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types
Jenkins Pipeline: Groovy Plugin vulnerable to unrestricted instantiation of types
CVE-2026-57282Medium· 5.0Jenkins Git client Plugin has an OS command injection vulnerability on agents
Jenkins Git client Plugin has an OS command injection vulnerability on agents
CVE-2026-57285Medium· 4.3Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
CVE-2026-57283Medium· 4.3Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability
Jenkins Pipeline: Groovy Plugin has a CSRF vulnerability
CVE-2026-57287Medium· 4.3Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations
GHSA-jj69-4grx-fqj5Critical· 7.8Duplicate Advisory: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
Duplicate Advisory: Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses
CVE-2026-56370Low· 3.3ImageMagick - Out-of-bounds Access in ConnectedComponentsImage via connected-components Artifact
ImageMagick before 7.1.2-19 contains an out-of-bounds access vulnerability in ConnectedComponentsImage() when processing connected-components artifacts with invalid indices. Attackers can trigger access violations by specifying malformed…
CVE-2026-56121Critical· 9.8PoCFeast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server
Feast before 0.63.0 contains an unsafe deserialization vulnerability that allows unauthenticated or unauthorized attackers to achieve remote code execution by sending a crafted gRPC request to the registry server. The user_defined_functi…
CVE-2026-57299Medium· 4.3Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.
Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.
CVE-2026-57297Medium· 4.3A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, a…
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, a…
CVE-2026-12537High· 7.8⚖ disputedImproper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker …
Improper Neutralization used in an OS Command in the container launcher in Google Gemini CLI (versions prior to 0.39.1) and run-gemini-cli GitHub Action (versions prior to 0.1.22) on headless CI platforms allows an unprivileged attacker …
CVE-2025-64719Medium· 4.9Gogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files …
CVE-2026-52804Medium· 5.5Gogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. This vu…
CVE-2026-52805High· 8.7Gogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, bu…
CVE-2026-52809Medium· 6.8PoCGogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation lifetime), not conf.Auth.ResetPasswordCodeLives. The token lifetime is baked i…
CVE-2026-52811Critical· 9.0Gogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.IsSymlink(targetPath)). The siblings UpdateRepoFile, DeleteRepoFile, and GetDif…
CVE-2026-48708High· 7.5OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination
OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination
CVE-2026-48709Low· 3.7OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration
OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration
GHSA-98gv-6gmj-cm6mLowDuplicate Advisory: ImageMagick: Memory leak in coders/txt.c without freetype
Duplicate Advisory: ImageMagick: Memory leak in coders/txt.c without freetype
GHSA-8g9f-ccmr-vfvgMedium· 3.7Duplicate Advisory: ImageMagick has a possible heap Use After Free vulnerability in its meta coder
Duplicate Advisory: ImageMagick has a possible heap Use After Free vulnerability in its meta coder