Tagged “ghsa”
CVEs tagged ghsa, newest first.
5692 CVEsRSS
CVE-2026-10720MediumCanonical MicroCeph: path traversal issue in the remote-import AP
Canonical MicroCeph: path traversal issue in the remote-import AP
CVE-2026-12644Medium· 5.3ts-deepmerge: Prototype Method Override leads to DoS
ts-deepmerge: Prototype Method Override leads to DoS
CVE-2026-48814Critical· 9.1Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
Network-AI: CVE-2026-46701 fix incomplete — empty default secret still authorizes all requests
CVE-2026-54051Critical· 9.9Network-AI: Improper Neutralization of Special Elements used in an OS Command
Network-AI: Improper Neutralization of Special Elements used in an OS Command
CVE-2026-55882HighTilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
Tilt: Unauthenticated pprof debug endpoints on the Tilt HUD server
CVE-2026-55883HighTilt: Cross-site WebSocket hijacking of the Tilt HUD stream
Tilt: Cross-site WebSocket hijacking of the Tilt HUD stream
CVE-2026-55884CriticalTilt: Missing authentication on the network-exposed Tilt HUD server
Tilt: Missing authentication on the network-exposed Tilt HUD server
CVE-2026-55568Medium· 5.9guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext
CVE-2026-12151High· 7.5undici WebSocket client vulnerable to denial of service via fragment count bypass
undici WebSocket client vulnerable to denial of service via fragment count bypass
CVE-2026-55689Medium· 6.8OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
OpenFGA: OIDC audience validation skipped when --authn-oidc-audience is unset
CVE-2026-55766Medium· 4.8guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
guzzlehttp/psr7: CRLF Injection in HTTP Start-Line Serialization
CVE-2026-55767Medium· 5.8guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
guzzlehttp/guzzle: Dot-Only Cookie Domains Match All Hosts
CVE-2026-55772High· 8.8CedarJava has type confusion vulnerability
CedarJava has type confusion vulnerability
CVE-2026-55773High· 8.8CedarJava has policy injection vulnerability
CedarJava has policy injection vulnerability
CVE-2026-12530High· 7.3Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
GHSA-cgxm-vr2f-6fj8Highparse-server: Denial of service via exponential-time processing of deeply nested query operators
parse-server: Denial of service via exponential-time processing of deeply nested query operators
GHSA-2h46-9x5w-4wf7MediumEntire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind
Entire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewind
GHSA-wg5p-8h9p-3mr7High· 8.6agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
GHSA-c2g3-c4gc-w5wgHighReDoS in DotVVM routing
ReDoS in DotVVM routing
GHSA-c8qj-jx8j-fg2wCriticalDotVVM: Missing authorization in AuthorizeActionFilter
DotVVM: Missing authorization in AuthorizeActionFilter
GHSA-2rm3-333w-xvc4Medium· 5.3DotVVM: Unrestricted file upload
DotVVM: Unrestricted file upload
GHSA-vmhf-c436-hxj4MediumJupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
GHSA-jv2h-4p9v-wf5wHighouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
GHSA-vcv2-r9jh-99m5High· 8.8Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
Agentic-Flow: OS Command Injection in agentic-flow MCP server tools via unsanitized tool-parameter interpolation into execSync
GHSA-q7j3-v8qv-22vqHigh· 7.5OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL
GHSA-5v8h-3h3q-446pLowNokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception
GHSA-8678-w3jw-xfc2Low· 2.6Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
Nokogiri: XML::Schema on JRuby allows network requests when NONET is set, bypassing CVE-2020-26247
GHSA-9cv2-cfxc-v4v2LowNokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
Nokogiri: Null Pointer Dereference calling methods on uninitialized wrapper classes
GHSA-5prr-v3j2-97mhMediumNokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`
Nokogiri: Possible Out-of-Bounds Read in `Nokogiri::XML::NodeSet#[]`
GHSA-wjv4-x9w8-wm3hLowNokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type
Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type