Tagged “ghsa”
CVEs tagged ghsa, newest first.
5663 CVEsRSS
CVE-2026-113670Medium· 5.3ApostropheCMS: Page REST API authorization bypass
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the core page REST API reads full page documents with .permission(false) in getOne and in the all=1 tree dump, bypassing page-type viewRole, visibility: …
CVE-2026-113648Low· 3.1ApostropheCMS: Missing Authentication in `cleanExport` Route
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication a…
CVE-2026-113651Low· 3.3PoCApostropheCMS: Path traversal in uploadfs
ApostropheCMS: Path traversal in uploadfs
CVE-2026-113650Medium· 5.3PoCApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)
ApostropheCMS is an open-source Node.js content management system. In sanitize-html 2.18.0, when an <iframe> is not allowed and disallowedTagsMode is 'discard' (the defaults), its raw-text content is re-sanitized by a recursive call to s…
CVE-2026-113652Medium· 5.6ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment URL. When uploadfs is configured with the Azure backend and sa…
CVE-2026-113655Medium· 4.3PoCApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
CVE-2026-113654Medium· 5.3PoCApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Prior to sanitize-html 2.18.0, a non-default nonTextTags configuration that includes noscript can end…
CVE-2026-113649Medium· 6.5ApostropheCMS: Import API bypasses publication roles for protected content
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can …
CVE-2026-113657Low· 3.7PoCApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
CVE-2026-113656Medium· 5.3ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS
ApostropheCMS is an open-source Node.js content management system. Prior to 1.5.5 of the ApostropheCMS Form add-on, its form submission route stages unbounded multipart uploads before form validation or authentication and lacks upload si…
CVE-2026-113658High· 7.5PoCApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not…
CVE-2026-113653Medium· 6.9ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
CVE-2026-112945Low· 2.1PoCVite: Cross origin script execution through Vite custom middleware
Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtm…
CVE-2026-111763Medium· 5.7A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to forward a configured API key to a third-party server. When …
CVE-2026-111764High· 7.5PoCA2A Java SDK has a fail-open default task authorization
A2A Java SDK has a fail-open default task authorization
CVE-2026-111765High· 7.5PoCA2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in Android…
CVE-2026-112949Medium· 4.7PoCVitest: Code injection via unauthenticated manual mock registration
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can r…
CVE-2026-112950Medium· 5.9PoCVitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/i…
CVE-2026-112954Medium· 5.3PoCApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API
ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort orde…
CVE-2026-112955Medium· 6.5ApostropheCMS: Import archives can exhaust server storage and deny service
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can submit archives whose decompressed bytes, entry count, and entry sizes are not bounded before do…
CVE-2026-112942High· 7.5launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middleware processes an attacker-controlled Windows file argument where the file argument ends in a parent-directory compon…
CVE-2026-112943Medium· 6.3launch-editor: escapeCmdArgs() omits % escaping on Windows
launch-editor: escapeCmdArgs() omits % escaping on Windows
CVE-2026-111762Medium· 5.7A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in `transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java` logs the entire JSO…
CVE-2026-111761Medium· 5.8PoCA2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme r…
CVE-2026-112944Medium· 6.3launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
CVE-2026-112895High· 7.5Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-112897High· 7.5PoCPillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-112896High· 7.1PoCPillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112400High· 7.5PoCPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112403Critical· 9.8PoCPillow: Heap buffer overflow in ImagingJpegDecode
Pillow: Heap buffer overflow in ImagingJpegDecode