Tagged “ghsa”
CVEs tagged ghsa, newest first.
5757 CVEsRSS
CVE-2026-41894HighSiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)
SiYuan: Path Traversal via Double URL Encoding in `/export/` Endpoint (Incomplete Fix Bypass for CVE-2026-30869)
CVE-2026-33471Critical· 9.6nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation
CVE-2026-33626High· 7.5PoCLMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
LMDeploy has Server-Side Request Forgery (SSRF) via Vision-Language Image Loading
CVE-2026-40895High· 7.5follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects…
CVE-2026-41242Critical· 9.8PoCprotobufjs compiles protobuf definitions into JavaScript (JS) functions
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1, 7.5.5, and 6.11.6, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during obje…
CVE-2026-56275Medium· 7.1Flowise Execute Flow function has an SSRF vulnerability
Flowise Execute Flow function has an SSRF vulnerability
CVE-2026-40176High· 7.8PoCComposer is vulnerable to Command Injection via Malicious Perforce Repository
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supp…
CVE-2026-5598High· 7.5Covert timing channel vulnerability in Legion of the Bouncy Castle Inc
Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue affects BC-JAVA: from 1.71 before 1.80.2, f…
CVE-2026-21727Low· 3.3A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records
A cross-tenant isolation vulnerability was found in Grafana’s Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user wi…
CVE-2026-0636Medium· 6.5Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc
Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (prov modules). This vulnerability is associated with program files LDAPStoreH…
CVE-2025-14813High· 7.5: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc
: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability is associated with program files G3413CTRBlockCipher. This issue affects B…
CVE-2025-54550High· 8.1The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution o…
The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution o…
CVE-2026-125114High· 8.3Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection
CVE-2026-40576Critical· 9.4excel-mcp-server has a Path Traversal issue
excel-mcp-server has a Path Traversal issue
CVE-2026-37980Medium· 6.9Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
CVE-2026-32203High· 7.5.NET and Visual Studio Denial of Service Vulnerability
Stack-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to deny service over a network.
CVE-2026-40179Medium· 6.1PoCPrometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
Prometheus has Stored XSS via metric names and label values in Prometheus web UI tooltips and metrics explorer
CVE-2026-5059Critical· 9.80dayPoCaws-mcp has a Command Injection Remote Code Execution Vulnerability
aws-mcp has a Command Injection Remote Code Execution Vulnerability
CVE-2026-125113Medium· 5.3xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
xrootd has path traversal in directory listing that allows access to the parent directory via trailing ".." pattern
CVE-2026-40111CriticalPraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
CVE-2026-40258Critical· 9.1gramps-webapi: Zip Slip Path Traversal in Media Archive Import
gramps-webapi: Zip Slip Path Traversal in Media Archive Import
CVE-2026-34479MediumApache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
CVE-2026-114110Low· 5.3uv vulnerable to arbitrary file deletion through RECORD entries
uv vulnerable to arbitrary file deletion through RECORD entries
CVE-2026-40113High· 8.4PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
PraisonAI Vulnerable to Argument Injection into Cloud Run Environment Variables via Unsanitized Comma in gcloud --set-env-vars
CVE-2026-39922Medium· 6.3GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network reques…
GeoNode versions 4.4.5 and 5.0.2 (and prior within their respective releases) contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to trigger outbound network reques…
CVE-2025-57735Critical· 9.1When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation …
CVE-2026-35581High· 7.2Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
Emissary has a Command Injection via PLACE_NAME Configuration in Executrix
CVE-2026-56762Medium· 5.3Hono missing validation of cookie name on write path in setCookie()
Hono missing validation of cookie name on write path in setCookie()
CVE-2026-40071Medium· 5.4pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
CVE-2026-39892Critical· 9.8⚖ disputedcryptography is a package designed to expose cryptographic primitives and recipes to Python developers
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this …