Tagged “ghsa”
CVEs tagged ghsa, newest first.
5758 CVEsRSS
CVE-2025-58367CriticalDeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
CVE-2025-9784High· 7.5PoCA flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive serv…
CVE-2025-58048Critical· 9.9Paymenter is a free and open-source webshop solution for hostings
Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive…
CVE-2025-54951Critical· 9.8ExecuTorch vulnerable to Heap-based Buffer Overflow
ExecuTorch vulnerable to Heap-based Buffer Overflow
CVE-2025-54949Critical· 9.8ExecuTorch heap buffer overflow vulnerability
ExecuTorch heap buffer overflow vulnerability
CVE-2025-54950Critical· 9.8ExecuTorch out-of-bounds access vulnerability
ExecuTorch out-of-bounds access vulnerability
CVE-2025-30405Critical· 9.8ExecuTorch integer overflow vulnerability
ExecuTorch integer overflow vulnerability
CVE-2025-30404Critical· 9.8ExecuTorch integer overflow vulnerability
ExecuTorch integer overflow vulnerability
CVE-2025-54381Critical· 9.9PoCBentoML SSRF Vulnerability in File Upload Processing
BentoML SSRF Vulnerability in File Upload Processing
CVE-2025-49015Medium· 4.9Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates
Couchbase .NET SDK (client library) does not properly enable hostname verification for TLS certificates
CVE-2025-49652Critical· 9.8PoCMissing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
CVE-2024-47081Medium· 5.3Requests vulnerable to .netrc credentials leak via malicious URLs
Requests vulnerable to .netrc credentials leak via malicious URLs
CVE-2025-1750Critical· 9.8LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
CVE-2025-1647Medium· 5.6PoCImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bootstrap allows Cross-Site Scripting (XSS).This issue affects Bootstrap: from 3.4.1 before 4.0.0.
CVE-2025-47241Critical· 9.3Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL
Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL
CVE-2025-43859Critical· 9.1h11 accepts some malformed Chunked-Encoding bodies
h11 accepts some malformed Chunked-Encoding bodies
CVE-2025-32388Medium· 5.4@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
CVE-2025-32428CriticalTigerVNC accessible via the network and not just via a UNIX socket as intended
TigerVNC accessible via the network and not just via a UNIX socket as intended
CVE-2024-52980Medium· 6.5Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function
Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function
CVE-2025-3248Critical· 9.8CISA KEVPoCLangflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.
CVE-2025-27520Critical· 9.8PoCBentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization
CVE-2024-10553Critical· 9.8H2O Deserialization of Untrusted Data Vulnerability
H2O Deserialization of Untrusted Data Vulnerability
CVE-2024-11042Critical· 9.1PoCInvokeAI Arbitrary File Deletion vulnerability
InvokeAI Arbitrary File Deletion vulnerability
CVE-2024-10190Critical· 9.8Horovod Vulnerable to Command Injection
Horovod Vulnerable to Command Injection
CVE-2024-10902Critical· 9.1DB-GPT vulnerable to Arbitrary File Upload with Path Traversal
DB-GPT vulnerable to Arbitrary File Upload with Path Traversal
CVE-2024-10831Critical· 9.1DB-GPT Absolute Path Traversal vulnerability
DB-GPT Absolute Path Traversal vulnerability
CVE-2024-10833Critical· 9.1DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload
DB-GPT Absolute Path Traversal in knowledge/{space_name}/document/upload
CVE-2024-10901Critical· 9.1DB-GPT Arbitrary File Write vulnerability
DB-GPT Arbitrary File Write vulnerability
CVE-2024-10835Critical· 9.1DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users
DB-GPT is vulnerable to SQL Injection attacks from unauthenticated users
CVE-2024-8537Critical· 9.1AgentScope path traversal vulnerability
AgentScope path traversal vulnerability