Tagged “ghsa”
CVEs tagged ghsa, newest first.
5685 CVEsRSS
GHSA-3hc7-r24j-rpwcMediumVikunja: Cross-project task disclosure through subtask expansion
Vikunja: Cross-project task disclosure through subtask expansion
GHSA-w2ch-4xgr-22wwLowVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
CVE-2026-108258Medium· 6.9Shiny for Python is a framework for building interactive web applications in Python
Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validati…
CVE-2026-108261Critical· 9.3PoCTina is a headless content management system
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin ifra…
CVE-2026-108260High· 7.6PoCTina is a headless content management system
Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/@tinacms/web-components/src/tina-markdown.js assigns a rich-text node.url value directly to an anchor href without validating the URL sch…
CVE-2026-108259High· 8.2PoCTina is a headless content management system
Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript…
GHSA-fprf-r6rv-xg99Medium· 5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
GHSA-4hv6-xc92-j86gMedium· 6.5Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes
GHSA-pjr3-86v4-5p7wMedium· 5.4Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
GHSA-hjx8-qv73-f7cmMedium· 6.5Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
GHSA-fmmf-xq98-g327MediumVikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
GHSA-m687-p538-r5hpHighVikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted
CVE-2026-107845Critical· 9.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comm…
CVE-2026-107844Medium· 5.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled {path} parameter to the configured image target directory with Path::join() but does not use Path::isBasePath() to verif…
CVE-2026-107843Medium· 5.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile() enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORM_SUBMIT or th…
CVE-2026-107842Medium· 5.3Contao is an Open Source CMS
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from …
CVE-2026-107841Medium· 5.7pacioli provides least-privilege governance and a governed agent broker for ERPNext
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent establi…
CVE-2026-107840High· 7.5yopass is a service for securely sharing secrets, passwords, and files
yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the Prometheus metrics middleware in pkg/server/server.go uses the attacker-controlled r.Method value directly as the method label for yopas…
CVE-2026-107839High· 7.5PoCageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games
ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Age of Empires and Age of Mythology games. Prior to version 1.15.2, the AoE3 POST /game/cloud/getFileURL handler in the bundled game server…
GHSA-p3pr-8f3m-4qp8Medium· 6.4pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
GHSA-fr26-jjhm-638cHighpyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
GHSA-jq7h-wrvp-3rgxHigh· 7.5pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
GHSA-889w-m37p-88m5High· 7.5pyLoad: Api.set_user_permission never invalidates the target's session
pyLoad: Api.set_user_permission never invalidates the target's session
GHSA-9q47-3cm2-2rp8MediumpyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
GHSA-68w4-83fh-f2w8High· 8.1pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
CVE-2026-107825Medium· 4.0PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazawaf/transaction.go handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUER…
CVE-2026-107834Medium· 5.3OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close() for every uploaded file part, so each te…
CVE-2026-107833Medium· 5.9PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recur…
CVE-2026-107826High· 7.5PoCOWASP Coraza WAF is a golang modsecurity compatible web application firewall library
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyprocessors/json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte b…
CVE-2026-48484Medium· 6.5PoCpyLoad is a free and open-source download manager written in Python
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` handles `multipart/form-data` uploads by reading the whole content of the uploaded file into memor…