Tagged “ghsa”
CVEs tagged ghsa, newest first.
5687 CVEsRSS
CVE-2026-105799Low· 2.3LangChain is a framework for building LLM-powered applications
LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values in structured RediSearch TAG filters and structured RediSearch TEXT filters, allowing injected Re…
CVE-2026-105800Low· 3.7PoCi18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that beg…
CVE-2026-105801High· 8.4openapi-python-client generates Python clients from OpenAPI documents
openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious OpenAPI document content before rendering string, docstring, and f-string contexts in generated Py…
GHSA-j8f7-x8jm-wmm4MediumLangflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assist…
Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home Assistant, Glean, Docling)
CVE-2026-10561Critical· 9.9Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation
GHSA-f4ch-vxwc-3p2mMedium· 4.3Duplicate Advisory: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
Duplicate Advisory: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)
GHSA-wq5f-xc86-pv6wHighsharp : Vulnerability in librsvg dependency CVE-2026-96889
sharp : Vulnerability in librsvg dependency CVE-2026-96889
CVE-2026-105782High· 7.5Scrapy is a high-level web crawling and scraping framework for Python
Scrapy is a high-level web crawling and scraping framework for Python. From 1.4.0 until 2.14.2, RefererMiddleware in scrapy/spidermiddlewares/referer.py treated a Referrer-Policy response-header value that resembled a Python import path …
GHSA-r4xh-jqrq-34v2Medium· 5.3smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key line
GHSA-6688-9rhm-gjv2LowDOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executes
GHSA-v853-p72q-4cfwHigh· 7.5Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__
GHSA-g2v6-rqmx-r4w6High· 7.2@vue/server-renderer: XSS via missing CR in attribute-name blacklist
@vue/server-renderer: XSS via missing CR in attribute-name blacklist
GHSA-jggr-w7fw-pc2jMediumfast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
GHSA-6w6g-hm98-mhgmHighhickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)
GHSA-5j98-2g5x-46v6High· 7.5hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures
GHSA-6f2x-v7q7-m7m5Mediumhickory-resolver follows irrelevant CNAME records
hickory-resolver follows irrelevant CNAME records
GHSA-g7fw-3gjp-g5hfMedium· 6.5OpenClaw: Channel read actions could skip target allowlists
OpenClaw: Channel read actions could skip target allowlists
GHSA-w2vw-w76x-qr89HighNx: OS command injection via git revisions and remote refs
Nx: OS command injection via git revisions and remote refs
GHSA-2mjx-qc3c-rqvcMedium· 5.3Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
CVE-2026-105760Medium· 5.3vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options wit…
CVE-2026-105758Medium· 5.3vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs…
CVE-2026-105757Medium· 6.5vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-…
CVE-2026-105756Medium· 6.5vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServ…
CVE-2026-105755Medium· 4.2vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. …
CVE-2026-105754Medium· 6.5vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifi…
CVE-2026-105753Medium· 6.5vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, w…
CVE-2026-105752Low· 3.1vLLM is an inference and serving engine for large language models
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, pl…
CVE-2026-104852High· 8.2GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's mergeDeep function follows inherited properties while recursively merging source objects and does n…
CVE-2026-9205Critical· 9.1Langflow: Weak Fernet Key via random.seed()
Langflow: Weak Fernet Key via random.seed()
CVE-2026-105751High· 7.5PoC⚖ disputedDocling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a d…