Tagged “ghsa”
CVEs tagged ghsa, newest first.
5688 CVEsRSS
GHSA-35mr-4567-66vgMedium· 6.5Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
GHSA-qxpp-qjg8-x4jvHigh· 7.1Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
GHSA-8mcx-5rqc-vhmfHigh· 8.8Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
GHSA-xxv7-2vv3-h682High· 7.7Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
CVE-2026-104874Medium· 5.3PoCMultidict is an implementation of a multidict data structure
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - ope…
CVE-2026-104873High· 7.6LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.t…
CVE-2026-104872Medium· 5.8OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentat…
CVE-2026-104871Medium· 6.3The Angular SSR is a server-rise rendering tool for Angular applications
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for ver…
CVE-2026-103918Medium· 6.5oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in pl…
CVE-2026-62314Medium· 5.8Anubis: Policy bypass via client controlled X-Original-URI header
Anubis: Policy bypass via client controlled X-Original-URI header
CVE-2026-104861High· 7.5PoCprobe-image-size gets image dimensions without downloading the entire file
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the en…
CVE-2026-104859High· 7.3Nx is a monorepo solution for TypeScript and polyglot codebases
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings…
CVE-2026-104855Low· 2.0⚖ disputedWasmtime is a runtime for WebAssembly
Wasmtime is a runtime for WebAssembly. From 46.0.0 until 46.0.2 and 47.0.3, fuel and epoch preemption checks inside bulk operations including memory.copy, table.grow, and array.copy can expose invalid intermediate state when an embedder …
CVE-2026-104854High· 8.5Nx is a monorepo solution for TypeScript and polyglot codebases
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory an…
CVE-2026-104853Medium· 5.8Nx is a monorepo solution for TypeScript and polyglot codebases
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contain…
CVE-2026-104851High· 8.8PoCfsspec is a specification and Python implementation framework for filesystem interfaces
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unre…
CVE-2026-104849Critical· 9.5PoCTinypool is a minimal Node.js worker thread pool implementation
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.f…
CVE-2026-104848Critical· 9.5PoCTinypool is a minimal Node.js worker thread pool implementation
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherite…
GHSA-c9xm-49cp-xcr9Mediumrmcp OAuth client fetches server-controlled resource_metadata URLs
rmcp OAuth client fetches server-controlled resource_metadata URLs
CVE-2026-94544Medium· 4.2⚖ disputedNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular req…
CVE-2026-94543Medium· 5.3Next.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a res…
CVE-2026-94486Medium· 5.4⚖ disputedNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious webs…
CVE-2026-94485Medium· 5.3⚖ disputedNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious we…
CVE-2026-94484Medium· 4.8Next.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a share…
CVE-2026-94483Medium· 6.5⚖ disputedNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized…
CVE-2026-104847High· 8.5ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes …
CVE-2026-104846Critical· 9.8Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bear…
CVE-2026-104845High· 7.5Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and d…
CVE-2026-104844Medium· 5.9PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because peri…
CVE-2026-104843Medium· 5.9uv is a Python package and project manager written in Rust
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a…