Tagged “ghsa”
CVEs tagged ghsa, newest first.
5631 CVEsRSS
CVE-2026-55186Medium· 4.2MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
GHSA-pg53-p7qp-65cvLowPocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
CVE-2026-62160HighDaptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
CVE-2026-62264High· 7.5@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
CVE-2026-61438High· 7.3PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
GHSA-c33x-vcv4-vg3gLowCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
CVE-2026-61847MediumCrass: A large number of adjacent CSS comments can trigger a SystemStackError
Crass: A large number of adjacent CSS comments can trigger a SystemStackError
CVE-2026-61846MediumCrass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
GHSA-w9x9-j56r-h98rHigh· 8.2@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
CVE-2026-61848MediumCrass: Non-ASCII characters cause superlinear CPU consumption
Crass: Non-ASCII characters cause superlinear CPU consumption
CVE-2026-9705Medium· 6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access token
Keycloak: Attacker can re-enable and take over disabled clients via registration access token
CVE-2026-115906Medium· 6.5zip: AES Entry HMAC Authentication Bypass on Premature EOF
zip: AES Entry HMAC Authentication Bypass on Premature EOF
CVE-2026-115907High· 7.5zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
CVE-2026-115908High· 7.4zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
CVE-2026-115909High· 7.5zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
CVE-2026-45049High· 8.3OpenAM Session Hijacking via CDSSO
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An atta…
CVE-2026-118664High· 8.2decode-uri-component: Denial of service via quadratic replacement of percent-encoded runs
decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct p…
GHSA-2hw4-c9m4-f2fjMedium· 6.5knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
CVE-2026-118658Medium· 4.7Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
Echo has Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
CVE-2026-118656Medium· 6.1Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash …
CVE-2026-118655Medium· 5.9Echo: Static Middleware Double-Unescape Path Traversal
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can rea…
CVE-2026-118654Medium· 5.9Echo static file middleware route protection bypass via encoded dot-dot traversal
Echo static file middleware route protection bypass via encoded dot-dot traversal
CVE-2026-118663Medium· 5.3@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make …
CVE-2026-118657Medium· 5.9Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
CVE-2026-118667Medium· 4.3LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v…
CVE-2026-118666MediumGraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
CVE-2026-118665HighGraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications
CVE-2026-118661Medium· 6.5Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
CVE-2026-118257High· 7.2Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0-alpha.5, sanitizeTranslatedHtml() escapes markup and event-handler text inside an iframe srcdoc value but leaves the …
CVE-2026-118660High· 8.6Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server be…