Tagged “ghsa”
CVEs tagged ghsa, newest first.
5688 CVEsRSS
CVE-2026-102265Medium· 5.3PoCPyJWT is a Python implementation of JSON Web Token standards
PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header rea…
CVE-2026-101918Medium· 5.3PoCPyJWT is a Python implementation of JSON Web Token standards
PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacke…
CVE-2026-101917Medium· 5.3PoCPyJWT is a Python implementation of JSON Web Token standards
PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. This occurs when u…
CVE-2026-101916High· 7.4@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set…
CVE-2026-96760Critical· 9.8PoC⚖ disputedAuthlib (v1.7.2 and below) contains a signature verification bypass vulnerability
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking f…
CVE-2026-101915Low· 3.7@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the stat…
CVE-2026-101914Medium· 6.5@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact path (method name) matcher used by RBAC performs a prefix comparison instead of an equality comparis…
CVE-2026-101913Medium· 6.3PoCip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range…
CVE-2026-101912Medium· 6.3PoCip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands u…
CVE-2026-101911Medium· 6.3PoCip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters…
CVE-2026-101910Medium· 6.9PoCip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applicati…
CVE-2026-101909High· 8.3PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separ…
CVE-2026-101908Medium· 6.9PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process…
CVE-2026-101907High· 7.0PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receive…
CVE-2026-101906High· 8.2PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PR…
CVE-2026-101905High· 7.6PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-p…
CVE-2026-101904Medium· 6.9PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process proto…
CVE-2026-101903High· 8.2PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled m…
CVE-2026-101902Medium· 6.9PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vuln…
CVE-2026-101901High· 8.2PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request us…
CVE-2026-101900Medium· 6.9PoCAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process pro…
CVE-2026-101898High· 7.0PoC⚖ disputedAxios is a promise-based HTTP client for the browser and Node.js
Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2…
CVE-2026-101894Critical· 9.1PoC⚖ disputedThe decompress package for Node.js extracts archives
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An att…
GHSA-456v-xq2p-r4cjHigh· 7.8code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
CVE-2026-55157High· 8.4PoCToken Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, token-optimizer-mcp is vulnerable to OS command injection in the sm…
CVE-2026-55156Medium· 5.3PoCToken Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients
Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/sessi…
GHSA-43rv-jrfh-9mrrMedium· 7.5Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
GHSA-7rr2-8fr3-fjqxHigh· 6.8Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
GHSA-c9wr-qm7p-p6vcCritical· 9.0Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries
Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries
CVE-2026-100723High· 7.5PoC⚖ disputedvm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module th…