Tagged “ghsa”
CVEs tagged ghsa, newest first.
5687 CVEsRSS
CVE-2026-100722Medium· 6.8PoCvm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the…
CVE-2026-100721Critical· 9.0PoCvm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-comp…
GHSA-mgrx-3hqw-485hCritical· 7.7Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)
Duplicate Advisory: INVITED users auto-promoted via SSO email match (invite-token bypass)
CVE-2026-57449High· 7.1PoCActual is a local-first personal finance tool
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TO…
GHSA-62mm-xwmv-crhgHighkhoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem
GHSA-vv77-66rf-pm86Highmpp vulnerable to Gas Draining with no limit
mpp vulnerable to Gas Draining with no limit
GHSA-qpxh-ff8m-c62vMediummpp vulnerable to Gas Draining with access list
mpp vulnerable to Gas Draining with access list
GHSA-vj8p-hp9x-gh47Highmpp vulnerable to Gas Draining with low gas limit
mpp vulnerable to Gas Draining with low gas limit
GHSA-29h2-jr22-frmhHighOpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet
CVE-2026-100368High· 8.4CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt
CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers for shells such as PowerShell and Windows Command Prompt. `CliInvoke.Specializations` versions 2.2.…
CVE-2026-93363Medium· 4.3The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly
The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attac…
CVE-2026-92161Critical· 9.8FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers
FriendsOfFlarum OAuth allows users to log in to Flarum with GitHub, Twitter, Facebook, and other providers. Prior to 1.7.4 and 2.0.0-beta.4, the Discord OAuth provider does not check the verified field returned for an OAuth email before …
CVE-2026-53493Medium· 6.9containerd is an open-source container runtime
containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can force very high CPU/memory usage during PullImage (before container start), causing long ContainerCr…
CVE-2026-55736MediumAsh: Private action arguments can be set by user input via string-keyed params and atomic changesets
Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets
GHSA-2jx3-ff3v-j7jjMediumyara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB
CVE-2026-12957HighLanguage Servers for AWS Vulnerable to Arbitrary Code Execution
Language Servers for AWS Vulnerable to Arbitrary Code Execution
CVE-2026-57439Medium· 5.0CyberChef: Prototype pollution in Series Chart operation
CyberChef: Prototype pollution in Series Chart operation
CVE-2026-12958High· 7.8Language Servers for AWS vulnerable to arbitrary file write
Language Servers for AWS vulnerable to arbitrary file write
GHSA-g28h-2cmm-rj9xHigh· 7.5langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputs
CVE-2026-59723High· 8.8Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
CVE-2026-57440High· 7.5PoCThe EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (n…
CVE-2026-96747Medium· 5.0The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encrypt…
CVE-2026-61825High· 8.7code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content be…
CVE-2026-96749High· 8.4⚖ disputedAn integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is perf…
CVE-2026-96748Medium· 6.5PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters
PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a conne…
CVE-2026-61823High· 7.3code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces
code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permit…
CVE-2026-62286Medium· 4.3PoCDozzle is a realtime log viewer for docker containers
Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returne…
CVE-2026-61816High· 7.5PoCzbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822
zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrol…
CVE-2026-61815High· 7.2zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822
zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header …
CVE-2026-61741Critical· 9.3http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies
http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newI…