Tagged “ghsa”
CVEs tagged ghsa, newest first.
5688 CVEsRSS
CVE-2026-86064High· 8.6PoCKlever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The…
CVE-2026-82405High· 8.7Klever-Go is the Go implementation of the Klever blockchain protocol
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientA…
CVE-2026-93421Medium· 5.3Mesop is a Python-based UI framework that allows users to build web applications
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report…
CVE-2026-77602Critical· 9.9PoCOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later…
CVE-2026-77601High· 8.8PoCOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-ap…
CVE-2026-77394High· 7.6PoCOpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /ope…
CVE-2026-76089High· 7.7Formie is a Craft CMS plugin for creating forms
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-s…
CVE-2026-76087High· 8.2Formie is a Craft CMS plugin for creating forms
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete subm…
CVE-2026-76086High· 8.5Formie is a Craft CMS plugin for creating forms
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration…
CVE-2026-61814High· 7.5Jawn is an open source JSON parser
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remo…
CVE-2026-61695High· 7.5PoCWire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMI…
CVE-2026-59990High· 7.5Jawn is an open source JSON parser
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until th…
CVE-2026-77420Medium· 5.5PoCJLine is a Java library for handling console input
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HIS…
CVE-2026-56675High· 8.39router /v1 APIs has unauthenticated access via reverse proxy locality collapse
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
CVE-2026-56679High9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
CVE-2026-56678Medium· 6.49router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
CVE-2026-56676High· 7.49router: Image prefetch DNS rebinding allows SSRF to internal services
9router: Image prefetch DNS rebinding allows SSRF to internal services
CVE-2026-77422High· 7.5PoCJLine is a Java library for handling console input
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(…
CVE-2026-77421Medium· 6.5JLine is a Java library for handling console input
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jlin…
CVE-2026-92692Medium· 6.9Sulu is an open-source PHP content management system based on the Symfony framework
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/Quer…
CVE-2026-85724Critical· 9.6PoCMoquette is a lightweight Java MQTT broker
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then t…
CVE-2026-92164Medium· 6.5PoCStreamlink is a CLI utility which pipes video streams from various services into a video player
Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting …
CVE-2026-73858Medium· 5.3PoCSolspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes.…
CVE-2026-61834Medium· 4.3PoCscim-patch is a library for applying SCIM patch operations
scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of …
CVE-2026-62998Medium· 4.3PoCREDAXO is a PHP-based content management system
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. …
CVE-2026-63001Medium· 4.8REDAXO is a PHP-based content management system
REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it whe…
CVE-2026-54892HighPlug: quadratic-time decoding of nested query/body parameters enables denial of service
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
CVE-2026-88974Medium· 5.4PoCWPGraphQL provides a GraphQL API for WordPress sites
WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the obje…
CVE-2026-63002Medium· 4.8PoCREDAXO is a PHP-based content management system
REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker wh…
CVE-2026-63000Medium· 6.4PoCREDAXO is a PHP-based content management system
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() inste…