Tagged “ghsa”
CVEs tagged ghsa, newest first.
5687 CVEsRSS
CVE-2026-77606Medium· 6.1Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when `headers=plain`, table header text was emitted into `<th>` via a raw HTML path. U…
CVE-2026-77608Medium· 6.1Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the `value` parameter was reflected back into rendered output and error messaging…
CVE-2026-61682Critical· 9.9kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X-Remote-Extra-* i…
CVE-2025-61682High· 8.6PoCSemantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Versions starting in 3.1.0 and prior to 7.0.0 insert the unsanitized value of a data attribute into the DOM as…
CVE-2026-93687High· 7.5PoCbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards
braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Nod…
CVE-2025-53837Critical· 9.9XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc)
XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile o…
CVE-2026-62282Medium· 6.5PoCOpenCVE is a vulnerability intelligence platform
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permiss…
CVE-2026-93605Critical· 10.0vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary co…
CVE-2026-93451Medium· 6.5snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Atta…
CVE-2026-54147Medium· 6.5http4k is a functional toolkit for Kotlin HTTP applications
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response wit…
CVE-2026-54148High· 8.1http4k is a functional toolkit for Kotlin HTTP applications
http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest does not compare the uri parameter in an Authorization: Digest response with the …
GHSA-4xmw-hh9q-4q7cCritical· 9.0Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
GHSA-2vh9-cv26-p97mMedium· 5.8Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack
Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack
GHSA-mgj2-jqjq-q8ggCritical· 8.6Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
GHSA-5v7w-95g5-pj6qCritical· 10.0Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
GHSA-gg6f-mhqm-f7gpCritical· 10.0Duplicate Advisory: Sandbox Escape (NodeVM)
Duplicate Advisory: Sandbox Escape (NodeVM)
GHSA-9538-79j2-h62hHigh· 7.1Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
GHSA-mrx9-2rrp-rhpxHigh· 7.5Duplicate Advisory: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Duplicate Advisory: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
GHSA-538q-xxpg-6h4rCritical· 10.0Duplicate Advisory: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
Duplicate Advisory: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
GHSA-x5qg-8pq6-39h6Critical· 10.0Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
GHSA-vjcv-9j33-wj62High· 7.5Duplicate Advisory: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
Duplicate Advisory: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
GHSA-29x6-9qh5-83ggCritical· 10.0Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
GHSA-63m2-qqch-jxv2Medium· 5.8Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
GHSA-xq74-c7jx-8w5jCritical· 10.0Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store
Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store
GHSA-8mvv-mcc3-xwhhLow· 4.2Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
GHSA-hwr5-cm8v-c76qCritical· 9.8Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
GHSA-6jgm-4w45-vh8jCritical· 9.9Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine
Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine
GHSA-m7cq-7f2q-f9fhCritical· 9.9Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`
Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`
GHSA-3f84-vwv5-r42gCritical· 10.0Duplicate Advisory: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
Duplicate Advisory: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
GHSA-9fxx-mv6c-j5xpCritical· 9.0Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE
Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE