Tagged “ghsa”
CVEs tagged ghsa, newest first.
5663 CVEsRSS
CVE-2026-118244High· 7.2Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print
Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Ch…
CVE-2026-118246High· 8.4Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who co…
CVE-2026-118245High· 8.6Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the compone…
CVE-2026-118247Medium· 6.9Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__…
CVE-2026-118249High· 7.2Highcharts: series column construction writes to Object.prototype
Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed poi…
CVE-2026-118250High· 7.2Highcharts: dotted series.keys paths write to Object.prototype
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching…
CVE-2026-116673Low· 3.3systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
CVE-2026-116583Medium· 5.3Seroval: Code injection through a typed array's own constructor property
Seroval: Code injection through a typed array's own constructor property
CVE-2026-117601High· 7.5Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
CVE-2026-115927Medium· 5.3Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
CVE-2026-116575Medium· 6.3Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
CVE-2026-116579Medium· 5.9Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
CVE-2026-115912High· 7.5vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled
CVE-2026-115915High· 8.1vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
CVE-2026-115919Medium· 6.2ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
CVE-2026-115920Medium· 6.2ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
CVE-2026-112909Medium· 6.1PoCfilelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
CVE-2026-112911Medium· 6.3PoCfilelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
CVE-2026-112912Low· 2.5PoCfilelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
CVE-2026-112915Medium· 5.5PoCfilelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
CVE-2026-112934Medium· 6.1PoCfilelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its …
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
CVE-2026-112935Medium· 4.7PoCfilelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
CVE-2026-112936Medium· 6.1PoCfilelock: ReadWriteLock follows a symlink at the lock path into SQLite
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
CVE-2026-112939Medium· 4.7PoCfilelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
CVE-2026-112941Low· 3.3PoCfilelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user r…
filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock
CVE-2026-56828High· 8.8Shopper: read-only team permissions allow administrator creation and permission escalation
Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_…
CVE-2026-59185High· 8.5identrail: Cross-tenant GitHub installation binding without ownership verification
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` …
CVE-2026-59179High· 8.3PoCOpenHop: Path Traversal in Flow ID File Operations
OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELETE /api/flows/:id` in `packages/server/src/routes.ts` to `Fl…
CVE-2026-59176High· 7.8PoCFunctype: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import
Functype is a family of TypeScript functional programming libraries. Prior to 1.4.4, the `set_functype_version` MCP tool in `functype-mcp-server` accepts an unconstrained `version` string using only `z.string()` validation in `packages/m…
CVE-2026-59172High· 7.8Joker linter executed project-local .jokerd/linter.* files during linting
Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint <file>` walks upward from the linted file to locate a `.jokerd/` directory and executes matching `linter.*` files before linting. Tho…