Tagged “ghsa”
CVEs tagged ghsa, newest first.
5692 CVEsRSS
CVE-2026-83608High· 3.1xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/d…
CVE-2026-83557Medium· 5.6DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe bas…
CVE-2026-19032Medium· 5.3jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URI(…
CVE-2026-63435Medium· 5.3Mail is an internet library for Ruby designed to handle email generation, parsing, and sending
Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match and an overly greedy charset cap…
CVE-2026-84366High· 7.4Scrapy is a high-level web crawling and scraping framework for Python
Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to th…
CVE-2026-83610Medium· 5.3xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) a…
CVE-2026-84304High· 7.5gRPC-Go is the Go language implementation of gRPC
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate…
CVE-2026-84371Medium· 5.4ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value…
CVE-2026-84305Medium· 6.2sqlparse is a non-validating SQL parser module for Python
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/…
CVE-2026-84309Medium· 5.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a …
CVE-2026-84311Low· 3.3⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused fo…
CVE-2026-84310Low· 3.3⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines wi…
CVE-2026-84307Low· 3.7Filament is a collection of full-stack components for accelerated Laravel development
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAc…
CVE-2026-84306Medium· 6.5Filament is a collection of full-stack components for accelerated Laravel development
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-cod…
CVE-2026-19418HighTYPO3 CMS - Broken Access Control in Backend and Install Tool
TYPO3 CMS - Broken Access Control in Backend and Install Tool
GHSA-wwv5-g3v4-889xLowTornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_…
Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
GHSA-8423-8fgw-73vqMediumtornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
GHSA-j8pm-gj4c-rq4xHigh· 7.5league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters
GHSA-f8fg-pg57-v4j8High· 7.2league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
GHSA-jjv6-8j6v-6j52High· 7.5league/commonmark: Denial of service in the SmartPunct and Attributes extensions
league/commonmark: Denial of service in the SmartPunct and Attributes extensions
GHSA-8rr7-cvq3-gmfhHigh· 7.5league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension
CVE-2026-58191Medium· 6.5PoCAppium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
GHSA-2rx9-3g3h-c2jvHigh· 7.1pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
GHSA-vx52-2968-3vc6High· 7.4pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
GHSA-3f6p-5ww8-9rcrHighMySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials
GHSA-gqvg-gmmx-x4hmHigh· 8.8MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
GHSA-frj6-5rhh-vwfwHigh· 6.5Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception
CVE-2026-82662Medium· 6.5PoCNodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth…
CVE-2026-75592MediumKirby is an open-source content management system
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Ki…
CVE-2026-82395MediumSulu is an open-source PHP content management system based on the Symfony framework
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media …