Tagged “ghsa”
CVEs tagged ghsa, newest first.
5662 CVEsRSS
CVE-2026-54162Medium· 4.7Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI
Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without…
CVE-2026-44179Critical· 9.9PoCXWiki Pro Macros: excerpt-include title and content injection executes code
XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `excerpt-include` macro does not properly escape the included page's title and executes `excerpt` con…
CVE-2026-116691Medium· 6.5PoCMLflow CrewAI autologging records LLM provider API keys in logged trace spans
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested creden…
CVE-2026-116694Medium· 6.3OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byt…
CVE-2026-116695Medium· 5.3Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass…
CVE-2026-116693High· 8.7dd-trace: ReDOS in URL query string obfuscation
dd-trace is the Datadog APM client for Node.js. From 2.0.0 until 5.131.1 and 6.20.1, the default DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP can perform excessive backtracking on attacker-controlled URL query strings. The expression is appl…
CVE-2026-116692Critical· 9.8PoCMLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected des…
CVE-2026-116696Low· 3.3PoCrussh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records w…
CVE-2026-116775Low· 2.3PoCpageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)
pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-co…
CVE-2026-116684Medium· 6.8Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier ac…
CVE-2026-116686Medium· 6.5Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared output…
CVE-2026-116687Low· 3.1CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured …
CVE-2026-116685Medium· 5.9Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and…
CVE-2026-116688High· 8.1CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the engine uses a vulnerable es-toolkit version whose prototype-pollution behavior can be reached while CKEditor processes …
CVE-2026-116690High· 7.5PoCMLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path vali…
GHSA-f897-62hf-6gxqHigh· 7.5MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
CVE-2026-116683High· 7.1CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values
CTFer.io's CTFd Terraform Provider manages CTFd resources as code. From 0.1.5 until 2.8.2, ctfd_team.password is stored as a non-sensitive value in Terraform state. A local or remote user with access to that state can read the team passw…
CVE-2026-116679Medium· 5.4Neko: Authorization bypass in legacy WebRTC input handling
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input be…
CVE-2026-116682High· 8.6PoCFileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the…
CVE-2026-116675High· 8.5TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malic…
CVE-2026-116674Medium· 6.5PoCsysteminformation: Prototype pollution in `networkStats()` via the interface name
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object _network cache and indexes it wi…
CVE-2026-116677Medium· 5.3OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organiz…
CVE-2026-116676High· 8.8PoCAtlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform comm…
GHSA-wf6j-7hvr-gr93High· 7.8Hydra legacy target blacklist permits unsafe PyYAML loading
Hydra legacy target blacklist permits unsafe PyYAML loading
CVE-2026-116587High· 7.5Go JOSE: DoS when parsing JWKs that contain RSA keys
Go JOSE: DoS when parsing JWKs that contain RSA keys
CVE-2026-27975Critical· 9.8Ajenti has potential Remote Code Execution
Ajenti has potential Remote Code Execution
CVE-2026-33944High· 8.8Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
GHSA-q84f-53jg-9ppmHigh· 8.1better-auth: Device login approval does not show the requesting client or permissions
better-auth: Device login approval does not show the requesting client or permissions
GHSA-j456-xh4h-cpf2High· 8.6NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
GHSA-4g23-2xm8-66gcMedium· 5.9Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service