Tagged “ghsa”
CVEs tagged ghsa, newest first.
5663 CVEsRSS
GHSA-g73g-hqqh-jr95Medium· 5.3Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
GHSA-4ffr-jq9g-5ffxMedium· 5.9Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
GHSA-m64x-33q8-m5h7HighGitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
GHSA-w8jc-g24h-crhwHigh· 7.5GitPython command wrappers omit unsafe protocol and option checks
GitPython command wrappers omit unsafe protocol and option checks
GHSA-fx3j-rwgx-fr94Medium· 6.5GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
GHSA-gq48-pqfc-9p58MediumGitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
GHSA-f9j4-qggq-h239High· 8.1GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
GHSA-23mf-xhv8-69c2HighGitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
GHSA-hhww-mrg2-969hMedium· 6.8LiteLLM vulnerable to reflected XSS in /sso/debug/callback
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
GHSA-r4xp-prcw-77qfHigh· 7.4better-auth: OAuth Proxy lets an attacker sign in as another user
better-auth: OAuth Proxy lets an attacker sign in as another user
GHSA-44jh-23m7-hpcfLow· 3.7@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
GHSA-g5ff-637f-6q2mHigh· 8.1LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
GHSA-763v-5pjm-fx36MediumStrands Agents: Default FileSessionManager storage is world-readable on shared systems
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
GHSA-3w55-933p-8pv5High· 7.1Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
CVE-2026-116591High· 8.7compress zstd: Panic on two-block frames
compress zstd: Panic on two-block frames
GHSA-h2v8-394m-p7vvLow· 3.7Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
GHSA-c8m5-c952-6cm4Medium· 4.0Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs
GHSA-w44r-93j7-qv28Low· 3.7rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
GHSA-vp88-798v-h67fLow· 2.3rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
CVE-2026-114619Medium· 4.6Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
CVE-2026-114618Medium· 6.8Authlib: Default JWT bearer grant accepts assertions for the wrong audience
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
CVE-2026-114617Medium· 4.2⚖ disputedAuthlib: ID token can disable its own nonce validation via the nonce_supported claim
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
CVE-2026-114615High· 7.4Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
CVE-2026-114614Low· 2.6Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
CVE-2026-114613High· 7.5MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
CVE-2026-108357High· 8.8PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
CVE-2026-108358High· 8.8PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
CVE-2026-114607Critical· 9.1better-auth: OAuth state can be used as a Magic Link to sign in as another user
better-auth: OAuth state can be used as a Magic Link to sign in as another user
CVE-2026-59158High· 7.5PoCNuxt Ollama: public runtime configuration discloses the configured cloud API key
Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. …
CVE-2026-116586Medium· 6.9Go JOSE: Panics in JSON parsing
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.5, par…