Tagged “ghsa”
CVEs tagged ghsa, newest first.
5691 CVEsRSS
CVE-2026-71417High· 7.3Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority_id, serial, or external_id without requiring permiss…
GHSA-jf24-8g2h-2wg7MediumLibreNMS Vulnerable to Remote Code Execution via AboutController
LibreNMS Vulnerable to Remote Code Execution via AboutController
GHSA-7cj5-v4pp-v632Medium· 4.8LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users
LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users
GHSA-7gww-x7fh-jf9jHigh· 8.1LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page
CVE-2026-17106High· 7.8PoCgithub.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction (CVE-2026-17106)
A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by…
CVE-2026-73974Medium· 5.5linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linux…
GHSA-c7hr-448w-65pxHigh· 8.3MeshCentral has unsanitized data fields
MeshCentral has unsanitized data fields
CVE-2026-53423Mediummembrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion
membrane_mp4_plugin has an unauthenticated denial-of-service via BEAM atom table exhaustion
CVE-2026-63641LowMagicMirror² is an open source modular smart mirror platform
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equival…
CVE-2026-63642MediumPoCMagicMirror² is an open source modular smart mirror platform
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed…
CVE-2026-63643MediumMagicMirror² is an open source modular smart mirror platform
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through…
CVE-2026-63640Medium· 4.3MagicMirror² is an open source modular smart mirror platform
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder i…
CVE-2026-68924Medium· 4.9MobSF is a mobile application security testing tool used
MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but do…
CVE-2026-68927Low· 3.0MobSF is a mobile application security testing tool used
MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before ap…
CVE-2026-68923Medium· 6.5MobSF is a mobile application security testing tool used
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE …
CVE-2026-68922Medium· 5.5MobSF is a mobile application security testing tool used
MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manifest android:icon value to construct paths under the scan resource d…
GHSA-2mf3-mr2r-r4vfHigh· 7.5@rhinostone/swig: arbitrary local file read via include/extends path traversal
@rhinostone/swig: arbitrary local file read via include/extends path traversal
CVE-2026-55839High· 8.7Kestra is an open-source, event-driven orchestration platform
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaS…
CVE-2026-63328MediumTrivy is a security scanner
Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager.go to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to i…
CVE-2026-69220HighThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReade…
CVE-2026-69219High· 7.5The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java uses ValueReader.readBytes to accept a wire-…
CVE-2026-63337High· 8.8The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted syst…
CVE-2026-63335MediumThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java proces…
CVE-2026-63336MediumThe RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) …
CVE-2026-61634Low· 7.5The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/r…
CVE-2026-70657Medium· 4.3Copyparty is a portable file server
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the conta…
CVE-2026-48798High· 7.1SSH.NET is a Secure Shell (SSH) library for .NET
SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the r…
CVE-2026-63632Low· 3.3Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/vers…
CVE-2026-59949Medium· 6.5yawkat LZ4 Java provides LZ4 compression for Java
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.n…
CVE-2026-59940Critical· 9.8Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general…