All pull requests

Pull requests

• [GHSA-7p8c-crfr-q93p] hutool Buffer Overflow vulnerability

  #11250·dylanpulver opened Nov 12, 2026·

  ·
  1

• [GHSA-8qwh-rm6c-jv96] Oxidized Web vulnerable to Cross-site Scripting

  #11249·dylanpulver opened Nov 12, 2026·

  ·
  2

• [GHSA-78p6-6878-8mj6] SM2-PKE has Unchecked AffinePoint Decoding (unwrap) in decrypt()

  #11248·dylanpulver opened Nov 12, 2026·

  ·
  1

• [GHSA-j9xq-69pf-pcm8] RustCrypto Has Insufficient Length Validation in decrypt() in SM2-PKE

  #11247·dylanpulver opened Nov 12, 2026·

  ·
  1

• [GHSA-67fv-9r7g-432h] Rhai stack overflow vulenrability

  #11246·dylanpulver opened Nov 12, 2026·

  ·
  2

• [GHSA-55f3-3qvg-8pv5] Symlink bypasses filesystem sandbox

  #11245·dylanpulver opened Nov 12, 2026·

  ·
  1

• [GHSA-mpmf-3w4r-qfpf] KubeVirt has a Link Following issue

  #11244·dylanpulver opened Nov 12, 2026·

  ·
  2

• [GHSA-44qj-cghf-9p97] free5GC's SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

  #11243·dylanpulver opened Nov 12, 2026·

  ·
  2

• [GHSA-8r94-4h3c-939f] Improper Restriction of Excessive Authentication Attempts

  #11242·dylanpulver opened Nov 12, 2026·

  ·
  2

• [GHSA-cj8w-v588-p8wx] pf4j vulnerable to remote code execution via expandIfZip method in the extract function

  #11241·dylanpulver opened Nov 12, 2026·

  ·
  1

• [GHSA-rxgf-r843-g53h] hutool Buffer Overflow vulnerability

  #11240·dylanpulver opened Nov 12, 2026·

  ·

• [GHSA-j44v-mmf2-xvm9] PDM Trojan Lockfile

  #11239·dylanpulver opened Nov 12, 2026·

  ·
  1

• [GHSA-5h86-8mv2-jq9f] aiohttp is vulnerable to directory traversal

  #11237·aungzayyanaing opened Nov 12, 2026·

  ·
  3

• [GHSA-fm3q-8qwm-p5xr] Element Web and Element Desktop before 1.12.32 accept...

  #11235·Frank-Lom opened Nov 12, 2026·

  ·
  3

• Update fixed version in GHSA-5hcw-679g-g6cq.json

  #11234·efekrbas opened Nov 12, 2026·

  ·
  1

• [GHSA-5hcw-679g-g6cq] Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains...

  #11233·efekrbas opened Nov 12, 2026·

  ·
  3

• [GHSA-pwfv-328h-75x9] golang.org/x/image/tiff allows unbounded memory consumption via an oversized tile

  #11232·hahwul opened Nov 12, 2026·

  ·
  1

• [GHSA-m6fh-wvw4-4629] golang.org/x/image/bmp panics on a paletted image with an out-of-range palette index

  #11231·hahwul opened Nov 12, 2026·

  ·
  2

• [GHSA-m43h-mp45-ghq6] golang.org/x/image/webp panics on a VP8 chunk whose dimensions do not match the canvas

  #11230·hahwul opened Nov 12, 2026·

  ·
  1

• [GHSA-j48v-cvqq-xcv6] zbus_polkit before 5.1.0 allows polkit authorization bypass via PID reuse

  #11229·hahwul opened Nov 12, 2026·

  ·
  2

• [GHSA-4vpj-hr3r-4gpg] golang.org/x/sys/windows NewNTUnicodeString silently truncates an overlong string

  #11228·hahwul opened Nov 12, 2026·

  ·
  1

• [GHSA-vvr2-h2jp-838m] Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

  #11227·ranjiGT opened Nov 12, 2026·

  ·
  3

• [GHSA-6j3h-rp73-6rvf] Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

  #11226·ranjiGT opened Nov 12, 2026·

  ·
  3

• [GHSA-xgjr-7j9q-2h4r] listmonk: SQL Injection in /api/subscribers/export bypasses table access control, leaking admin password hashes and SMTP credentials

  #11225·ranjiGT opened Nov 12, 2026·

  ·
  3

• [GHSA-f74m-x83r-c4v4] FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

  #11224·ranjiGT opened Nov 12, 2026·

  ·
  3