All pull requests

Pull requests

• [GHSA-38jj-69cp-9wgc] Not Failing Securely ('Failing Open') vulnerability in...

  #10519·kaito-yamaguchi-assured opened Oct 23, 2026·

  ·
  1

• [GHSA-2464-fhr4-w9xw] Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

  #10517·yusuke-koyoshi opened Oct 23, 2026·

  ·
  3

• [GHSA-x7hc-r9m3-67vr] Improperly Controlled Modification of Dynamically...

  #10516·Rudloff opened Oct 23, 2026·

  ·

• [GHSA-9c24-g32g-35rj] Drupal PECL YAML parser unsafe object handling

  #10515·Rudloff opened Oct 23, 2026·

  ·

• [GHSA-3m36-mjwj-352c] Drupal core Cross-site Scripting (XSS) vulnerability

  #10514·Rudloff opened Oct 23, 2026·

  ·

• [GHSA-2w6h-6wr9-m5r8] Incomplete cleanup vulnerability in Apache Tomcat could...

  #10513·keita-chiba opened Oct 23, 2026·

  ·
  1

• [GHSA-2hg3-hfj5-cq2f] Execution After Redirect (EAR) vulnerability in Apache...

  #10512·keita-chiba opened Oct 23, 2026·

  ·
  1

• [GHSA-wv4g-r8pf-3wmw] Time-of-check time-of-use (TOCTOU) race condition...

  #10511·taishikitamura opened Oct 23, 2026·

  ·
  1

• [GHSA-w9r8-5j45-v8mg] Incorrect object recycling and re-use vulnerability in...

  #10510·yusuke-koyoshi opened Oct 23, 2026·

  ·
  1

• [GHSA-ggqh-85g7-w56q] Cruise Control's Jetty ConstraintSecurityHandler...

  #10509·cedricbu opened Oct 23, 2026·

  ·

• [GHSA-7pwq-q9jf-539h] kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

  #10508·ranjiGT opened Oct 23, 2026·

  ·
  2

• [GHSA-9mvp-w4rr-5c6x] decidim-elections: Election question titles allow stored script execution

  #10507·ranjiGT opened Oct 23, 2026·

  ·
  2

• [GHSA-jm5p-837g-rv8g] Wagtail: Improper restriction handling on Page translation API endpoint

  #10506·ranjiGT opened Oct 23, 2026·

  ·
  2

• [GHSA-65fv-6pff-4q47] Add Go package github.com/zitadel/zitadel

  #10505·OsamaSE opened Oct 23, 2026·

  ·

• Correct Nuxt affected ranges for GHSA-vjh5-4x84-xrqp

  #10504·platx opened Oct 23, 2026·

  ·

• [GHSA-pw57-w545-279f] Improper Neutralization of Input During Web Page...

  #10503·Rudloff opened Oct 22, 2026·

  ·

• [GHSA-x9r9-c232-4q39] Hugging Face Transformers downloads custom generation code before trust consent

  #10502·itzik123 opened Oct 22, 2026·

  ·

• [GHSA-8mgp-746c-j5xp] NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

  #10501·itzik123 opened Oct 22, 2026·

  ·

• [GHSA-5r6c-gj4g-r697] Add fix commit reference

  #10500·stanleys12 opened Oct 22, 2026·

  ·

• [GHSA-hc5v-gxvj-58wh] Add fix commit reference

  #10499·stanleys12 opened Oct 22, 2026·

  ·

• [GHSA-wcjj-9m6g-2fr2] functype-mcp-server: MCP set_functype_version Package Alias RCE via Unsanitized pnpm install + Dynamic Import

  #10498·ranjiGT opened Oct 22, 2026·

  ·
  2

• [GHSA-794g-x443-36f7] Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

  #10496·robbert-intraflag opened Oct 22, 2026·

  ·
  2

• [GHSA-8pqf-f4m5-798g] Twisted: IMAP wildcardToRegexp() ReDoS

  #10494·bufur opened Oct 22, 2026·

  ·
  1

• [GHSA-rc42-6c7j-7h5r] Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed

  #10493·pstreef opened Oct 22, 2026·

  ·
  1

• GHSA-wj4w-mc24-pcfm: add the affected npm package and version range

  #10492·assakafpix opened Oct 22, 2026·

  ·