All pull requests

Pull requests

• [GHSA-33r5-xmm8-v6x5] Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered .constructor member access

  #10877·ranjiGT opened Nov 4, 2026·

  ·
  2

• [GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

  #10876·yadinesh1 opened Nov 4, 2026·

  ·
  2

• [GHSA-6gx8-r37x-4vw8] grpc-gateway v2.28.0 is vulnerable to Incorrect Access...

  #10875·steakunderscore opened Nov 4, 2026·

  ·
  4

• [GHSA-83r6-96m8-r52p] Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

  #10874·srinivasKandukuri opened Nov 4, 2026·

  ·
  1

• [GHSA-g5v7-jchf-7jrr] Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

  #10873·srinivasKandukuri opened Nov 4, 2026·

  ·
  1

• [GHSA-9mrv-8pvf-hf4m] Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

  #10872·srinivasKandukuri opened Nov 4, 2026·

  ·
  1

• [GHSA-2cvf-wqm6-wr9g] Podman: The podman run command can be instructed to disable almost all sandboxing by image annotation

  #10870·hara-satoshi-ymr opened Nov 4, 2026·

  ·
  2

• [GHSA-7w2g-9mf9-324m] Hurl: first fixed version is 8.1.0

  #10869·zohuyhieuzo03 opened Nov 4, 2026·

  ·
  2

• [GHSA-rhj7-vh3v-mcq6] Daptin: first fixed version is 0.12.26

  #10868·zohuyhieuzo03 opened Nov 4, 2026·

  ·
  1

• [GHSA-rjcg-fcj6-3hq4] tcpflow through 1.6.1 contains an out-of-bounds read...

  #10867·mirdukkkkk opened Nov 4, 2026·

  ·
  3

• [GHSA-rfx3-98h7-v3xp] Marten's LINQ provider has SQL injection via unescaped string literals

  #10866·mysticmind opened Nov 3, 2026·

  ·
  3

• Update GHSA-q97c-8qh3-fpc6.json

  #10865·nicolasderouet opened Nov 3, 2026·

  ·

• [GHSA-7hhj-8fwv-m5hc] A flaw was found in gnutls. A remote attacker could...

  #10864·benjaminandrew386-boop opened Nov 3, 2026·

  ·

• [GHSA-8fxw-fmj8-xp7j] MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

  #10863·kamilk3d opened Nov 3, 2026·

  ·
  1

• [GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

  #10862·worldwideskier-alpine opened Nov 3, 2026·

  ·
  1

• [GHSA-wh92-6q6g-px7j] Remove magento/community-edition 2.4.9, which contains the fix

  #10861·plohmy opened Nov 3, 2026·

  ·
  1

• [GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

  #10860·khucanhduy9-cloud opened Nov 3, 2026·

  ·
  1

• [GHSA-gcqx-w48m-w2h4] deepmerge mergeObject() allows prototype poisoning of returned objects

  #10859·gwynne opened Nov 3, 2026·

  ·

• Improve GHSA-wpw8-53h7-xqcq

  #10857·ultragangster7 opened Nov 2, 2026·

  ·

• [GHSA-wpw8-53h7-xqcq] In the Linux kernel, the following vulnerability has been...

  #10856·ultragangster7 opened Nov 2, 2026·

  ·

• [GHSA-f9x3-7vq9-cph6] Add patched Laravel 10.x and 11.x versions

  #10855·rmcdaniel opened Nov 2, 2026·

  ·

• [GHSA-99jh-6h7p-pp36] Add fixed version 4.16.3 for github.com/labstack/echo/v4

  #10854·myhubstat opened Nov 2, 2026·

  ·

• [GHSA-246p-cpwv-v3jq] Add fixed version 4.16.3 for github.com/labstack/echo/v4

  #10853·myhubstat opened Nov 2, 2026·

  ·

• [GHSA-rfx3-98h7-v3xp] Marten's LINQ provider has SQL injection via unescaped string literals

  #10852·jeremydmiller opened Nov 2, 2026·

  ·
  1

• [GHSA-rcfx-77hg-w2wv] Add CWE-1395 to FastMCP advisory

  #10851·eeee2345 opened Nov 2, 2026·

  ·