All pull requests

Pull requests

• [GHSA-2299-ghjr-6vjp] Parse Server: MFA recovery code single-use bypass via concurrent requests

  #11291·aungzayyanaing opened Nov 13, 2026·

  ·
  1

• [GHSA-243v-98vx-264h] Wasmtime can panic when adding excessive fields to a wasi:http/types.fields instance

  #11290·aungzayyanaing opened Nov 13, 2026·

  ·
  3

• [GHSA-2679-6mx9-h9xc] Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

  #11289·aungzayyanaing opened Nov 13, 2026·

  ·
  3

• [GHSA-2238-xc5r-v9hj] @tinacms/graphql has a Path Traversal issue

  #11288·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-22qr-rp27-j9wm] PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

  #11286·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-226f-f24g-524w] Open WebUI: Redirect-Bypass SSRF in OAuth _process_picture_url (incomplete-fix sibling of CVE-2026-45401)

  #11285·aungzayyanaing opened Nov 13, 2026·

  ·
  1

• [GHSA-23m2-mghx-vqmf] Wagtail: Reflected XSS in dynamic image URL generator view

  #11284·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-243p-f3cv-c5wh] Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

  #11283·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-22jm-h49p-29qw] MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

  #11282·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-65jj-fmw8-468q] zebrad has unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention

  #11281·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-2gf8-q9rr-jq3h] zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

  #11280·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-qv2r-v3mx-f4pf] zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

  #11279·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-c8w6-x74f-vmg3] zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

  #11278·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-63wg-wjjj-7cp8] Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

  #11277·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-4fc2-h7jh-287c] zebrad has mempool transaction admission denial via single-peer inbound queue saturation

  #11276·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-rj37-6j9x-74q6] SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS

  #11275·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-wv6g-x823-wx9m] Terragrunt catalog predictable temp symlink clobber

  #11274·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-m27g-v28p-f9fx] OmniAuth: Host Header Injection Vulnerability

  #11273·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-8vv3-6qpc-gpw6] bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

  #11272·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-w4f7-4cxr-rv3c] cowboy and gun affected by an HTTP Request/Response Splitting vulnerability

  #11271·aungzayyanaing opened Nov 13, 2026·

  ·
  1

• [GHSA-6ph5-fww6-vfwv] NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length

  #11270·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-fq3v-74gv-27gm] Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

  #11269·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-r38m-44fw-h886] AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

  #11268·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-655q-fx9r-782v] Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis

  #11266·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-g8vq-v3mg-7mrg] Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

  #11265·aungzayyanaing opened Nov 13, 2026·

  ·
  2