All pull requests

Pull requests

• [GHSA-3g3m-2fjr-6pw4] Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

  #10928·tnohtition-mfv opened Nov 6, 2026·

  ·
  2

• [GHSA-83r6-96m8-r52p] Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

  #10927·jlarrea-wiz opened Nov 6, 2026·

  ·
  1

• [GHSA-f8p7-h97q-7vx7] Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

  #10926·jlarrea-wiz opened Nov 6, 2026·

  ·
  1

• [GHSA-g5v7-jchf-7jrr] Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

  #10925·jlarrea-wiz opened Nov 6, 2026·

  ·
  1

• [GHSA-9mrv-8pvf-hf4m] Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

  #10924·jlarrea-wiz opened Nov 6, 2026·

  ·
  1

• Add source repository and fixed release references to GHSA-87gv-mpgp-xpp2 (CVE-2026-119757)

  #10923·maulanawirawan opened Nov 6, 2026·

  ·
  1

• [GHSA-m5ph-mmg5-6w5h] filecoin-pin: Unbounded DAG pinning can exhaust server resources

  #10922·Vendetaaaa opened Nov 6, 2026·

  ·
  5

• [GHSA-rvm3-566m-v7fv] Correct affected ranges for Capacitor 8.x

  #10921·EduardoAndradeMachado opened Nov 6, 2026·

  ·
  1

• [GHSA-8678-w3jw-xfc2] Add CVE alias CVE-2026-57234

  #10920·munimv2 opened Nov 6, 2026·

  ·
  2

• [GHSA-f7vj-73pm-m822] LeRobot contains an unsafe deserialization vulnerability...

  #10919·Dballzall opened Nov 6, 2026·

  ·
  4

• [GHSA-cqgh-8p3p-mx4m] Fix patched version to 5.37.0 (5.36.1 was never released)

  #10918·mytrashcan opened Nov 6, 2026·

  ·
  1

• [GHSA-g84c-rxfj-3j2c] webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

  #10917·hnaether-c8y opened Nov 6, 2026·

  ·
  1

• [GHSA-cv3g-hj65-pcfh] Fix patched version for PyPI (4.6.78 was never published)

  #10916·mytrashcan opened Nov 6, 2026·

  ·
  1

• [GHSA-mqvw-jfmh-93qq] Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

  #10915·ranjiGT opened Nov 6, 2026·

  ·
  1

• [GHSA-5368-6h4h-gr29] Spring Boot's PID file write follows symlinks at predictable default path

  #10914·ranjiGT opened Nov 6, 2026·

  ·
  1

• [GHSA-m4x9-hx6x-2c43] Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

  #10913·ranjiGT opened Nov 6, 2026·

  ·
  1

• [GHSA-hgj6-7826-r7m5] jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)

  #10912·ranjiGT opened Nov 6, 2026·

  ·
  4

• [GHSA-5phw-3jrp-3vj8] Server-Side Request Forgery in Apache Solr

  #10911·baptistegrimaud opened Nov 6, 2026·

  ·
  1

• [GHSA-qj9p-jvmw-82rh] add org.apache.pinot:pinot-broker and pinot-controller, which contain the fixed defaults

  #10909·zyl71 opened Nov 6, 2026·

  ·
  1

• Add source repository, fix commit and fixed release references to GHSA-c7g8-f337-8fr6 (CVE-2026-89292)

  #10908·maulanawirawan opened Nov 5, 2026·

  ·
  3

• [GHSA-8prm-248r-h957] Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability

  #10907·Hemz1416 opened Nov 5, 2026·

  ·
  1

• [GHSA-g84c-rxfj-3j2c] webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

  #10906·6vers opened Nov 5, 2026·

  ·
  4

• [GHSA-w7rv-gfp4-j9j3] Narrow slippers affected range to >= 0.2.0, <= 0.6.2

  #10905·aarik4122-ui opened Nov 5, 2026·

  ·
  1

• [GHSA-xvh5-g6gv-559v] Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

  #10903·frenzymadness opened Nov 5, 2026·

  ·
  3

• Clarify CVE-2026-30117 proxy impact and remediation

  #10901·hanspagel opened Nov 5, 2026·

  ·
  2