All pull requests

Pull requests

• [GHSA-r374-rxx8-8654] Paramiko rsakey.py allows the SHA-1 algorithm

  #10890·skleinsasser-lv opened Nov 4, 2026·

  ·
  2

• GHSA-r34x-38p8-9whw: add affected PyPI package (agno)

  #10889·stillmarcus24 opened Nov 4, 2026·

  ·
  1

• GHSA-4pfw-7888-8q2g: add affected PyPI package (gpt-researcher)

  #10888·stillmarcus24 opened Nov 4, 2026·

  ·
  1

• GHSA-gmx5-crwh-6vxg: add affected npm package (@modelcontextprotocol/server-slack)

  #10887·stillmarcus24 opened Nov 4, 2026·

  ·
  1

• GHSA-gx45-8jc3-gqqr: add affected PyPI package (langflow)

  #10886·stillmarcus24 opened Nov 4, 2026·

  ·
  1

• [GHSA-fwhc-5w96-hjf3] SQL injection in the RelatedProduct block in Mageplaza...

  #10885·SamJUK opened Nov 4, 2026·

  ·
  2

• [GHSA-jx5v-788g-qw58] katello SQL Injection vulnerability

  #10884·jasnow opened Nov 4, 2026·

  ·
  1

• [GHSA-qmpr-r5h7-6c7x] A use after free issue was addressed with improved memory...

  #10879·damarcusj1-wq opened Nov 4, 2026·

  ·
  3

• [GHSA-7r86-cg39-jmmj] minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

  #10878·return-sin opened Nov 4, 2026·

  ·
  2

• [GHSA-33r5-xmm8-v6x5] Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered .constructor member access

  #10877·ranjiGT opened Nov 4, 2026·

  ·
  2

• [GHSA-6gx8-r37x-4vw8] grpc-gateway v2.28.0 is vulnerable to Incorrect Access...

  #10875·steakunderscore opened Nov 4, 2026·

  ·
  7

• [GHSA-83r6-96m8-r52p] Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

  #10874·srinivasKandukuri opened Nov 4, 2026·

  ·
  1

• [GHSA-g5v7-jchf-7jrr] Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

  #10873·srinivasKandukuri opened Nov 4, 2026·

  ·
  1

• [GHSA-9mrv-8pvf-hf4m] Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

  #10872·srinivasKandukuri opened Nov 4, 2026·

  ·
  1

• [GHSA-2cvf-wqm6-wr9g] Podman: The podman run command can be instructed to disable almost all sandboxing by image annotation

  #10870·hara-satoshi-ymr opened Nov 4, 2026·

  ·
  2

• [GHSA-7w2g-9mf9-324m] Hurl: first fixed version is 8.1.0

  #10869·zohuyhieuzo03 opened Nov 4, 2026·

  ·
  2

• [GHSA-rhj7-vh3v-mcq6] Daptin: first fixed version is 0.12.26

  #10868·zohuyhieuzo03 opened Nov 4, 2026·

  ·
  1

• [GHSA-rjcg-fcj6-3hq4] tcpflow through 1.6.1 contains an out-of-bounds read...

  #10867·mirdukkkkk opened Nov 4, 2026·

  ·
  3

• [GHSA-rfx3-98h7-v3xp] Marten's LINQ provider has SQL injection via unescaped string literals

  #10866·mysticmind opened Nov 3, 2026·

  ·
  3

• Update GHSA-q97c-8qh3-fpc6.json

  #10865·nicolasderouet opened Nov 3, 2026·

  ·

• [GHSA-7hhj-8fwv-m5hc] A flaw was found in gnutls. A remote attacker could...

  #10864·benjaminandrew386-boop opened Nov 3, 2026·

  ·
  3

• [GHSA-8fxw-fmj8-xp7j] MongoDB: GridFS data disclosure and deletion via query-operator injection in file IDs

  #10863·kamilk3d opened Nov 3, 2026·

  ·
  1

• [GHSA-wh92-6q6g-px7j] Remove magento/community-edition 2.4.9, which contains the fix

  #10861·plohmy opened Nov 3, 2026·

  ·
  1

• Improve GHSA-wpw8-53h7-xqcq

  #10857·ultragangster7 opened Nov 2, 2026·

  ·

• [GHSA-wpw8-53h7-xqcq] In the Linux kernel, the following vulnerability has been...

  #10856·ultragangster7 opened Nov 2, 2026·

  ·