All pull requests

Pull requests

• [GHSA-5h86-8mv2-jq9f] aiohttp is vulnerable to directory traversal

  #11237·aungzayyanaing opened Nov 12, 2026·

  ·
  3

• [GHSA-fm3q-8qwm-p5xr] Element Web and Element Desktop before 1.12.32 accept...

  #11235·Frank-Lom opened Nov 12, 2026·

  ·
  3

• Update fixed version in GHSA-5hcw-679g-g6cq.json

  #11234·efekrbas opened Nov 12, 2026·

  ·
  1

• [GHSA-5hcw-679g-g6cq] Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains...

  #11233·efekrbas opened Nov 12, 2026·

  ·
  3

• [GHSA-pwfv-328h-75x9] golang.org/x/image/tiff allows unbounded memory consumption via an oversized tile

  #11232·hahwul opened Nov 12, 2026·

  ·
  1

• [GHSA-m6fh-wvw4-4629] golang.org/x/image/bmp panics on a paletted image with an out-of-range palette index

  #11231·hahwul opened Nov 12, 2026·

  ·
  2

• [GHSA-m43h-mp45-ghq6] golang.org/x/image/webp panics on a VP8 chunk whose dimensions do not match the canvas

  #11230·hahwul opened Nov 12, 2026·

  ·
  1

• [GHSA-j48v-cvqq-xcv6] zbus_polkit before 5.1.0 allows polkit authorization bypass via PID reuse

  #11229·hahwul opened Nov 12, 2026·

  ·
  2

• [GHSA-4vpj-hr3r-4gpg] golang.org/x/sys/windows NewNTUnicodeString silently truncates an overlong string

  #11228·hahwul opened Nov 12, 2026·

  ·
  1

• [GHSA-vvr2-h2jp-838m] Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

  #11227·ranjiGT opened Nov 12, 2026·

  ·
  3

• [GHSA-6j3h-rp73-6rvf] Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

  #11226·ranjiGT opened Nov 12, 2026·

  ·
  3

• [GHSA-xgjr-7j9q-2h4r] listmonk: SQL Injection in /api/subscribers/export bypasses table access control, leaking admin password hashes and SMTP credentials

  #11225·ranjiGT opened Nov 12, 2026·

  ·
  3

• [GHSA-f74m-x83r-c4v4] FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive

  #11224·ranjiGT opened Nov 12, 2026·

  ·
  3

• [GHSA-xxrh-5hgg-gj4h] Nuxt Content: Unauthenticated SQLite Function DoS via Content Query API

  #11223·ranjiGT opened Nov 12, 2026·

  ·
  3

• Add affected Maven packages to GHSA-76q5-xqfh-7vw2 (CVE-2026-95628)

  #11222·rushitparekh opened Nov 12, 2026·

  ·

• Add affected Maven packages to GHSA-m9c4-p9cf-c4cv (CVE-2026-101259)

  #11221·rushitparekh opened Nov 12, 2026·

  ·

• Add affected Maven packages to GHSA-7rmf-gx38-35x6 (CVE-2026-85316)

  #11220·rushitparekh opened Nov 12, 2026·

  ·

• Add affected Maven packages to GHSA-xp25-2fp7-pffp (CVE-2026-85249)

  #11219·rushitparekh opened Nov 12, 2026·

  ·

• Add affected Maven packages to GHSA-5p69-3rq2-6qj8 (CVE-2026-85247)

  #11218·rushitparekh opened Nov 12, 2026·

  ·

• Add affected Maven packages to GHSA-83r5-f6fc-33rj (CVE-2026-85246)

  #11217·rushitparekh opened Nov 12, 2026·

  ·

• Add affected Maven packages to GHSA-rgg6-2q97-gxhm (CVE-2026-85243)

  #11216·rushitparekh opened Nov 12, 2026·

  ·

• Add affected Maven packages to GHSA-xwpw-3mm7-243x (CVE-2026-84181)

  #11215·rushitparekh opened Nov 12, 2026·

  ·

• Correct SvelteKit enhanced-form advisory affected versions

  #11214·DoisKoh opened Nov 12, 2026·

  ·
  1

• Add affected Maven packages to GHSA-v58v-w6mp-4gfw (CVE-2026-84180)

  #11213·rushitparekh opened Nov 12, 2026·

  ·

• Add affected Maven packages to GHSA-vxj7-chgp-72vh (CVE-2026-84176)

  #11212·rushitparekh opened Nov 12, 2026·

  ·