All pull requests

Pull requests

• [GHSA-cxf4-7mrp-vvpr] Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter

  #9858·Unifex opened Sep 30, 2026·

  ·
  3

• [GHSA-rrmf-rvhw-rf47] PyTorch is vulnerable to memory corruption through its torch.jit.script function

  #9857·Ankush-Pathak opened Sep 29, 2026Contributor·

  ·

• [GHSA-fhjh-xqqj-cjf5] LightGBM through 4.7.0 fails to validate child and split...

  #9856·portyu9 opened Sep 29, 2026·

  ·
  1

• [GHSA-pm27-vjq7-f5fv] snappy-java through 1.1.10.8 contains a buffer overflow...

  #9855·portyu9 opened Sep 29, 2026·

  ·
  1

• [GHSA-gr8h-7qg5-vh27] OOM Denial of Service via Unbounded Map Pre-Sizing in...

  #9854·portyu9 opened Sep 29, 2026·

  ·

• [GHSA-jg8r-5jh2-v2xj] Payload CMS default account-unlock access allows authenticated users to reset other accounts' lockouts

  #9853·Davithi opened Sep 29, 2026·

  ·

• [GHSA-x4vx-rjvf-j5p4] DOMPurify: IN_PLACE mode trusts attacker-controlled nodeName on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects

  #9852·Davithi opened Sep 29, 2026·

  ·

• [GHSA-237m-2qxv-ww7c] BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant...

  #9851·portyu9 opened Sep 29, 2026·

  ·
  1

• [GHSA-2qv6-9wx5-cwv4] LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

  #9850·Davithi opened Sep 29, 2026·

  ·

• [GHSA-8xx9-69p8-7jp3] LiquidJS has a renderLimit DoS guard bypass via empty {% for %} body

  #9849·Davithi opened Sep 29, 2026·

  ·

• [GHSA-9x9p-qf8f-mvjg] LiquidJS's {% render %} tag silently bypasses per-render ownPropertyOnly:true via Context.spawn()

  #9848·Davithi opened Sep 29, 2026·

  ·

• [GHSA-hh27-hf48-9f5q] LiquidJS has a memory and render limit bypass via unbounded width padding in date filter (strftime)

  #9847·Davithi opened Sep 29, 2026·

  ·

• [GHSA-hjwh-6x9j-wjwq] The raster Rust crate's crop() function (src/editor.rs)...

  #9846·portyu9 opened Sep 29, 2026·

  ·

• [GHSA-4j5r-9p93-j2px] Headroom's LLM proxy lets a client choose the upstream...

  #9845·portyu9 opened Sep 29, 2026·

  ·
  1

• [GHSA-2mhp-wpjp-pjr8] github.com/temporalio/tchannel-go did not validate the...

  #9844·portyu9 opened Sep 29, 2026·

  ·

• [GHSA-hvr3-jhx6-xw68] UVdesk core-framework before 1.1.7 contains an improper...

  #9843·portyu9 opened Sep 29, 2026·

  ·
  1

• [GHSA-5wq9-489q-pp4g] An issue was discovered in IdentityModel (aka ScottBrady...

  #9842·portyu9 opened Sep 29, 2026·

  ·

• [GHSA-7xr2-q9vf-x4r5] Correct affected range and add patched version 2026.3.24

  #9841·mikeflame opened Sep 29, 2026·

  ·
  3

• [GHSA-r8jr-wg88-fq5c] Map to org.keycloak:keycloak-services, fixed in 26.5.6

  #9840·mikeflame opened Sep 29, 2026·

  ·
  1

• [GHSA-526f-jxpj-jmg2] Mark thrift 0.23.0 as the fixed version

  #9839·mikeflame opened Sep 29, 2026·

  ·
  1

• [GHSA-v8jm-5vwx-cfxm] Mark dompurify 2.5.9 as the patched version for the 2.x range

  #9838·mikeflame opened Sep 29, 2026·

  ·
  2

• [GHSA-9r5m-9576-7f6x] Correct affected range: 10.25.0 is also affected; first fixed in 10.25.1

  #9837·mikeflame opened Sep 29, 2026·

  ·
  1

• [GHSA-6q5m-63h6-5x4v] Correct affected range: 10.25.0 is also affected; first fixed in 10.25.1

  #9836·mikeflame opened Sep 29, 2026·

  ·
  1

• [GHSA-xr8f-h2gw-9xh6] Set 1.7.0-beta.2 as the patched version for the 1.7.0 beta range

  #9835·mikeflame opened Sep 29, 2026·

  ·
  2

• [GHSA-hm7r-c7qw-ghp6] Add patched version 6.2.0 for fast-jwt

  #9834·mikeflame opened Sep 29, 2026·

  ·
  1