All pull requests

Pull requests

• [GHSA-w4f7-4cxr-rv3c] cowboy and gun affected by an HTTP Request/Response Splitting vulnerability

  #11040·maennchen opened Nov 9, 2026·

  ·
  3

• [GHSA-gc25-3vc5-2jf9] Sandbox Breakout / Arbitrary Code Execution in sandbox

  #11039·Shockolate opened Nov 9, 2026·

  ·
  2

• [GHSA-j328-xmgp-j4q3] Shopper: privilege escalation via improper Livewire admin component authorization

  #11038·ranjiGT opened Nov 9, 2026·

  ·
  2

• [GHSA-fwhc-5w96-hjf3] SQL injection in the RelatedProduct block in Mageplaza...

  #11037·aadmathijssen opened Nov 9, 2026·

  ·
  3

• [GHSA-gv83-gqw6-9j2c] Name the affected module github.com/gofiber/fiber/v3

  #11036·jamesconwaydev opened Nov 9, 2026·

  ·
  1

• [GHSA-8327-84cj-8xjm] Stack overflow when parsing specially crafted JSON ABI strings

  #11035·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-q745-cfqh-hcrw] phpThumb is vulnerable to Command Injection through its gif_outputAsJpeg function

  #11034·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-6mp4-q625-mxjp] YOURLS is vulnerable to XSS through JSONP and Callback request parameters

  #11033·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-vjmr-f5fc-vr2w] hsweb-framework has a Path Traversal issue

  #11032·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-794x-8x6x-qpfc] Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

  #11031·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-fxr3-gvm4-m8vc] hsweb-framework has an open redirect issue

  #11030·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-gx6c-pv62-9mcf] Snowflake JDBC Driver is Vulnerable to Uncontrolled Resource Consumption through SdkProxyRoutePlanner

  #11029·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-9p93-7j67-5pc2] OpenClaw: Gateway HTTP /sessions/:sessionKey/kill Reaches Admin Kill Path Without Caller Scope Binding

  #11028·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-mw7w-g3mg-xqm7] OpenClaw: BlueBubbles Group Reactions Bypass requireMention and Still Enqueue Agent-Visible System Events

  #11027·Chr0mium24 opened Nov 9, 2026·

  ·
  2

• [GHSA-g49q-jw42-6x85] thelounge may publicly disclose of all usernames/idents via port 113

  #11026·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-mrxx-39g5-ph77] Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in Upsert Condition Field

  #11025·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-x92x-px7w-4gx4] Dgraph: Pre-Auth Full Database Exfiltration via DQL Injection in NQuad Lang Field

  #11024·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-vvf7-6rmr-m29q] Dgraph: Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars

  #11023·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-8g8j-r87h-p36x] Vitess users with backup storage access can gain unauthorized access to production deployment environments

  #11022·Chr0mium24 opened Nov 9, 2026·

  ·
  2

• [GHSA-3vcg-j39x-cwfm] Vyper's slice() may elide side-effects when output length is 0

  #11021·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-qhr6-mgqr-mchm] Vyper's concat() builtin may elide side-effects for zero-length arguments

  #11020·Chr0mium24 opened Nov 9, 2026·

  ·
  1

• [GHSA-cq46-m9x9-j8w2] Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization

  #11019·Chr0mium24 opened Nov 9, 2026·

  ·
  2

• [GHSA-wwhq-w58m-w29c] Caddy is fixed in 2.11.3

  #11018·jamesconwaydev opened Nov 9, 2026·

  ·
  1

• [GHSA-mhc4-g3wh-cw7m] Mark 0.23.6 and 0.24.3 as the fixed versions

  #11017·jamesconwaydev opened Nov 9, 2026·

  ·
  1

• [GHSA-jm82-fx9c-mx94] Add CVE alias CVE-2026-57204

  #11014·munimv2 opened Nov 9, 2026·

  ·
  1