All pull requests

Pull requests

• [GHSA-g9ww-x58f-9g6m] Contrast BadAML injection allows arbitrary code execution

  #11357·katexochen opened Nov 15, 2026·

  ·
  1

• [GHSA-x4mc-mqm7-gg39] uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

  #11354·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-m976-87wm-48fm] uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

  #11353·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-2m8x-mvfx-gwgj] uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

  #11352·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-mh5c-xrmh-m794] uutils coreutils has an Untrusted Search Path

  #11351·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-5hgf-628x-mcqf] uutils coreutils has an Incorrect Permission Assignment for Critical Resource

  #11350·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-hpfw-mqm3-33jh] uutils coreutils has a Link Following issue

  #11349·sylvestre opened Nov 15, 2026·

  ·
  2

• [GHSA-x2wv-9p67-mh9w] uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

  #11348·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-957r-r8gc-vv3h] uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries

  #11347·sylvestre opened Nov 15, 2026·

  ·
  2

• [GHSA-xf75-659h-cgg5] uutils coreutils has a Link Following Issue

  #11346·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-9gh9-hwpr-rvqq] uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

  #11345·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-f2jv-wjjc-2c94] uutils coreutils has an Uncaught Exception When Encountering Valid but Non-UTF-8 Paths

  #11344·sylvestre opened Nov 15, 2026·

  ·
  2

• [GHSA-q6m9-xj2w-xmrc] uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

  #11343·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-wh8p-h9hw-x2mc] uutils coreutils has an Unchecked Return Value Issue

  #11342·sylvestre opened Nov 15, 2026·

  ·
  1

• [GHSA-539f-xcgw-2gjg] Addressable display_uri can show misleading hosts containing bidi and invisible characters

  #11341·ranjiGT opened Nov 15, 2026·

  ·
  2

• [GHSA-2vgq-wchc-25w7] Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption

  #11340·ranjiGT opened Nov 15, 2026·

  ·
  2

• [GHSA-46wx-v44x-9hh2] Hono: csrf() does not check requests sent by hyperlink auditing (text/ping)

  #11339·ranjiGT opened Nov 15, 2026·

  ·
  2

• [GHSA-5cjw-f85j-cv6r] Tornado: Open redirect via triple-slash redirect paths

  #11338·ranjiGT opened Nov 15, 2026·

  ·
  2

• [GHSA-gvp8-978c-rx2q] Add patched version 2.14.0 for PyJWT

  #11337·mytrashcan opened Nov 14, 2026·

  ·
  3

• Add CVE-2025-13327 reference to uv PyPI advisory

  #11336·sovergarden-dev opened Nov 14, 2026·

  ·
  1

• [GHSA-q672-hfc7-g833] Apache Druid Vulnerable to Authentication Bypass

  #11334·aungzayyanaing opened Nov 14, 2026·

  ·
  1

• [GHSA-2gpf-2492-q9jh] PraisonAI: Call API localhost-only authentication bypass via spoofed Host header

  #11333·aungzayyanaing opened Nov 14, 2026·

  ·
  2

• [GHSA-253c-mchw-3w2r] markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds

  #11332·aungzayyanaing opened Nov 14, 2026·

  ·
  2

• [GHSA-2rqm-h6hv-g79v] odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

  #11331·aungzayyanaing opened Nov 14, 2026·

  ·
  2

• [GHSA-mgqh-hxfv-cf6h] Eclipse Kura unauthenticated HTTP request on Service Listing V1 causes remote OOM denial of service

  #11330·mattdibi opened Nov 14, 2026·

  ·
  5