All pull requests

Pull requests

• Add source repository, fix commit and fixed release references to GHSA-c7g8-f337-8fr6 (CVE-2026-89292)

  #10908·maulanawirawan opened Nov 5, 2026·

  ·
  2

• [GHSA-8prm-248r-h957] Microsoft Security Advisory CVE-2026-47300 – .NET Elevation of Privilege Vulnerability

  #10907·Hemz1416 opened Nov 5, 2026·

  ·
  1

• [GHSA-g84c-rxfj-3j2c] webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

  #10906·6vers opened Nov 5, 2026·

  ·
  4

• [GHSA-w7rv-gfp4-j9j3] Narrow slippers affected range to >= 0.2.0, <= 0.6.2

  #10905·aarik4122-ui opened Nov 5, 2026·

  ·
  1

• [GHSA-xvh5-g6gv-559v] Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

  #10903·frenzymadness opened Nov 5, 2026·

  ·
  3

• Clarify CVE-2026-30117 proxy impact and remediation

  #10901·hanspagel opened Nov 5, 2026·

  ·
  2

• [GHSA-fc5q-39xc-vjpf] Picomatch through 4.0.7 contains a regular expression...

  #10900·fal3n-4ngel opened Nov 5, 2026·

  ·
  2

• [GHSA-wqmh-qccw-pqwf] MLflow FileStore trace IDs allow path traversal and arbitrary file writes

  #10898·kriscon-db opened Nov 5, 2026·

  ·
  3

• [GHSA-mqmp-4mcp-vg8v] add org.apache.orc:orc-core, which contains the fixed Java reader

  #10897·zyl71 opened Nov 5, 2026·

  ·
  1

• [GHSA-p782-4j23-xqcg] add org.apache.atlas:atlas-repository, which contains the fixed code

  #10896·zyl71 opened Nov 5, 2026·

  ·
  1

• [GHSA-875x-g8p7-5w27] add web-auth/webauthn-symfony-bundle, which contains ProfileBasedRequestOptionsBuilder

  #10895·zyl71 opened Nov 5, 2026·

  ·
  2

• [GHSA-7895-gffq-w6jq] Apache Tomcat has a Missing Critical Step in Authentication vulnerability

  #10894·hara-satoshi-ymr opened Nov 5, 2026·

  ·
  3

• [GHSA-fq3v-74gv-27gm] Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

  #10893·wintermi opened Nov 5, 2026·

  ·
  4

• [GHSA-4pq7-67mc-3rgx] Spring Security Authorization Server's default consent...

  #10892·trosonke opened Nov 5, 2026·

  ·
  3

• [GHSA-r374-rxx8-8654] Paramiko rsakey.py allows the SHA-1 algorithm

  #10890·skleinsasser-lv opened Nov 4, 2026·

  ·
  2

• GHSA-r34x-38p8-9whw: add affected PyPI package (agno)

  #10889·stillmarcus24 opened Nov 4, 2026·

  ·
  1

• GHSA-4pfw-7888-8q2g: add affected PyPI package (gpt-researcher)

  #10888·stillmarcus24 opened Nov 4, 2026·

  ·
  1

• GHSA-gmx5-crwh-6vxg: add affected npm package (@modelcontextprotocol/server-slack)

  #10887·stillmarcus24 opened Nov 4, 2026·

  ·
  1

• GHSA-gx45-8jc3-gqqr: add affected PyPI package (langflow)

  #10886·stillmarcus24 opened Nov 4, 2026·

  ·
  1

• [GHSA-fwhc-5w96-hjf3] SQL injection in the RelatedProduct block in Mageplaza...

  #10885·SamJUK opened Nov 4, 2026·

  ·
  2

• [GHSA-jx5v-788g-qw58] katello SQL Injection vulnerability

  #10884·jasnow opened Nov 4, 2026·

  ·
  1

• [GHSA-qmpr-r5h7-6c7x] A use after free issue was addressed with improved memory...

  #10879·damarcusj1-wq opened Nov 4, 2026·

  ·
  3

• [GHSA-7r86-cg39-jmmj] minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

  #10878·return-sin opened Nov 4, 2026·

  ·
  2

• [GHSA-33r5-xmm8-v6x5] Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered .constructor member access

  #10877·ranjiGT opened Nov 4, 2026·

  ·
  2

• [GHSA-6gx8-r37x-4vw8] grpc-gateway v2.28.0 is vulnerable to Incorrect Access...

  #10875·steakunderscore opened Nov 4, 2026·

  ·
  7