All pull requests

Pull requests

• [GHSA-fwxx-wv44-7qfg] Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

  #10787·ranjiGT opened Oct 30, 2026·

  ·
  1

• [GHSA-788w-68h3-cvxp] Ghost: Remote Code Execution via Bookmark Card Images

  #10786·ranjiGT opened Oct 30, 2026·

  ·
  2

• [GHSA-q8hq-4h99-fj7x] Keycloak TLS Client-Initiated Renegotiation Denial of Service

  #10785·ranjiGT opened Oct 30, 2026·

  ·
  2

• [GHSA-x8mh-94wc-33gv] apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider

  #10784·ranjiGT opened Oct 30, 2026·

  ·
  1

• [GHSA-799x-qp47-8qwq] Apache Airflow has no certificate validation on SMTP STARTTLS connections

  #10783·ranjiGT opened Oct 30, 2026·

  ·
  1

• [GHSA-qpgp-93vx-g8v8] Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

  #10782·ranjiGT opened Oct 30, 2026·

  ·
  4

• [GHSA-2vqw-3mp8-cgmx] Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

  #10781·ranjiGT opened Oct 30, 2026·

  ·
  4

• [GHSA-7r4p-vjf4-gxv4] Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

  #10780·ranjiGT opened Oct 30, 2026·

  ·
  2

• [GHSA-w5f2-9q9c-ff4h] LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

  #10779·ranjiGT opened Oct 30, 2026·

  ·
  2

• [GHSA-vqc8-7275-q272] Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names

  #10778·axlon opened Oct 30, 2026·

  ·
  3

• [GHSA-9392-pj54-qqf8] Add patched version 29.1.0

  #10777·mikeflame opened Oct 29, 2026·

  ·
  1

• [GHSA-ffw8-fwxp-h64w] Add patched version 29.1.0

  #10776·mikeflame opened Oct 29, 2026·

  ·
  1

• [GHSA-ff5q-cc22-fgp4] Add patched version 29.1.0

  #10775·mikeflame opened Oct 29, 2026·

  ·
  1

• [GHSA-ghcv-22jf-vfxm] Add patched version 29.1.0

  #10774·mikeflame opened Oct 29, 2026·

  ·
  2

• [GHSA-qm9p-p5pw-jrx2] Add patched version 29.1.0

  #10773·mikeflame opened Oct 29, 2026·

  ·
  2

• [GHSA-j432-4w3j-3w8j] Add patched version 29.1.0

  #10772·mikeflame opened Oct 29, 2026·

  ·
  1

• [GHSA-2hch-c97c-g99x] Add patched version 29.1.0

  #10771·mikeflame opened Oct 29, 2026·

  ·
  2

• [GHSA-ccq9-r5cw-5hwq] Add patched version 29.1.0

  #10770·mikeflame opened Oct 29, 2026·

  ·
  1

• [GHSA-wc3f-xc32-435f] Add patched version 29.1.0

  #10769·mikeflame opened Oct 29, 2026·

  ·
  1

• [GHSA-834v-8h66-3h79] Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

  #10768·iAlturki opened Oct 29, 2026·

  ·
  2

• [GHSA-cg8m-r9f2-5wm2] Narrow the affected range to black 26.10.0

  #10767·iseletsk opened Oct 29, 2026·

  ·

• [GHSA-3jp2-3mrg-2vxc] Remove patched version 4.0.0

  #10765·Rania193 opened Oct 29, 2026·

  ·
  1

• [GHSA-2j8r-3c22-8565] Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability

  #10764·ranjiGT opened Oct 29, 2026·

  ·
  1

• [GHSA-56v8-86gj-66jp] Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

  #10763·ranjiGT opened Oct 29, 2026·

  ·
  1

• [GHSA-wg36-wvj6-r67p] Composer has a command injection via malicious perforce repository

  #10762·ranjiGT opened Oct 29, 2026·

  ·
  2