All pull requests

Pull requests

• [GHSA-rm89-rhwj-9j92] Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

  #10705·neotrow opened Oct 27, 2026·

  ·
  2

• Improve GHSA-f525-44xv-f2qj

  #10703·hara-satoshi-ymr opened Oct 27, 2026·

  ·
  1

• [GHSA-f3j8-8ggq-f9x2] In Eclipse hawkBit versions 1.0.3 and prior, a privilege...

  #10702·Santoshkumarpuppala opened Oct 27, 2026·

  ·

• [GHSA-6v25-8wq6-xq4j] Hazelcast allows arbitrary member memory access by low-privileged client

  #10701·JackPGreen opened Oct 27, 2026·

  ·
  2

• [GHSA-86w9-cpqp-85rv] node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

  #10700·ckallasjc opened Oct 27, 2026·

  ·

• [GHSA-537c-gmf6-5ccf] Vulnerable OpenSSL included in cryptography wheels

  #10699·axeon3 opened Oct 27, 2026·

  ·
  2

• Correct block_buffer affected range for GHSA-qwgh-2vcv-g2f7

  #10698·fwhskr opened Oct 27, 2026·

  ·
  2

• [GHSA-xqcf-hj92-967m] Django REST framework XSS Vulnerability

  #10697·MaximGerman2908 opened Oct 27, 2026·

  ·

• [GHSA-86w9-cpqp-85rv] node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

  #10696·davidlehn opened Oct 27, 2026·

  ·

• [GHSA-6966-vjj6-99xv] JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard

  #10695·scw opened Oct 27, 2026·

  ·
  3

• [GHSA-whpp-xv3h-rwxf] Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations

  #10694·tal-sealsecurity opened Oct 26, 2026·

  ·

• [GHSA-f4vp-28x5-837r] Add affected package EPiServer.CMS.UI < 12.32.0 (CVE-2025-22390)

  #10693·larsflagan opened Oct 26, 2026·

  ·
  3

• [GHSA-fc9r-7hhq-7wqj] Add affected package EPiServer.CMS.UI < 12.32.0 (CVE-2025-22389)

  #10692·larsflagan opened Oct 26, 2026·

  ·
  4

• [GHSA-8r9q-7v3j-jr4g] Align affected-version description with corrected range

  #10691·Muzzy5150 opened Oct 26, 2026·

  ·

• [GHSA-hc6q-2mpp-qw7j] Cross-realm object access in Webpack 5

  #10690·uscolective-byte opened Oct 26, 2026·

  ·

• [GHSA-c44f-37qr-gw3f] Add fix commit reference

  #10689·stanleys12 opened Oct 26, 2026·

  ·

• Update GHSA-9v8h-qqgm-4m35.json with CVE alias

  #10686·Guluis opened Oct 26, 2026·

  ·

• [GHSA-j8w7-6x6g-56p6] An unauthenticated remote attacker may use an allocation...

  #10685·bernhardreiter opened Oct 26, 2026·

  ·

• [GHSA-wwx6-x28x-8259] russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets

  #10684·ranjiGT opened Oct 26, 2026·

  ·
  2

• [GHSA-f9x3-7vq9-cph6] Laravel TokenGuard authentication bypass through non-string API credentials

  #10682·rolandsusans opened Oct 26, 2026·

  ·
  4

• [GHSA-4x29-79gh-6v8q] Correct affected Maven packages (tomcat-util does not contain the vulnerable class)

  #10681·hara-satoshi-ymr opened Oct 26, 2026·

  ·
  1

• Cover affected quinn-proto 0.10.x releases in GHSA-q8wc-j5m9-27w3

  #10680·decoder-dev opened Oct 26, 2026·

  ·

• Exclude fixed Tokio 1.42.1 branch from GHSA-rr8g-9fpq-6wmg

  #10679·decoder-dev opened Oct 26, 2026·

  ·

• Correct canonical mdbook crate name in GHSA-gx5w-rrhp-f436

  #10678·decoder-dev opened Oct 26, 2026·

  ·

• Correct canonical tauri crate name in GHSA-q9wv-22m9-vhqh

  #10677·decoder-dev opened Oct 26, 2026·

  ·