All pull requests

Pull requests

• [GHSA-4v58-8p28-2rq3] awslabs/tough is Missing Delegated Metadata Validation

  #11010·ranjiGT opened Nov 8, 2026·

  ·
  2

• [GHSA-jxxr-4gwj-5jf2] brace-expansion: Large numeric range defeats documented max DoS protection

  #11009·ranjiGT opened Nov 8, 2026·

  ·
  2

• [GHSA-89g2-xw5c-v95p] PPTAgent: Arbitrary Code Execution via Python eval() of LLM-Generated Code with Builtins in Scope

  #11008·ranjiGT opened Nov 8, 2026·

  ·
  2

• [GHSA-7xw9-549r-8jrc] DIRAC: SQL injection and lack of access control in PilotManager service

  #11007·ranjiGT opened Nov 8, 2026·

  ·
  2

• [GHSA-vg99-gr89-qhw9] DIRAC: Pilot code downloaded over unverified HTTPS connection

  #11006·ranjiGT opened Nov 8, 2026·

  ·
  2

• [GHSA-9jpv-c7p4-997x] DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input

  #11005·ranjiGT opened Nov 8, 2026·

  ·
  3

• [GHSA-m4m7-4cw8-62j6] DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval

  #11004·ranjiGT opened Nov 8, 2026·

  ·
  3

• [GHSA-hfcp-477w-3wjw] rubyipmi is vulnerable to OS Command Injection through malicious usernames

  #11002·ranjiGT opened Nov 8, 2026·

  ·
  1

• [GHSA-q339-8rmv-2mhv] ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

  #11001·ranjiGT opened Nov 8, 2026·

  ·
  2

• Correct affected scope for GHSA-c3xh-98xp-6qhf: repository workflow, not Action consumers

  #11000·XY-code1 opened Nov 8, 2026·

  ·
  1

• Add upstream fix and release references for GHSA-5xjx-3w67-w9x9

  #10999·XY-code1 opened Nov 8, 2026·

  ·
  1

• Correct patched version for vm2 GHSA-qvjj-29qf-hp7p to 3.10.4

  #10998·XY-code1 opened Nov 8, 2026·

  ·
  1

• [GHSA-86w9-cpqp-85rv] node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements

  #10997·brettshearer opened Nov 8, 2026·

  ·
  1

• [GHSA-72r4-9c5j-mj57] Add CVE alias CVE-2026-59194

  #10995·munimv2 opened Nov 8, 2026·

  ·
  1

• [GHSA-hfhx-w8p8-4hc7] Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

  #10993·zuhairhalawa opened Nov 7, 2026·

  ·
  1

• [GHSA-gh4h-34gr-87r7] Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

  #10992·zuhairhalawa opened Nov 7, 2026·

  ·
  1

• [GHSA-cr7p-cr3q-h5cm] Budibase: Account Enumeration via Login Lockout Response Differential

  #10991·zuhairhalawa opened Nov 7, 2026·

  ·
  1

• [GHSA-4qcj-m5wp-jmf4] Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings

  #10990·zuhairhalawa opened Nov 7, 2026·

  ·
  1

• [GHSA-2xgg-r2wc-c5r2] Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector

  #10989·zuhairhalawa opened Nov 7, 2026·

  ·
  1

• [GHSA-c7hr-448w-65px] MeshCentral has unsanitized data fields

  #10988·ranjiGT opened Nov 7, 2026·

  ·
  2

• [GHSA-vwg3-w8w3-pc79] Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems

  #10986·rhukster opened Nov 7, 2026·

  ·
  1

• [GHSA-v8x2-fjv7-8hjh] Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions

  #10985·rhukster opened Nov 7, 2026·

  ·
  3

• [GHSA-rmw5-f87r-w988] Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint /admin/accounts/groups/[group] parameter data[readableName]

  #10984·rhukster opened Nov 7, 2026·

  ·
  2

• [GHSA-r3rg-jrjq-w4mr] Grav CMS Local File Injection

  #10983·rhukster opened Nov 7, 2026·

  ·
  1

• [GHSA-q3qx-cp62-f6m7] Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure

  #10982·rhukster opened Nov 7, 2026·

  ·
  4