All pull requests

Pull requests

• [GHSA-9rjg-x2p2-h68h] API Platform Core: Relation IRIs are not type-checked: a related resource can be denormalised as the wrong resource type (type confusion)

  #10848·fabianbloching opened Nov 2, 2026·

  ·
  1

• [GHSA-jj36-9pvh-vj5r] Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation

  #10847·ranjiGT opened Nov 2, 2026·

  ·
  2

• [GHSA-2qrf-pqgx-qh9v] Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

  #10846·ranjiGT opened Nov 2, 2026·

  ·
  4

• [GHSA-vpp8-g58w-m8mp] Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset

  #10845·ranjiGT opened Nov 2, 2026·

  ·
  3

• [GHSA-53xc-49m8-p798] Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

  #10844·ranjiGT opened Nov 2, 2026·

  ·
  3

• [GHSA-cwm5-jh59-mwxr] Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

  #10843·ranjiGT opened Nov 2, 2026·

  ·
  3

• [GHSA-q7qq-6mhp-9rc4] Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

  #10842·ranjiGT opened Nov 2, 2026·

  ·
  3

• [GHSA-9m4w-fmjw-fvjq] Ghost: Regular Expression Denial of Service in External Media Inliner

  #10840·ranjiGT opened Nov 2, 2026·

  ·
  2

• [GHSA-xr8f-h2gw-9xh6] Set 1.7.0-beta.2 as the patched version for the 1.7.0 beta range

  #10839·mikeflame opened Nov 2, 2026·

  ·
  1

• [GHSA-f66q-9rf6-8795] Add patched version 5.8.2

  #10838·mikeflame opened Nov 2, 2026·

  ·
  2

• [GHSA-hm7r-c7qw-ghp6] Add patched version 6.2.0 for fast-jwt

  #10837·mikeflame opened Nov 2, 2026·

  ·
  2

• [GHSA-g3hv-75wg-m249] minimatch: affected range starts at 7.0.0

  #10836·mgx-systems opened Nov 2, 2026·

  ·

• [GHSA-7hp6-4w63-5g45] LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key

  #10835·Haruna38 opened Nov 2, 2026·

  ·
  1

• [GHSA-2j2x-2gpw-g8fm] flat: correct 4.x affected range to >= 4.0.0, < 4.1.1

  #10833·superbot-helper opened Nov 2, 2026·

  ·
  1

• [GHSA-5849-834g-hvw5] pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

  #10832·Gotradepal opened Nov 2, 2026·

  ·
  2

• [GHSA-9fwh-fc64-58p8] SimplePie through 1.9.0 contains a local file read...

  #10830·jtojnar opened Nov 2, 2026·

  ·

• [GHSA-g2v8-7jhw-pp8p] Backstage: Sensitive information exposure in Scaffolder

  #10829·superbot-helper opened Nov 1, 2026·

  ·
  3

• [GHSA-wp74-jgxh-gv4q] Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

  #10827·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-rp2p-6cmp-jxj9] Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

  #10826·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-w7cw-xp7h-6j5j] Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

  #10825·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-2969-4q4w-w5h3] Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

  #10824·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-23fw-v26w-5fgq] Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability

  #10823·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-cpm7-cfpx-3hvp] Emissary has Stored XSS via Navigation Template Link Injection

  #10822·ranjiGT opened Nov 1, 2026·

  ·
  2

• [GHSA-6c37-7w4p-jg9v] Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

  #10821·ranjiGT opened Nov 1, 2026·

  ·
  2

• [GHSA-3p24-9x7v-7789] Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix

  #10820·ranjiGT opened Nov 1, 2026·

  ·
  2