All pull requests

Pull requests

• [GHSA-rpg2-jvhp-h354] Yggdrasil Vulnerable to Local Privilege Escalation

  #10728·SiteQ8 opened Oct 28, 2026·

  ·

• [GHSA-7gj6-22m4-qfhx] DB-GPT Arbitrary File Write vulnerability

  #10727·SiteQ8 opened Oct 28, 2026·

  ·

• [GHSA-6973-8887-87ff] nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

  #10726·SiteQ8 opened Oct 28, 2026·

  ·
  1

• [GHSA-hm2w-vr2p-hq7w] UEFI Firmware Parser has a heap out-of-bounds write in tiano decompressor ReadCLen

  #10725·SiteQ8 opened Oct 28, 2026·

  ·
  1

• [GHSA-2689-5p89-6j3j] UEFI Firmware Parser has a stack out-of-bounds write in tiano decompressor MakeTable

  #10724·SiteQ8 opened Oct 28, 2026·

  ·
  1

• [GHSA-54j7-grvr-9xwg] Command Injection in adb-mcp MCP Server

  #10723·SiteQ8 opened Oct 28, 2026·

  ·
  1

• [GHSA-8vvx-qvq9-5948] Flowise allows arbitrary file write to RCE

  #10722·SiteQ8 opened Oct 28, 2026·

  ·
  1

• [GHSA-h42x-xx2q-6v6g] Flowise Pre-auth Arbitrary File Upload

  #10721·SiteQ8 opened Oct 28, 2026·

  ·
  1

• [GHSA-8whc-2wmv-ww35] WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

  #10720·SiteQ8 opened Oct 28, 2026·

  ·
  1

• Classify the authlib PyPI project reference as PACKAGE

  #10719·p-linnane opened Oct 28, 2026·

  ·
  1

• Clarify historical msgpack exposure in GHSA-j586-36cw-2gc2

  #10718·p-linnane opened Oct 28, 2026·

  ·
  3

• Include pre-3.1.30 GitPython releases in GHSA-f9j4-qggq-h239

  #10717·p-linnane opened Oct 28, 2026·

  ·
  2

• Replace stale latest-release wording in GHSA-cx6f-vjhg-g3cc

  #10716·p-linnane opened Oct 28, 2026·

  ·
  1

• Classify the h11 PyPI project reference as PACKAGE

  #10715·p-linnane opened Oct 28, 2026·

  ·
  1

• Align GHSA-23mf-xhv8-69c2 CVSS v4 with the CNA record

  #10714·p-linnane opened Oct 28, 2026·

  ·
  2

• Include POSIX path escapes and repair formatting in GHSA-xmj3-9gf7-h52w

  #10713·p-linnane opened Oct 28, 2026·

  ·
  1

• Add CVE-2026-73622 alias to GHSA-94p4-4cq8-9g67

  #10712·alimony opened Oct 28, 2026·

  ·
  3

• [GHSA-5v8v-66v8-mwm7] Add npm iltorb (bundles Brotli C older than 1.0.8)

  #10710·r-bedekar opened Oct 27, 2026·

  ·

• [GHSA-fj9w-c36g-h5x8] AsyncHttpClient doesn't verify SCRAM and Digest mutual-authentication responses

  #10708·ranjiGT opened Oct 27, 2026·

  ·
  2

• [GHSA-79qf-vqgc-7xx3] ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

  #10707·ranjiGT opened Oct 27, 2026·

  ·
  2

• [GHSA-pjr3-86v4-5p7w] Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)

  #10706·drawliin opened Oct 27, 2026·

  ·
  1

• [GHSA-rm89-rhwj-9j92] Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators

  #10705·neotrow opened Oct 27, 2026·

  ·
  2

• Improve GHSA-f525-44xv-f2qj

  #10703·hara-satoshi-ymr opened Oct 27, 2026·

  ·
  1

• [GHSA-f3j8-8ggq-f9x2] In Eclipse hawkBit versions 1.0.3 and prior, a privilege...

  #10702·Santoshkumarpuppala opened Oct 27, 2026·

  ·

• [GHSA-6v25-8wq6-xq4j] Hazelcast allows arbitrary member memory access by low-privileged client

  #10701·JackPGreen opened Oct 27, 2026·

  ·
  2