GHSA-4QHR-QF46-FCRX Duplicate Advisory: Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-63gh-g2x5-x69v. This link is maintained to preserve external references. Original Description Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

GHSA-Q72M-F2R4-W4CW Duplicate Advisory: Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2j8r-3c22-8565. This link is maintained to preserve external references. Original Description Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network...

GHSA-MQVM-GMC4-6RV2 Duplicate Advisory: Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-527h-q9f6-p7qx. This link is maintained to preserve external references. Original Description Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a...

GHSA-V3F6-M9J2-437P Duplicate Advisory: Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8cp2-47hg-mfgh. This link is maintained to preserve external references. Original Description Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to den...

GHSA-8M2G-8CGM-3VCP DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather than the actual...

GHSA-C4C3-7FPV-J4Q5 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Summary A fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is the sole mTLS gate, an unauthenticated attacker can bypass the route's mTLS requirement. Details In...

GHSA-FCCG-MWVH-QQG4 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

Summary Netty's default SNI entrypoint reparses and recopies previously received ClientHello fragments on every additional TLS handshake record. A remote peer can send a small first record that advertises a large ClientHello length and then drip the body in many tiny records, causing superlinear...

GHSA-6X6C-W9W9-HV4H Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Impact Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint. The condition that...

GHSA-MMG6-4QMV-6PC8 Infracost: Arbitrary file read via config-template readFile symlink traversal

Impact Path traversal via link following in the Infracost config-template parser. The readFile, pathExists, isDir, and matchPaths template functions confined repo-supplied paths with a lexical filepath.Rel check plus a leaf-only os.Lstat: readFile "evil/file" With an intermediate directory symlin...

GHSA-P2W3-6X73-2F6X Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

Summary The isBlockedIP SSRF guard in Dozzle's webhook notification dispatcher blocks loopback, link-local, multicast, and unspecified addresses but does not recognize IPv6 transition mechanism addresses RFC 3056 6to4, RFC 6052 NAT64, RFC 4380 Teredo that embed arbitrary IPv4 addresses. An...

GHSA-4R6H-5V86-94P3 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

Summary The join filter src/filters/array.ts:8-13 charges memoryLimit by array element count, not by the string length it produces, letting a template bypass a configured memoryLimit and allocate strings far past budget — bounded only by V8/process limits, not by memoryLimit. Details js //...

GHSA-C2JG-2778-GGM4 Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

Summary Prowler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...

GHSA-8CW4-87C7-C6XX node-csv: Prototype replacement still reachable via columns path

Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj'proto', invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 Object.hasOwn duplicate...

GHSA-5QR2-V392-M9G8 SWC HTML minifier may allow script element breakout when minifying embedded JSON

Impact @swc/html minifies JSON contained in script elements such as application/json and application/ld+json by parsing and serializing the JSON value. Before the patched versions, JSON serialization could convert escaped less-than signs such as \u003C into literal sequence, the generated HTML...

GHSA-XP7J-H7JC-4W8P Semaphore U: OS Command Injection

Summary An OS command injection in repository giturl handling lets any user holding the Manager or Owner role on any project the normal project-collaborator roles achieve remote code execution on the Semaphore server host. Using git's --upload-pack= option, an attacker runs arbitrary commands. Th...

GHSA-RCR6-4JQH-J84M Gitea: Remote Code Execution via diffpatch Git Hook Installation

Summary Gitea's diffpatch endpoint can be abused to install and execute a Git hook from repository-controlled content. An attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user. With default open registration, an unauthenticated visitor can...

GHSA-V684-Q882-JGMQ SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked

CVE: This vulnerability corresponds to CVE-2026-72789. Summary publishAccess.json is an opt-out list. The publish gate returns accessible for anything not explicitly listed in it. Encrypted notebooks are never written into that file, because only the administrator-gated setPublishAccess writes it...

GHSA-74PJ-6G7R-J55C SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /api/notebook/getNotebookInfo

CVE: This vulnerability corresponds to CVE-2026-72790. Relationship to GHSA-8x84-r2ff-h8pq please read first getNotebookInfo is named in the earlier advisory GHSA-8x84-r2ff-h8pq, in its remediation section, which asked for reader filtering on both getNotebookConf and getNotebookInfo. Commit...

GHSA-57V5-WQX3-CGJ4 SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

Scope note please read first This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit acfc02ee8 "Improve database field visibility across views", 11020 and is live on v3.7.4-alpha.1, so it will ship in v3.7.4 unless gated first. No released stable...

GHSA-3GQ4-3J92-5W49 NLTK: Corpus Reader Sandbox Bypass

Summary NLTK corpus-reader constructors can still reach outside-root file and database reads before the nltk.pathsec sandbox boundary is enforced. The PoC shows the safe path blocked by pathsec.open, then LinThesaurusCorpusReader and PanLexLiteCorpusReader succeeding in the same process. Affected...

GHSA-P4RW-RVV2-7XWR NLTK: Corpus readers follow symlinks outside trusted roots despite pathsec enforcement

Summary Several corpus readers still step outside NLTK's symlink-aware trusted-root model. They derive in-root paths from trusted corpus state, convert those paths back into plain strings, and reopen them with built-in open rather than nltk.pathsec.open. Details - Vulnerability type: Path travers...

GHSA-X99W-6FGC-PMFW NLTK: Allowlisted pickle loaders still permit code execution in current source

Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...

GHSA-97QJ-X29F-37W7 NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses

Several XML parsing sites in NLTK still used xml.etree.ElementTree directly, which honours declarations in a document's internal DTD subset. A crafted document a few hundred bytes long can expand to megabytes in memory each nesting level multiplies by ten, a denial-of-service. Affected call sites...

GHSA-6WW7-3FRV-CQXH NLTK: pathsec SSRF protection can be bypassed when a proxy is configured

Summary Current NLTK source reopens SSRF in proxied environments. pathsec.urlopen validates the requested hostname locally, but once proxy inheritance is enabled the real fetch is performed by the proxy rather than by the validated direct-connect socket path. Details - Vulnerability type:...

GHSA-RHP5-R9X4-F5G2 NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

Summary The NLTK library's TransitionParser.parse method deserializes model files using pickleload with the default restricted=False parameter, allowing arbitrary Python code execution when loading a malicious model file. The library provides a RestrictedUnpickler class for safe deserialization,...

GHSA-3HHW-38PF-PXJ6 NLTK: Symlink-based arbitrary file read in IPIPANCorpusReader, bypasses nltk.pathsec entirely

Summary IPIPANCorpusReader nltk/corpus/reader/ipipan.py exposes public methods, channels, domains, categories, and fileidschannels=..., that accept a caller supplied fileids list and read a file via a completely unprotected builtin open call, with no nltk.pathsec involvement at all. A symlink...

GHSA-F833-7JW8-XWRV NLTK: Symlink-based sandbox bypass in FramenetCorpusReader (bypasses the fix for CVE-2026-54292)

This is a new, distinct vulnerability: a bypass of the fix already published as GHSA-xh95-f55m-82fw "Path traversal in NLTK FramenetCorpusReader.frame allows arbitrary XML file read, bypassing the nltk.pathsec sandbox", not a duplicate of it. Summary The original advisory was fixed PR 3581 by...

GHSA-568F-PV23-39P4 NLTK: Stable FrameNet and NKJP readers parse outside-root XML

Summary Published nltk==3.9.4 still contains several XML-reader entrypoints that build parser paths from caller-controlled selectors or trusted-looking index state without preserving the corpus-root boundary. Details - Vulnerability type: Path traversal and trusted-root bypass - Affected componen...

GHSA-5WP5-5229-5G6Q NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection

NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...

GHSA-X5PH-MJ9P-RFR8 NLTK: StreamBackedCorpusView Bypasses pathsec.ENFORCE - Arbitrary Local File Read

Summary Setting nltk.pathsec.ENFORCE = True is documented to sandbox all file access to allowed NLTK data directories and raise PermissionError on unauthorized access. However, StreamBackedCorpusView opens files via builtins.open directly, bypassing pathsec.validatepath entirely. An attacker who...

GHSA-72R2-7MFR-5XR9 NLTK: FileSystemPathPointer.open() sandbox check is dead code — arbitrary file read via file:// protocol

Summary There's a logic bug in FileSystemPathPointer.open inside nltk/data.py that makes the sandbox check permanently inert. The guard condition is always False — meaning any file the process can read is accessible by passing a file:// URL to nltk.data.load. --- Details In nltk/data.py,...

GHSA-R6GQ-WHWQ-MVG9 NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root

Summary nltk.corpus.reader.api.CorpusReader.open can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does not account for symlink resolution. This lea...

GHSA-5CWM-P7PJ-GQP2 Duplicate Advisory: Sensitive information written to logs by Snowflake drivers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qqj6-54q6-cxv6. This link is maintained to preserve external references. Original Description Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drive...

GHSA-955M-RR6M-2F9V @sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data...

GHSA-QJRQ-CVV4-3G9W Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9gfj-28hw-jchp. This link is maintained to preserve external references. Original Advisory knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, creat...

GHSA-6PH4-R249-58P2 Duplicate Advisory: knowns vulnerable to command injection

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mc52-mwq4-vfx3. This link is maintained to preserve external references. Original Description knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files...

GHSA-FG72-Q65G-WM5W Duplicate Advisory: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of Service

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q5pr-72pq-83v3. This link is maintained to preserve external references. Original Description h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in...

GHSA-7Q9C-HPX7-9CWM TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

Summary @typespec/spector registers a POST /.admin/stop HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to...

GHSA-RH53-XVX2-J327 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

Summary The OpenChoreo control-plane cluster-gateway exposes internal management APIs /api/proxy/, /api/exec/, /api/wirelogs/ that tunnel requests through to connected data planes' Kubernetes APIs, but the internal listener authenticates no caller. Its request validator permits mutating HTTP...

GHSA-PR7F-P5MW-FC87 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts

Executive Summary The follow-up protection for CVE-2025-62164 is incomplete at vLLM revision 26587f9519e22a5c4549ead7595ad9ca3229c4fd. It wraps serialized prompt-embedding reconstruction and dense conversion in torch.sparse.checksparsetensorinvariants, but PyTorch 2.11.0 implements that context...

GHSA-48JH-3GJ7-FG8V vLLM: ReDoS via structured_outputs.regex in the lm-format-enforcer backend (no compile timeout) — missed sibling of GHSA-rwxx-mrjm-wc2m

Summary The fix for GHSA-rwxx-mrjm-wc2m "ReDoS via structuredoutputs.regex compiled without timeout" wrapped the regex compile in the xgrammar and outlines backends with compileregexwithtimeout and, for outlines, validateregexisbuildable. The lm-format-enforcer backend was left unguarded: it...

GHSA-HWRM-C4CX-RF4J vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

Summary When the vLLM API receives a malformed request e.g., invalid JSON or missing required fields, FastAPI raises a Pydantic RequestValidationError. The validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts this exception to a string via strexc, which includes the...

GHSA-8737-QX52-HJFF vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds

Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...

GHSA-MP7R-57W4-5QM3 SiYuan: Tag labels from password-protected documents are returned to readers who have not entered the password

CVE: This vulnerability corresponds to CVE-2026-72792. Summary /api/tag/getTag filters its results for reader roles through FilterTagsByPublishIgnore, which checks only the visible publish tier. Documents that are published but password-protected pass that check, so a reader who has never entered...

GHSA-H4V5-CRX2-3CV4 SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72793. Summary /api/system/getConf is registered with CheckAuth only and is reachable by the publish RoleReader token, and anonymously when Publish.Auth.Enable is false. Its non-administrator masking chain is a blocklist that enumerates fields...

GHSA-H6W7-XXCF-W2MQ SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72795. Summary /api/block/getBlockDOMWithEmbed and /api/block/getBlockDOMsWithEmbed gate only the requested block against publish access. The blocks pulled in by that block's embed transclusion query are inlined into the returned DOM with no...

GHSA-34FJ-MWM6-FJFG SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

CVE: This vulnerability corresponds to CVE-2026-72794. Summary /api/system/getConf returns Conf.CookieKey, the key used to sign the server's session cookies in its response body. The endpoint is registered with CheckAuth only, so the field reaches the publish RoleReader token and the anonymous...

GHSA-FGMR-7W36-9QFQ SiYuan: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72796. Summary Several static-file routes in the server mux kernel/server/serve.go are registered with CheckAuth only and serve directories directly, without the publish-access checks, sensitive-path blocklist, or refuseToAccess rules that the REST...

GHSA-F2RW-W22V-54VH SiYuan: getEncryptedNotebookStatus discloses names and current lock/unlock state of all encrypted notebooks to anonymous readers

CVE: This vulnerability corresponds to CVE-2026-72797. Summary POST /api/notebook/getEncryptedNotebookStatus returns the identifier, name, and current lock state of every encrypted notebook, with no publish-access filtering. The route is registered CheckAuth only, no CheckReadonly, no...

GHSA-MFRJ-V65R-979C SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

CVE: This vulnerability corresponds to CVE-2026-72798. Summary renderAttributeView correctly applies the reader publish-access filter, but the filter's row-accessibility decision is keyed solely to the row's first cell, and it never inspects the remaining cells' values. Relation and Rollup cells...