GHSA-M4RF-3FR8-XWX3 NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

Vulnerability The fix for CVE-2026-12841 CWE-88, JVM argument injection added validatejavaoptions to block dangerous JVM flags such as -agentlib, -agentpath, -javaagent, -Xrunjdwp, and @argfile references. However, the validation is only applied when setting global options via configjava. The jav...

GHSA-8RR7-CVQ3-GMFH league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

Impact AttributesExtension ships with the library but must be explicitly registered on the Environment; it is not included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register AttributesExtension are not affected by this...

GHSA-6HWM-XVPH-95VM NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

GHSA-JJV6-8J6V-6J52 league/commonmark: Denial of service in the SmartPunct and Attributes extensions

Impact Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the Environment; neither is included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register...

GHSA-F8FG-PG57-V4J8 league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

Summary The AttributesExtension documents a security guarantee: Note: Attributes starting with on e.g. onclick or onerror are capable of executing JavaScript code and are therefore never allowed by default. You must explicitly add them to the allow list if you want to use them. —...

GHSA-J8PM-GJ4C-RQ4X league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

Impact Affected versions of league/commonmark perform super-linear work on three independent parsing paths, all of which are reachable on a stock new CommonMarkConverter with default configuration and no extensions registered. Each trigger fits on a single line of input, so no complex Markdown...

GHSA-8423-8FGW-73VQ tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

Description Summary parsemultipartformdata httputil.py:34 calls data.splitb"--"+boundary+b"\r\n" before the maxparts check :35. A 600KB body with 100k parts creates a 100k-element transient list first, then rejects transient memory amplification each split element is a copy. Pre-auth HTTP DoS. Ro...

GHSA-WWV5-G3V4-889X Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Summary The CVE-2026-35536 fix added a validation loop that rejects \x00-\x20\x3b\x7f, but only for the hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated kwargs path writes attacker-supplied attribute values straight into the Morsel with no validation, and because...

GHSA-2M8G-3CMR-WG3W Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

Summary While investigating Django REST Framework's request parsing behavior, I identified that DRF's high-level request.data parsing appears to bypass Django's configured DATAUPLOADMAXMEMORYSIZE protection for application/json and application/x-www-form-urlencoded request bodies. In the tested...

GHSA-G47C-3XMW-Q6M2 Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

Summary AdminRenderer may disclose data that would normally be protected by GET permissions when rendering a 400 Bad Request response for an invalid write request. If a view allows POST or another write method but denies GET, an invalid request rendered through AdminRenderer can invoke the view's...

GHSA-XWG4-73V4-XW9W nanoid: Integer Overflow or Wraparound

Summary An integer overflow in nanoidsize permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string "uuuuuuuuuuuuuuuuuuuuu". Any application that passes user-influenced values to the size parameter loses all randomness guarantees fo...

GHSA-VX52-2968-3VC6 pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Summary pnpm expands $VAR environment placeholders in the httpProxy / httpsProxy / noProxy settings read from a project's pnpm-workspace.yaml. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs pnpm install in can route all install...

GHSA-2RX9-3G3H-C2JV pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

Summary A crafted lockfile alias could reach several install-time filesystem joins. With --trust-lockfile or a frozen lockfile, traversal segments could create links outside the intended project or nodemodules boundary. This patch validates dependency names and every virtual-store slot before...

GHSA-3WGP-X9P5-C7CC Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

Summary Appium's base-driver mounts the built-in /test/guinea-pig, /test/guinea-pig-scrollable and /test/guinea-pig-app-banner routes unconditionally on every server. The handler reflects the throwError query param, the comments POST field, and the User-Agent request header into the returned HTML...

GHSA-GQVG-GMMX-X4HM MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

Summary MLflow introduced MLFLOWALLOWPICKLEDESERIALIZATION as a security control to prevent unsafe pickle.load execution during model loading, in response to CVE-2024-37052 through CVE-2024-37060. When set to False, operators expect all pickle deserialization to be blocked. The most recent relate...

GHSA-C83G-RGW3-J3CX Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

Vulnerability Details File: index.js Location: cache browserslist's result cache, line 402 and parseCache parseQueries's AST cache Root Cause js var cache = var parseCache = function browserslistqueries, opts ... var cacheKey = JSON.stringifyqueries, context if cachecacheKey return cachecacheKey...

GHSA-73WF-GQ98-2V4G Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)

Vulnerability Details File: node.js Function: normalizeStats line 214, reached from getStat called unconditionally on every browserslist call and loadStat Root Cause js function normalizeStatsdata, stats if !data data = if stats && 'dataByBrowser' in stats stats = stats.dataByBrowser if typeof...

GHSA-3F6P-5WW8-9RCR MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

Summary A rogue MySQL server or MITM can force mysql2 to send credentials in plaintext by requesting an auth switch to mysqlclearpassword. The driver complies without verifying that TLS is active. Details mysqlclearpassword is registered as a default standard plugin in lib/commands/authswitch.js...

GHSA-CQ55-C7WV-PXMQ Smarty: SSRF via redirect bypass of trusted_uri using {fetch}

When a Security policy is active, fetch validates the requested remote URL against the trusteduri allowlist via Security::isTrustedUri. For non-http:// schemes e.g. https:// the resource was then read with filegetcontents, which follows HTTP redirects by default. Because isTrustedUri only validat...

GHSA-RF2P-VH74-7VVH Kirby: System path exposure from error messages in the REST API

TL;DR This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' = false option. It was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default...

GHSA-X9R9-C232-4Q39 Hugging Face Transformers downloads custom generation code before trust consent

A vulnerability in Hugging Face Transformers versions 4.49.0, = 5.8.1 allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.loadcustomgenerate. The function fetches and caches a remote module file before performing the required...

GHSA-C9FF-59G8-M36Q jolokia-service-jsr160 Incomplete target JMX Service URL deny list handling for user-controlled input

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service URLs allows a bypass of the denylist introduced to mitigate CVE-2018-1000130. The proxy accepts a target.url value from a Jolokia POST request and passes it to JMXServiceURL an...

GHSA-RGWJ-5XJ2-C3M3 MySQL2: Unbounded zlib inflate in compressed MySQL protocol handler allows decompression-bomb DoS

Vulnerability Details File: lib/compressedprotocol.js Line: 43 zlib.inflatebody, err, data = ... inside handleCompressedPacket Root Cause When a connection is created with compress: true and the server advertises CLIENTCOMPRESS, every incoming packet is unwrapped by handleCompressedPacket in...

GHSA-67MX-6WF2-92XP Kirby: File upload permissions are not checked during processing of chunk data

TL;DR This vulnerability affects all Kirby sites where users of a particular role have access to the REST API access.panel permission is enabled but no permission to upload any kind of file files.create, files.replace and user/users.update permissions are all disabled. It was possible to fill up...

GHSA-9VX2-J98C-P72W Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes %2f, such as nginx, PHP's built-in server or Apache setups that have the option AllowEncodedSlashes enabled. It was possible to create and access thumbnails from media...

GHSA-VCC3-GHJQ-M6FR decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

Impact An attacker who can supply input to decodeUriComponent directly or via a dependency that uses this package on URL/query/path data can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote...

GHSA-VF76-F5CP-9846 Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The...

GHSA-GR94-W7QR-F4J3 Socket.IO: Engine.IO WebTransport SID DoS

Impact Engine.IO servers with WebTransport enabled are vulnerable to a remotely triggerable denial of service. A malicious unauthenticated client can send a crafted WebTransport upgrade request containing a specially chosen session ID, such as proto. Because the session ID lookup did not properly...

GHSA-FM3F-CH8H-QW8Q @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

GHSA-8X3Q-JPJH-QH5C elFinder: SSRF protection bypass via DNS rebinding in the `fsock_get_contents()` fallback

poc.zip Summary elFinder 2.1.69 is vulnerable to a Server-Side Request Forgery SSRF protection bypass when PHP cURL is unavailable and URL uploads use the fsockgetcontents fallback. An attacker who can submit a URL for server-side upload can use an attacker-controlled DNS hostname that initially...

GHSA-MFQJ-CQV3-H7XW TYPO3 CMS - Unrestricted File Upload in Form Framework

Problem Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured - uploading PHP files was not possible. The restriction was not enforced server-side because the MimeTypeValidator was registered during form buildi...

GHSA-FRJ6-5RHH-VWFW Duplicate Advisory: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-r7g4-qg5f-qqm2. This link is maintained to preserve external references. Original Description Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false...

GHSA-H3HJ-CMCX-XC66 Duplicate Advisory: Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-p6gq-j5cr-w38f. This link is maintained to preserve external references. Original Description nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option,...

GHSA-G5XC-5W98-JFVM MariaDB has possible SQL injection in Buffer parameter escaping under big5/gbk/sjis/cp932/gb18030 client charsets

Summary A SQL injection is possible when the connector escapes Buffer parameters client-side under a multi-byte client character set whose trail-byte range overlaps the ASCII backslash 0x5C: big5, gbk, sjis, cp932, and gb18030. Under these charsets, an attacker-controlled lead byte can absorb the...

GHSA-FFG3-P8FM-MJX2 RestrictedPython guard hooks can be shadowed via positional-only arguments

Impact RestrictedPython rewrites sensitive operations to go through guard hooks. Attribute access becomes getattrobj, name, item access becomes getitemobj, key, writes go through write, and print goes through print. The embedding application supplies these hooks to enforce its policy. Argument-na...

GHSA-C857-9X2M-CVH2 org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can request a clear-text plugin over an unencrypted plain-TCP connection, and the driver responds with the user's password in cleartext on the wire...

GHSA-5RQC-86VF-G8R2 org.mariadb:r2dbc-mariadb has Inappropriate Encoding for Output Context and Improper Encoding or Escaping of Output

Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data...

GHSA-XVR9-35CR-46V9 org.mariadb.jdbc:mariadb-java-client has Inappropriate Encoding for Output Context

Summary The connector encodes and decodes all character data assuming the connection character set is UTF-8. A server can change charactersetclient mid-session to a non-UTF-8 charset, after which the driver and server interpret the same bytes under different encodings, causing silent data...

GHSA-QXVW-FVWX-5CP7 org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

Summary When PAM dialog authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. Details The...

GHSA-G9JJ-CGMH-9F38 MariaDB has cleartext password disclosure to a MITM on the initial-handshake

Summary When a Java application connects with sslMode=verify-full or verify-ca and a password but does not pin a server certificate, Connector/J deliberately accepts an untrusted/self-signed certificate at the TLS layer the "MITM-proof without a CA" feature and proves the server's identity...

GHSA-J5G3-42WP-GQM3 Snipe-IT has an Improper Privilege Management issue

Impact The update method in UsersController passes the permission request field unconditionally to NormalizePermissionsPayloadAction, which returns an empty array when the field is absent. The result is passed to PreserveUnauthorizedPrivilegedPermissionsAction, which selectively restores only the...

GHSA-5V29-34H8-V68R MapFish Print has XXE that allows reading arbitrary files of certain types

Summary XXE on MapFish Print allows reading arbitrary files of certain types. Eg /etc/passwd or k8 secrets and certs. https://github.com/mapfish/mapfish-print/commit/13020c0fbc299e5f604e4e66066311c4bf04d507 Details To trigger the XXE it is required to host a remote script and dtd file. When using...

GHSA-FP46-6VFW-GC9C free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

Summary The AUSF component of free5GC compares authentication response values with normal Go equality helpers instead of constant-time cryptographic comparison functions. Two authentication flows are affected in internal/sbi/processor/ueauthentication.go: 1. 5G-AKA confirmation compares RES and...

GHSA-334Q-H5G3-FPXV free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

Summary The AUSF component of free5GC stores per-subscriber authentication state in a global sync.Map keyed only by SUPI. Every incoming authentication request creates a new AusfUeContext and stores it under that SUPI key without checking whether an authentication procedure is already in progress...

GHSA-M4G4-86QC-V8W7 silverstripe/versioned has XSS in archive admin restore

Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin Reporter Steve Boyd Silverstripe Ltd...

GHSA-56WQ-X3WV-3FF4 SeaweedFS: Path traversal in the S3 gateway X-Amz-Copy-Source header allows cross-bucket object read

Summary The SeaweedFS S3 API gateway did not reject .. path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. The request URL path was hardened against traversal in 4.30 CVE-2026-54917, but the copy-source header was only checked for emptiness, so a .. segment in the...

GHSA-HGPF-8634-G44C SeaweedFS: Improper authorization in the S3Tables / Iceberg REST management API lets a low-privileged S3 user enumerate administrator-owned table buckets

Summary SeaweedFS routes requests signed with SigV4 service s3tables to the S3Tables management API. Authorization on that path collapsed account-less S3 identities into the shared admin account and failed open, so a user holding only ordinary S3 Read credentials — and no S3Tables-specific...

GHSA-J769-9GV9-65GR Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens

Impact Graylog contains an insecure direct object reference IDOR vulnerability in the token revocation endpoint. An authenticated user can delete access tokens belonging to other users, including service account tokens and administrator tokens, if they know or can guess a valid token identifier...

GHSA-GQR6-R77P-C2PJ Fortigate syslog message parser can be exploited to modify or delete fields from the original message

Impact A security issue has been identified in Graylog affecting the parsing of syslog messages that use a key-value format, such as those generated by Fortigate devices. The vulnerability allows attackers to overwrite individual message fields, or to produce invalid messages which Graylog will...

GHSA-MRPP-V6PG-P54X klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply

Summary On the SFT add-quantity path the only supply bound is SFTAddCirculation, which does meta.Circulation += amount with no overflow guard, then checks if meta.Circulation meta.MaxSupply && meta.MaxSupply != 0. If amount overflows int64 and wraps negative, negative MaxSupply is false, the cap...