GHSA-M5PH-MMG5-6W5H filecoin-pin: Unbounded DAG pinning can exhaust server resources

Summary The IPFS Pinning Service API implementation accepts a caller-controlled CID through POST /pins, queues background processing, and then recursively fetches the full DAG with helia.pins.addcid. The route and background pinning path do not enforce a request rate limit, per-user quota, maximu...

GHSA-64VX-6H2C-RJH7 Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE

Summary banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that handles a tool call. There is no allowlist or sanitization on importpath, so any importable...

GHSA-5Q7H-W9JF-CX97 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts

Summary kaniko before v1.25.20 can send a Microsoft Entra ID Azure AD access token for Azure Resource Manager to a registry host an attacker controls. A Dockerfile that references an image on a lookalike host, such as FROM x.azurecr.io.attacker.com/img, is enough. The build needs no RUN instructi...

GHSA-HHF9-QW4V-72XP lxd allows Cross-guest volume hijack via DevLXD device patch

Summary A guest can mount another guest's custom storage volume over /dev/lxd and read or write its contents without owning it. The DevLXD storage API blocks access to volumes you don't own, but the instance device-update path that attaches a volume to a container without checks ownership. Any...

GHSA-93CM-2V4M-C56C Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

Summary The fix for CVE-2026-47735 released 2026.06.1 is incomplete. It added a DuckDB sandbox SET GLOBAL alloweddirectories=; SET GLOBAL enableexternalaccess=false and an Arc SQL-layer denylist of the literal functions readparquet and arcpartitionagg. The sandbox correctly blocks reads outside t...

GHSA-MC8M-RR6C-R5QR @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

Impact In affected configurations, client upload access does not consistently align with the associated collection’s access configuration. You are affected if: - You use client uploads with @payloadcms/storage-vercel-blob. - Authenticated users can access the client-upload route. Applications tha...

GHSA-3CGG-C5PP-57H6 odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

Summary ODF style attribute values are interpolated into style="..." attributes without HTML-escaping in both of odf-kit's to-HTML renderers odtToHtml and odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute...

GHSA-GH9R-C94J-CMP5 Stanza: RCE via pickle deserialization in the lemmatizer

TL;DR Loading an attacker-supplied lemma .pt runs arbitrary code as the loading user. Since 1.14.0 the lemmatizer stores posdict as a gzip-compressed pickle in the checkpoint's dicts field a bytes value. torch.loadweightsonly=True treats bytes as a primitive and passes it through unexamined, so i...

GHSA-P3JP-9V83-76W9 Microsoft Security Advisory CVE-2026-111497 - .NET Brotli Decoder Out-of-bounds Write Vulnerability

Executive summary A buffer overflow vulnerability exists in the Brotli decompression library used by .NET. This vulnerability may allow an unauthenticated attacker to read or corrupt process memory. This could lead to information disclosure, denial of service, or elevation of privilege. ASP.NET...

GHSA-48V2-6JCM-FC99 praktor: Path traversal in Telegram file uploads allows writing outside the agent workspace uploads/ directory (stored instruction injection)

Impact A remote Telegram user can write files to arbitrary paths inside an agent's persistent workspace volume praktor-wk-, mounted at /workspace/agent, escaping the documented uploads/ directory. The attacker controls the Telegram document filename, which was concatenated into the destination pa...

GHSA-J97H-3F8R-MRJR Keycloak has authentication bypass via jwt algorithm confusion

Description A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the...

GHSA-9PPR-WFW9-XVR2 Netfoil doesn't decrement TTL

Summary TTL was not decremented, so stale records would continue to be served...

GHSA-H26J-4VP7-X9W2 Metalama: Unsafe deserialization over Metalama's Visual Studio inter-process named pipe enables local code execution

Summary Metalama uses a local named-pipe channel to communicate between its Visual Studio processes — the Visual Studio UI process devenv, the out-of-process Roslyn code-analysis process, and the CodeLens process. This channel deserialized messages from the pipe without restricting which CLR type...

GHSA-M3QR-FVP4-78XJ Arc has unauthenticated application log disclosure via `/api/v1/logs`

Summary Arc exposes GET /api/v1/logs without authentication even when authentication is enabled by default. The route is registered before the global Fiber authentication middleware, and the handler returns recent buffered application logs without performing its own authorization check. Details A...

GHSA-J656-3HF2-FVJC DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

The read-only mode can be bypassed on the MySQL and MariaDB connectors. In read-only mode a caller can still execute arbitrary write and DDL statements for example DROP TABLE, which defeats the protection that read-only mode is meant to provide when a database is exposed to an AI agent. Root caus...

GHSA-F9J6-8P6X-R9J6 SD JWT JS: Tampered disclosures silently dropped instead of rejected

Summary When one Disclosure in an SD-JWT presentation is tampered so its digest no longer matches the Issuer-signed sd array, @sd-jwt/decode 0.19.0 does not reject the presentation. It silently drops the unmatched Disclosure and returns a reduced claim set, reporting success. The Issuer signature...

GHSA-8FMV-6RG5-5924 Kubeflow Pipelines: Pipeline archive upload allows decompression bomb to exhaust server memory

Summary The Kubeflow Pipelines API server decompresses uploaded pipeline archives without adequately bounding expanded data in affected versions. A small ZIP or gzip-compressed tar archive can consume disproportionately large amounts of memory while the server locates or reads the pipeline file,...

GHSA-WG5Q-X4J9-QM54 Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

Summary The Kubeflow Pipelines API server's GET /apis/v1alpha1/runs/runid/nodes/nodeid/log handler retrieves logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and a suitable pod or node identifier can read live or archived...

GHSA-5849-834G-HVW5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires opening an incomplete file without a trailer. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4289...

GHSA-CGGF-277G-3Q54 pypdf has possible large memory usage when parsing page tree

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the page tree with many shared resources. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4290...

GHSA-MFR5-77XH-9J7H pypdf has possible infinite loop when cloning dictionaries

Impact An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires cloning/duplicating a DictionaryObject. Patches This has been fixed in pypdf==6.21.4. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4288...

GHSA-4528-X5FX-H6HG joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Summary Joi.string.email multiple: true takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. Details When the multiple option is set, the email rule spli...

GHSA-8494-F6MR-CJPV @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service

Summary Content.disposition takes quadratic time when a Content-Disposition parameter contains a long token without =. One unauthenticated multipart request can block the Node.js event loop for several minutes. Details Content.disposition reads the parameters with a global regular expression in...

GHSA-G3HV-75WG-M249 minimatch has potential denial of service via globparts amplification

minimatch 10.2.6 contains an attacker-controlled pattern amplification in firstPhasePreProcess when optimizationLevel = 2. researcher: Reid Downing b1nv0id files: - src/index.ts: 690-770 - src/index.ts: 780-796 issue: input-controlled growth of globParts during first-phase preprocessing, followed...

GHSA-3G3M-2FJR-6PW4 Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

Summary In glob 13.0.6, an aborted async walk rejects or emits an error but continues recursively reading directories in the background. The root cause is that abort branches in src/walker.ts call cb without returning. As a result, callers that rely on signal or AbortSignal.timeout to bound glob...

GHSA-C73Q-W75P-J82V Authlib RFC 7592 examples omit registration-access-token client binding

Description Summary RFC 7592 OAuth 2.0 Dynamic Client Registration Management Protocol lets a previously registered client read, update, or delete its own registration, authenticated by a registrationaccesstoken issued specifically to that client at registration time. The entire security model of...

GHSA-42GH-23HR-VPHW pypdf has possible long runtimes when retrieving page labels

Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes. This requires retrieving the page labels of a file. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4251...

GHSA-4VQV-7265-GM2W pypdf has possible large memory usage for exceptions in strict mode

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loading an invalid dictionary. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4265...

GHSA-62M5-6WH8-28X7 pypdf has possible long runtimes/large memory usage for encrypted PDF files

Impact An attacker who uses this vulnerability can craft a PDF which leads to large runtimes/memory usage. This requires accessing the page count of an encrypted PDF file, which itself declares a wrong /Count value. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade...

GHSA-X3RH-GJGM-FMQC pypdf has possible large memory usage when parsing cross-reference streams

Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires opening a file with cross-reference streams. Patches This has been fixed in pypdf==6.21.3. Workarounds If you cannot upgrade yet, consider applying the changes from PR 4269...

GHSA-2QM8-X737-GMW5 pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large,...

GHSA-MM57-4V3P-RCHX pyasn1 has quadratic-complexity denial of service in binary REAL decoding

Summary In pyasn1 0.6.4 and earlier, decoding a binary-encoded ASN.1 REAL with a large mantissa can consume CPU time quadratic in the mantissa length. The BER, CER, and DER decoders all use the affected RealPayloadDecoder. An application is exposed when it passes attacker-controlled ASN.1...

GHSA-9M75-VC3G-4X39 pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding

Summary In pyasn1 0.6.4 and earlier, decoding a constructed OCTET STRING or character string made of many fragments can spend disproportionate CPU time repeatedly copying the accumulated value. A separate indefinite-length ANY path has the same problem while collecting the encoded components. The...

GHSA-FM9C-5RCF-2Q5P pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding

Summary When an application decodes attacker-controlled BER, CER, or DER data without an ASN.1 schema, a container with many distinct long tag IDs can cause quadratic CPU use. Repeated inputs can exhaust CPU and reduce service availability. Details...

GHSA-4642-5MCJ-2RQW Forge: ASN.1 OID first arc truncation in asn1.oidToDer

Summary asn1.oidToDer did not range-check the first two arcs of an OID string, so an OID such as 0.42.840.113549.1.1.1 or 4294977127.18.840.113549.1.1.1 was encoded as the DER of a different OID here rsaEncryption, 1.2.840.113549.1.1.1. This is an incomplete fix of CVE-2025-66030. Fixed in...

GHSA-6WVX-3R32-XMCG Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

Summary The forge.http client stored cookies from Set-Cookie response headers in a plain object keyed by cookie name and path. A malicious server could use the cookie name proto to add properties to Object.prototype, use inherited names such as constructor to add properties to Object, and send an...

GHSA-525V-9GP9-W22H Forge: TLS client crash when the server sends no certificate

Summary The forge TLS client's check for a missing server certificate read the wrong property and never ran. A malicious TLS server, or an on-path attacker who removes the server's Certificate message, can make connection.process throw a TypeError, which crashes applications that use the forge TL...

GHSA-7WCH-P9PX-956X Forge: Regular expression denial of service in PEM decoding (pem.decode)

Summary pem.decode, which every node-forge API that parses PEM input uses, split messages with a regular expression that takes polynomial time on input without a matching END line, and parsed encapsulated headers with regular expressions that take quadratic time on long header lines. A remote...

GHSA-H6CR-WJV9-3CPP Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

Summary BigInteger.prototype.modInverse in node-forge's bundled jsbn library enters an infinite loop when the value or the modulus is negative, for example when a negative public exponent is passed to forge.pki.rsa.generateKeyPair. This is an incomplete fix of CVE-2026-33891 GHSA-5m6q-g25r-mvwx,...

GHSA-4487-J8R4-4G2F Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

Summary When a CA store created by pki.createCaStore holds two or more certificates with the same subject name, pki.verifyCertificateChain permanently removes those certificates from the store while trying each one as the issuer. A peer can send any certificate that names that subject as its issu...

GHSA-5CWG-6VW7-RJ6P Forge: AES-GCM authentication bypass via unvalidated tagLength option

Summary The AES-GCM mode in forge.cipher does not validate the tagLength option passed to start. With a tagLength of 0 or a value that converts to 0 such as null, false, '' or '0', the authentication tag is empty, and decipher.finish returns true for any ciphertext and additional data when the...

GHSA-JC66-7Q78-782G Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

Summary forge.pkcs12.pkcs12FromAsn1 accepts a PKCS12 MAC iteration count of zero or less from the input, and the PKCS12 key derivation function then returns a constant key that does not depend on the password or salt. An attacker who does not know the password can modify a PKCS12/PFX file and...

GHSA-8HRF-8G6F-7XWP Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

Summary A connection created with forge.tls.createConnection throws an uncaught TypeError from process when it receives a record of another content type while waiting for the rest of a handshake message that was split across records. A peer can trigger this with 18 bytes before the handshake,...

GHSA-HQQ3-7JHF-C5JX Forge: Denial of service in TLS record processing via call stack exhaustion

Summary Connections created with forge.tls.createConnection processed received TLS records recursively, one stack level per record. A peer can send one chunk of thousands of small records, such as heartbeat records, which are accepted before the handshake, and process throws RangeError: Maximum...

GHSA-5X38-2VFF-X55P Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Summary node-forge parses certificate extensions with the deprecated OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and forge.pki.verifyCertificateChain used the first extension with that name. A certificate with a forged deprecated-OID extension cA TRUE before its genuine basicConstraints...

GHSA-9VW2-F4VP-X7GF PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

Summary When PHPT tests are run with code coverage, PHPUnit 13.4.0 to 13.4.3 writes the code of each PHPT test to a directory with a fixed name below the operating system's path used for temporary files, for instance /tmp/phpunit-phpt on Linux, and executes it from there. PHPUnit uses this...

GHSA-3XF4-9G3C-4H4W Nuxt dev server exposes generated appSecret through Vite file serving

Impact When no appSecret is configured via NUXTAPPSECRET, NITROAPPSECRET or runtimeConfig.appSecret, nuxt dev generates a development secret and stores it in /app-secret by default .nuxt/app-secret. The build directory is inside the directories that Nuxt passes to Vite's server.fs.allow, so the...

GHSA-9V7C-Q64Q-VV33 Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

Summary Since 4.6.0, Nuxt resolves . and .. segments in the request path, including percent-encoded forms such as %2e, before rendering a page. Nitro's routing, Nitro's route rules and server/middleware see the path with those segments still in place. A request for /%2e/admin therefore renders th...

GHSA-X287-WCFC-Q46C Nuxt dev server arbitrary file read through client error reports

Summary A client that can connect to the dev server's HMR socket can send a nuxt:dev:client-error event whose message ends in an absolute file path. The dev server reads that file while building the error report, and its contents are returned in the error overlay, on the dev error channel, and in...

GHSA-648H-GW55-M2G7 Nuxt dev server exposes private runtime config through the Nitro dev bundle

Summary With Nitro 2 the default server engine in Nuxt 3 and Nuxt 4, the Nitro development server bundle written by nuxt dev can be fetched through the Vite dev server. Nitro inlines the resolved runtimeConfig into that bundle, so private runtime config values that were resolved at build time can...