Tagged “ghsa”
CVEs tagged ghsa, newest first.
3811 CVEsRSS
CVE-2026-54451High· 8.2PoCElixir protobuf is a pure Elixir implementation of Google Protobuf
Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes with Protobuf.Decoder can be taken offline when the schema contains a self-referential o…
CVE-2026-54446High· 8.1PoCNetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-ne…
CVE-2026-50158High· 7.7yutu is an AI-powered toolkit for managing and growing YouTube channels
yutu is an AI-powered toolkit for managing and growing YouTube channels. Prior to 0.10.9, the caption-download MCP tool accepts a caller-controlled file parameter through cmd/caption/download.go and passes it to Caption.Download() in pkg…
CVE-2026-50125High· 7.5PoCMKP is a Model Context Protocol server for Kubernetes
MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitByt…
CVE-2026-47252Critical· 9.0PoCAnyquery is an SQL query engine built on top of SQLite
Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brav…
CVE-2026-54617Critical· 9.8GravitLauncher is an open-source Minecraft launcher based on sashok724's v3
GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274…
CVE-2026-49292Low· 0.0Kiwi TCMS is an open source test management system
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migra…
CVE-2026-61599High· 8.8djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling …
CVE-2026-61589Medium· 6.3djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFac…
CVE-2026-61453MediumGrav: XSS Blueprint Validation Bypass via Twig String Concatenation
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
CVE-2026-58657Medium· 4.8Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
CVE-2026-64684Medium· 6.8RMCP is an official Rust SDK for the Model Context Protocol
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest…
CVE-2026-61597Medium· 5.1djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/use…
CVE-2026-61592High· 7.4djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen `session_id` with no binding to the authenticated us…
CVE-2026-61594Critical· 9.1djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()…
CVE-2026-61591High· 8.1djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, for views that opt into state snapshots, the snapshot `state_json` embedded in the client page was res…
CVE-2026-61588Medium· 6.5djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is assigned to a public view attribute, djust serialized it to the clie…
CVE-2026-61596High· 7.1djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the…
CVE-2026-63506High· 8.8PoCTina is a headless content management system
Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected Tin…
CVE-2026-75513Critical· 9.1PoCMarten is a .NET Transactional Document DB and Event Store on PostgreSQL
Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-management paths interpolate runtime, potentially attacker-controlled strings into single-quoted SQ…
CVE-2026-81870Low· 2.0PoCOpenTelemetry-Go is the Go implementation of OpenTelemetry
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively includ…
CVE-2026-62949Medium· 6.5AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, _process_channel_open and _process_channel_open_confirmation in a…
CVE-2026-86071Low· 3.7Junrar is an open source Java RAR archive library
Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a cr…
CVE-2026-63225Medium· 4.4Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier
Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSample…
CVE-2026-63126High· 7.5PoCWire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary b…
CVE-2026-75516High· 8.7The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start() applies Math.min(maxInboundMessageBodySize, frameMax) after Connection.Tune ne…
CVE-2026-59823Medium· 5.3LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.9, an authenticated LiteLLM Proxy caller with a valid virtual key can place api_base inside the user_config request body to bypass is_req…
CVE-2026-82399High· 7.5PoCCoreDNS is a DNS server written in Go
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call d…
CVE-2026-77360Medium· 6.3PoCoRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client's incoming Vary request header into…
CVE-2026-81875High· 7.5PoCHAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.12, SHCParser in org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/elementmodel/SHCParser.java can consume attacker…