All pull requests

Pull requests

• [GHSA-c8w6-x74f-vmg3] zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

  #11278·aungzayyanaing opened Nov 13, 2026·

  ·
  1

• [GHSA-63wg-wjjj-7cp8] Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

  #11277·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-4fc2-h7jh-287c] zebrad has mempool transaction admission denial via single-peer inbound queue saturation

  #11276·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-rj37-6j9x-74q6] SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS

  #11275·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-wv6g-x823-wx9m] Terragrunt catalog predictable temp symlink clobber

  #11274·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-m27g-v28p-f9fx] OmniAuth: Host Header Injection Vulnerability

  #11273·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-8vv3-6qpc-gpw6] bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

  #11272·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-w4f7-4cxr-rv3c] cowboy and gun affected by an HTTP Request/Response Splitting vulnerability

  #11271·aungzayyanaing opened Nov 13, 2026·

  ·
  1

• [GHSA-6ph5-fww6-vfwv] NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length

  #11270·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-fq3v-74gv-27gm] Excelize: Unbounded <col max> attribute is loaded with no MaxColumns check and expanded per-column by flatCols(), so any column mutator hangs or OOMs the process

  #11269·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-r38m-44fw-h886] AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

  #11268·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-655q-fx9r-782v] Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis

  #11266·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-g8vq-v3mg-7mrg] Redlib allows a Denial of Service via DEFLATE Decompression Bomb in restore_preferences Form

  #11265·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-g5hg-p3ph-g8qg] Multer vulnerable to Denial of Service via unhandled exception

  #11264·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-jfgx-762w-99vr] @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

  #11263·aungzayyanaing opened Nov 13, 2026·

  ·
  4

• [GHSA-gm62-xv2j-4w53] urllib3 allows an unbounded number of links in the decompression chain

  #11262·aungzayyanaing opened Nov 13, 2026·

  ·
  1

• [GHSA-wvg4-6p58-3gh3] Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch

  #11261·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-h7h7-mm68-gmrc] Svelte affected by XSS in SSR <option> element

  #11260·aungzayyanaing opened Nov 13, 2026·

  ·
  4

• [GHSA-vhv4-fh94-jm5x] JS Html Sanitizer allows XSS when used with contentEditable

  #11259·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-x574-m823-4x7w] Vite bypasses server.fs.deny when using ?raw??

  #11258·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-cpwx-vrp4-4pq7] Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

  #11257·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-xmg8-99r8-jc2j] Login screen allows message spoofing if SSO is enabled

  #11255·jess-lowe opened Nov 13, 2026·

  ·
  2

• [GHSA-hff9-5pqw-6w9f] imgproxy: affected package is github.com/imgproxy/imgproxy/v4

  #11254·jamesconwaydev opened Nov 13, 2026·

  ·
  1

• [GHSA-f82v-jwr5-mffw] Authorization Bypass in Next.js Middleware

  #11253·aungzayyanaing opened Nov 12, 2026·

  ·
  1

• [GHSA-365w-hqf6-vxfg] Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

  #11251·jess-lowe opened Nov 12, 2026·

  ·
  5