All pull requests

Pull requests

• Correct ASGI title and add patch references for GHSA-933h-hp56-hf7m

  #10937·RogerF5-Security opened Nov 7, 2026·

  ·
  1

• [GHSA-5qpg-rh4j-qp35] Add CVE alias CVE-2025-48945

  #10936·munimv2 opened Nov 7, 2026·

  ·
  1

• [GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

  #10935·agntflw opened Nov 6, 2026·

  ·
  2

• Mark GHSA-h7wm-ph43-c39p as fixed in Scrapy 2.20.0

  #10934·AdrianAtZyte opened Nov 6, 2026·

  ·
  2

• Add source repository and fixed release references to GHSA-qvg8-69ff-cf67 (CVE-2026-123488)

  #10933·maulanawirawan opened Nov 6, 2026·

  ·
  1

• Add source repository and fixed release reference to GHSA-2rqf-g355-8vxq (CVE-2026-123490)

  #10932·maulanawirawan opened Nov 6, 2026·

  ·
  1

• [GHSA-gcjh-h69q-9w9g] cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

  #10931·Moep90 opened Nov 6, 2026·

  ·
  1

• [GHSA-6vch-q96h-7gc3] etcd: tlsListener.acceptLoop spawns unbounded handshake goroutines with no deadline

  #10930·Moep90 opened Nov 6, 2026·

  ·
  1

• Add source repository and fixed release references to GHSA-r7pw-r949-xvmf (CVE-2026-123487)

  #10929·maulanawirawan opened Nov 6, 2026·

  ·
  1

• [GHSA-3g3m-2fjr-6pw4] Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

  #10928·tnohtition-mfv opened Nov 6, 2026·

  ·
  2

• [GHSA-83r6-96m8-r52p] Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing

  #10927·jlarrea-wiz opened Nov 6, 2026·

  ·
  1

• [GHSA-f8p7-h97q-7vx7] Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier

  #10926·jlarrea-wiz opened Nov 6, 2026·

  ·
  1

• [GHSA-g5v7-jchf-7jrr] Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control

  #10925·jlarrea-wiz opened Nov 6, 2026·

  ·
  1

• [GHSA-9mrv-8pvf-hf4m] Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator

  #10924·jlarrea-wiz opened Nov 6, 2026·

  ·
  1

• Add source repository and fixed release references to GHSA-87gv-mpgp-xpp2 (CVE-2026-119757)

  #10923·maulanawirawan opened Nov 6, 2026·

  ·
  1

• [GHSA-m5ph-mmg5-6w5h] filecoin-pin: Unbounded DAG pinning can exhaust server resources

  #10922·Vendetaaaa opened Nov 6, 2026·

  ·
  6

• [GHSA-rvm3-566m-v7fv] Correct affected ranges for Capacitor 8.x

  #10921·EduardoAndradeMachado opened Nov 6, 2026·

  ·
  1

• [GHSA-8678-w3jw-xfc2] Add CVE alias CVE-2026-57234

  #10920·munimv2 opened Nov 6, 2026·

  ·
  2

• [GHSA-f7vj-73pm-m822] LeRobot contains an unsafe deserialization vulnerability...

  #10919·Dballzall opened Nov 6, 2026·

  ·
  4

• [GHSA-cqgh-8p3p-mx4m] Fix patched version to 5.37.0 (5.36.1 was never released)

  #10918·mytrashcan opened Nov 6, 2026·

  ·
  1

• [GHSA-g84c-rxfj-3j2c] webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath

  #10917·hnaether-c8y opened Nov 6, 2026·

  ·
  1

• [GHSA-cv3g-hj65-pcfh] Fix patched version for PyPI (4.6.78 was never published)

  #10916·mytrashcan opened Nov 6, 2026·

  ·
  1

• [GHSA-mqvw-jfmh-93qq] Spring Boot's Cassandra SSL auto-configuration disables TLS hostname verification

  #10915·ranjiGT opened Nov 6, 2026·

  ·
  1

• [GHSA-5368-6h4h-gr29] Spring Boot's PID file write follows symlinks at predictable default path

  #10914·ranjiGT opened Nov 6, 2026·

  ·
  1

• [GHSA-m4x9-hx6x-2c43] Spring Boot's random value property source uses a weak PRNG unsuitable for secrets

  #10913·ranjiGT opened Nov 6, 2026·

  ·
  1