All pull requests

Pull requests

• [GHSA-h7ww-273w-6cm8] Mistune: Path Traversal and XSS in Include directive

  #10673·xhinzz opened Oct 25, 2026·

  ·
  1

• [GHSA-2mfj-r695-5h9r] Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php

  #10672·zuhairhalawa opened Oct 25, 2026·

  ·
  2

• [GHSA-r374-rxx8-8654] Paramiko rsakey.py allows the SHA-1 algorithm

  #10671·zuhairhalawa opened Oct 25, 2026·

  ·

• [GHSA-gq5c-rw37-g46c] FacturaScripts vulnerable to Reflected Cross-Site Scripting (XSS) via Cookie Manipulation

  #10670·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-j4rh-7jcr-qm69] misp-modules website - Missing CSRF protection in the website home blueprint

  #10669·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-fhq3-2gf3-8f3j] misp-modules has nsafe remote resource fetching in expansion

  #10668·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-5mmc-8pc9-wggg] WPGraphQL: Contributor can publish and modify posts without the required capabilities via updatePost

  #10667·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-6g8r-74qp-6859] uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

  #10666·zuhairhalawa opened Oct 25, 2026·

  ·

• [GHSA-5v4g-vw9x-h534] uutils coreutils has an Improper Input Validation Issue in its env Utility

  #10665·zuhairhalawa opened Oct 25, 2026·

  ·

• [GHSA-4wrp-79m8-9m9p] uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition

  #10664·zuhairhalawa opened Oct 25, 2026·

  ·

• [GHSA-48m6-486p-9j8p] nimiq-consensus panics via RequestMacroChain micro-block locator

  #10663·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-vc34-39q2-m6q3] nimiq-account: Vesting insufficient funds error can panic

  #10662·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-pf4j-pf3w-95f9] nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of-knowledge

  #10661·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-j99g-7rqw-q9jg] nimiq-blockchain: Peer-triggerable panic during history sync

  #10660·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-7c4j-2m43-2mgh] nimiq-primitives: Node crash due to missing interlink validation in election macro block proposals

  #10659·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-6973-8887-87ff] nimiq-block has skip block quorum bypass via out-of-range BitSet indices & u16 truncation

  #10658·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-264v-m8fm-76jm] nimiq-transaction: Panic via HistoryTreeProof length mismatch

  #10657·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-q7f2-rv22-2xgr] FacturaScripts Vulnerable to Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download

  #10656·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-f63g-88cj-hjf9] IzPack has Path Traversal in UnpackerBase that allows writing files outside the installation directory via malicious pack entries

  #10654·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-xmj9-7625-f634] Data Sharing Framework has an Inverted Time Comparison in OIDC JWKS and Token Cache

  #10653·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-gj7p-595x-qwf5] Data Sharing Framework is Missing Session Timeout for OIDC Sessions

  #10652·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-vmg4-6gfg-83qx] ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

  #10651·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-pm5p-7w5h-jm5q] Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network

  #10650·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-996f-334j-67g7] Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

  #10649·zuhairhalawa opened Oct 25, 2026·

  ·
  1

• [GHSA-8hm4-r66f-29wr] Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync

  #10648·zuhairhalawa opened Oct 25, 2026·

  ·
  1