All pull requests

Pull requests

• [GHSA-2hj5-g64g-fp6p] Argo CD allows cross-site scripting on repositories page

  #11301·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-2v3v-3whp-953h] starcitizentools/citizen-skin allows stored XSS in user registration date message

  #11300·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• Add matrix-sdk 0.13.0 release reference to GHSA-275g-g844-73jh

  #11299·aungzayyanaing opened Nov 13, 2026·

  ·

• Add color-string 2.1.2 release reference to GHSA-286p-vc9p-p5qv

  #11298·aungzayyanaing opened Nov 13, 2026·

  ·

• [GHSA-2q8q-8fgw-9p6p] OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias

  #11297·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-253q-9q78-63x4] Clatter has a PSK Validity Rule Violation issue

  #11296·aungzayyanaing opened Nov 13, 2026·

  ·

• [GHSA-3rg7-wf37-54rm] Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

  #11295·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-27c9-vp3w-6ww8] Shopware exposes sensitive user information via CSV export mapping

  #11294·aungzayyanaing opened Nov 13, 2026·

  ·
  1

• Add marimo 0.23.0 release reference to GHSA-2679-6mx9-h9xc

  #11293·aungzayyanaing opened Nov 13, 2026·

  ·

• [GHSA-2m4f-cg75-76w2] NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

  #11292·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-2299-ghjr-6vjp] Parse Server: MFA recovery code single-use bypass via concurrent requests

  #11291·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-243v-98vx-264h] Wasmtime can panic when adding excessive fields to a wasi:http/types.fields instance

  #11290·aungzayyanaing opened Nov 13, 2026·

  ·
  3

• [GHSA-2238-xc5r-v9hj] @tinacms/graphql has a Path Traversal issue

  #11288·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-22qr-rp27-j9wm] PenPot MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

  #11286·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-226f-f24g-524w] Open WebUI: Redirect-Bypass SSRF in OAuth _process_picture_url (incomplete-fix sibling of CVE-2026-45401)

  #11285·aungzayyanaing opened Nov 13, 2026·

  ·
  1

• [GHSA-23m2-mghx-vqmf] Wagtail: Reflected XSS in dynamic image URL generator view

  #11284·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-243p-f3cv-c5wh] Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

  #11283·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-22jm-h49p-29qw] MCP TypeScript SDK: Experimental tasks were not tied to the session that created them

  #11282·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-65jj-fmw8-468q] zebrad has unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention

  #11281·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-2gf8-q9rr-jq3h] zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

  #11280·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-qv2r-v3mx-f4pf] zebrad has full node denial of service via non-ASCII LongPollId in getblocktemplate

  #11279·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-c8w6-x74f-vmg3] zebrad vulnerable to full node denial of service via crafted Sapling receiver in z_listunifiedreceivers

  #11278·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-63wg-wjjj-7cp8] Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

  #11277·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-4fc2-h7jh-287c] zebrad has mempool transaction admission denial via single-peer inbound queue saturation

  #11276·aungzayyanaing opened Nov 13, 2026·

  ·
  2

• [GHSA-rj37-6j9x-74q6] SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS

  #11275·aungzayyanaing opened Nov 13, 2026·

  ·
  2