Security Advisories | GitStock

high2026-08-17

uniget CLI: Metadata signature verification only runs when UNIGET_IGNORE_METADATA_SIGNATURE is set

uniget-org/cli · GHSA-fhgh-wq4q-r37x

high2026-08-17

CVE-2026-59893-sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

andialbrecht/sqlparse · GHSA-prg7-hcfm-mfcr

high2026-08-17

CVE-2026-54284-sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

andialbrecht/sqlparse · GHSA-pwgv-4x5q-6m9f

high2026-08-17

CVE-2026-55090-Etherpad has stored XSS in HTML export via unescaped attribute-pool values

ether/etherpad · GHSA-2jp7-wwpg-3p9w

medium2026-08-17

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

ether/etherpad · GHSA-92hr-gmr6-h8cp

medium2026-08-17

CVE-2026-55062-uniget CLI has Path Traversal in Hook Files - Directory Escape Vulnerability

uniget-org/cli · GHSA-m6jg-wr9m-cg2f

medium2026-08-17

CVE-2026-55061-uniget CLI has an EDITOR Command Injection

uniget-org/cli · GHSA-qmcq-xw74-w667

high2026-08-17

vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass

patriksimek/vm2 · GHSA-v836-6xw4-9cx3

critical2026-08-17

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

patriksimek/vm2 · GHSA-m5w8-4gq2-6f8x

critical2026-08-17

CVE-2026-47698-vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

patriksimek/vm2 · GHSA-cfcw-xp6x-25gj

critical2026-08-17

CVE-2026-47686-VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE

patriksimek/vm2 · GHSA-m283-3h24-438v

high2026-08-17

CVE-2026-47683-vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

patriksimek/vm2 · GHSA-gmc2-2x9w-cgh9

high2026-08-17

CVE-2026-71491-sqlparse: Quadratic O(n²) DoS in group_comments

andialbrecht/sqlparse · GHSA-f2ff-p2ww-7p4p

medium2026-08-17

CVE-2026-68520-Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

nicolargo/glances · GHSA-4h34-v6r8-mmjc

high2026-08-17

CVE-2026-68519-Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

nicolargo/glances · GHSA-59fj-m2j6-hcxh

high2026-08-17

CVE-2026-62982-Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

nicolargo/glances · GHSA-73wf-9vmv-5pv9

medium2026-08-17

CVE-2026-59894-sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

andialbrecht/sqlparse · GHSA-3496-9g83-7v6x

medium2026-08-17

CVE-2026-68517-Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

nicolargo/glances · GHSA-fp27-88fp-2phg

medium2026-08-17

CVE-2026-45099-Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

gruntwork-io/terragrunt · GHSA-8394-6f8r-whxg

high2026-08-17

CVE-2026-68518-Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

nicolargo/glances · GHSA-qcpp-8x79-hhp3