Security Advisories | GitStock

high2026-10-02

Vibe-Trading file-read tools expose arbitrary server-readable files

hkuds/vibe-trading · GHSA-5rmq-chc7-m22f

critical2026-10-02

Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

hkuds/vibe-trading · GHSA-jqmf-mx4f-hfr6

medium2026-10-02

Trigger.dev: Cross-environment deployment cancel

triggerdotdev/trigger.dev · GHSA-4672-hwv6-gq62

high2026-10-02

Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name

triggerdotdev/trigger.dev · GHSA-9q4r-4842-93vw

medium2026-10-02

Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyId

triggerdotdev/trigger.dev · GHSA-59h8-w5q6-mfmp

high2026-10-02

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

triggerdotdev/trigger.dev · GHSA-pqxw-g93w-hj9x

high2026-10-02

CVE-2026-96780-figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

patorjk/figlet.js · GHSA-62ch-8vmq-8xm7

critical2026-10-02

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

triggerdotdev/trigger.dev · GHSA-gg6r-gp4c-89hp

medium2026-10-02

CVE-2026-77387-geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

geopy/geopy · GHSA-mhvh-fq92-pfmr

high2026-10-02

Xray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks

xtls/xray-core · GHSA-5wf9-h793-w73c

medium2026-10-02

Trigger.dev: Blind SSRF via alert-channel webhook

triggerdotdev/trigger.dev · GHSA-q567-cr4x-96w4

high2026-10-02

Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)

triggerdotdev/trigger.dev · GHSA-pp95-gc86-jq6q

high2026-10-02

Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL

triggerdotdev/trigger.dev · GHSA-xxv7-2vv3-h682

high2026-10-02

Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)

triggerdotdev/trigger.dev · GHSA-qxpp-qjg8-x4jv

medium2026-10-02

CVE-2026-59944-Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

composer/composer · GHSA-96h3-5x6v-m776

high2026-10-02

Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths

jelmer/dulwich · GHSA-8mcx-5rqc-vhmf

medium2026-10-02

Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

jelmer/dulwich · GHSA-35mr-4567-66vg

high2026-10-02

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

jelmer/dulwich · GHSA-8w8g-wq8h-fq33

high2026-10-02

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

jelmer/dulwich · GHSA-5fqc-mrg8-w798

high2026-10-02

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

jelmer/dulwich · GHSA-cm62-gvxx-vmxx

← Previous 1 41 42 43 44 45 1536 Next →