Security Advisories | GitStock

medium2026-09-15

CVE-2026-69216-Http4s: Ember chunk parser lenience (TE.TE request smuggling)

http4s/http4s · GHSA-jrpm-956j-96jg

medium2026-09-15

CVE-2026-69215-Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin

http4s/http4s · GHSA-grh8-3p95-f9rr

medium2026-09-15

CVE-2026-69214-Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

http4s/http4s · GHSA-wv64-j4fq-5f9x

high2026-09-15

CVE-2026-69213-Http4s Ember HTTP/2 has an unbounded outbound frame queue

http4s/http4s · GHSA-8f3q-3jmv-7prw

high2026-09-15

CVE-2026-69208-Http4s: DigestAuth nonce map grows unbounded

http4s/http4s · GHSA-fm4g-76c9-7w69

medium2026-09-15

CVE-2026-69206-Http4s: DigestAuth allows replay of captured requests

http4s/http4s · GHSA-9xww-74xv-gjfp

high2026-09-15

CVE-2026-69205-Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

http4s/http4s · GHSA-9998-894r-fwvr

critical2026-09-15

CVE-2026-69204-Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

http4s/http4s · GHSA-8h4c-x2wg-6xp8

high2026-09-15

CVE-2026-69203-Http4s Ember HTTP/2 does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

http4s/http4s · GHSA-9vwc-pc8p-253q

high2026-09-15

CVE-2026-69202-Http4s Ember HTTP/2: unbounded inbound body buffering

http4s/http4s · GHSA-6m4x-pp6q-5jmm

low2026-09-15

Nezha: OAuth2 redirect_uri Host header injection regression when dashboard_host is empty

nezhahq/nezha · GHSA-rf68-8gjr-36q7

medium2026-09-15

CVE-2026-32599-Netmaker has a boolean‑based SQL Injection

gravitl/netmaker · GHSA-r8cr-4f9w-7r75

medium2026-09-14

CVE-2026-76081-ZITADEL: Improper Role Revocation on Granted Projects during Multiple Role Deletions

zitadel/zitadel · GHSA-v859-c572-qh5p

high2026-09-14

CVE-2026-56668-ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

zitadel/zitadel · GHSA-vrh8-c9cm-wh8v

critical2026-09-14

CVE-2026-59178-ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

esphome/device-builder · GHSA-rrxg-g2pf-6hh4

low2026-09-14

October CMS: Incomplete Scheme Validation in Image Resizer

octobercms/october · GHSA-2xmm-m4wv-3fjh

low2026-09-14

CVE-2026-49400-October CMS: PHP Object Injection via Backend Widget Session Storage

octobercms/october · GHSA-2ff2-mx52-q8wp

low2026-09-14

CVE-2026-46696-October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

octobercms/october · GHSA-xv9m-fm3w-8w5x

medium2026-09-13

CVE-2026-90771-joi messages compilation allows prototype replacement through __proto__ error codes

hapijs/joi · GHSA-wr44-6hxh-3jwq

medium2026-09-11

CVE-2026-56666- ZITADEL: Auto-linking by email: IdP-side email verification is not checked

zitadel/zitadel · GHSA-992q-9gwp-7r79

← Previous 1 73 74 75 76 77 1540 Next →