Security advisories

high2026-09-08

CVE-2026-83607-xmldom: Element name injection via createElement() bypasses requireWellFormed

View chart →

xmldom/xmldom · GHSA-w2rr-34g9-rvrj

high2026-09-08

CVE-2026-83605-xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

View chart →

xmldom/xmldom · GHSA-4w3w-2rp5-g8jm

high2026-09-08

CVE-2026-50646-Microsoft Security Advisory CVE-2026-50646 – .NET Remote Code Execution Vulnerability

View chart →

dotnet/wpf · GHSA-gh2h-rhph-h37g

medium2026-09-08

CVE-2026-81725-NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

View chart →

nltk/nltk · GHSA-8mpw-7fpc-4gqj

high2026-09-08

CVE-2026-80206-NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

View chart →

nltk/nltk · GHSA-w3v8-gmh9-3wv7

high2026-09-08

CVE-2026-80205- NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

View chart →

nltk/nltk · GHSA-rrv8-h7p8-rx55

critical2026-09-08

CVE-2026-62815-Microsoft QUIC: Remote Code Execution Vulnerability

View chart →

microsoft/msquic · GHSA-92f5-vc22-8j33

medium2026-09-08

CVE-2026-62900-Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability

View chart →

dotnet/sourcelink · GHSA-23fw-v26w-5fgq

medium2026-09-08

CVE-2026-73558-vLLM: Cross-User Data Leak Vulnerability

View chart →

vllm-project/vllm · GHSA-7m6h-x95x-82q5

medium2026-09-08

CVE-2026-78679-GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

View chart →

gitpython-developers/gitpython · GHSA-3wxw-xv34-2frg

high2026-09-08

CVE-2026-78677-GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination

View chart →

gitpython-developers/gitpython · GHSA-8mcc-hrx5-hvxc

medium2026-09-08

CVE-2026-78678-GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

View chart →

gitpython-developers/gitpython · GHSA-5xxx-qhh7-9287

critical2026-09-08

CVE-2026-78676-GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE

View chart →

gitpython-developers/gitpython · GHSA-284h-m62q-gf8w

high2026-09-08

CVE-2026-78675-GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

View chart →

gitpython-developers/gitpython · GHSA-7833-fr7j-v32q

critical2026-09-08

CVE-2026-82533-DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

View chart →

deepseek-ai/deepseek-harness · GHSA-8m2g-8cgm-3vcp

critical2026-09-08

CVE-2026-75595-Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

View chart →

netty/netty · GHSA-c4c3-7fpv-j4q5

medium2026-09-08

CVE-2026-75596-Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

View chart →

netty/netty · GHSA-fccg-mwvh-qqg4

medium2026-09-08

CVE-2026-71494-Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

View chart →

infracost/infracost · GHSA-6x6c-w9w9-hv4h

medium2026-09-08

CVE-2026-71493-Infracost: Arbitrary file read via config-template readFile symlink traversal

View chart →

infracost/infracost · GHSA-mmg6-4qmv-6pc8

low2026-09-08

CVE-2026-73087-Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher

View chart →

amir20/dozzle · GHSA-p2w3-6x73-2f6x