Security Advisories | GitStock

medium2026-09-02

CVE-2026-81890-elFinder: CSRF in netmount allows forced FTP mounts and server-side FTP connections

studio-42/elfinder · GHSA-9hjf-w35w-6vx2

high2026-09-02

CVE-2026-82392-pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm/pnpm · GHSA-c59q-g84q-2gj5

high2026-09-02

CVE-2026-82393-pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

pnpm/pnpm · GHSA-vq4v-j7r6-jq4m

medium2026-09-02

CVE-2026-81722-NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

nltk/nltk · GHSA-ww6m-cw3f-q94g

medium2026-09-02

CVE-2026-81727-NLTK: Downloader.download follows hardlinks and overwrites outside-root files

nltk/nltk · GHSA-f794-5jv7-7672

high2026-09-02

CVE-2026-81726-NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

nltk/nltk · GHSA-8mgp-746c-j5xp

medium2026-09-02

CVE-2026-81723-NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

nltk/nltk · GHSA-vp2x-qp44-57v7

medium2026-09-02

CVE-2026-12876-NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk/nltk · GHSA-ff5c-cp5c-9wjf

medium2026-09-02

CVE-2026-81724-NLTK: Uncontrolled recursion in nltk.featstruct.FeatStructReader causes unhandled RecursionError (DoS) via deeply nested feature-structure input

nltk/nltk · GHSA-cw6x-m8jw-qmrh

low2026-09-02

ImageMagick: Memory Leak when providing invalid options to the cli

imagemagick/imagemagick · GHSA-cvhv-g4rq-3hmw

medium2026-09-02

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

humanwhocodes/humanfs · GHSA-p498-v437-472g

high2026-09-02

CVE-2026-73231-Faker: helpers.fake exploitable into arbritary code execution

faker-js/faker · GHSA-qxc2-j82w-r537

high2026-09-02

CVE-2026-59832-Siyuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

siyuan-note/siyuan · GHSA-275h-v5h9-vr82

high2026-09-02

CVE-2026-59834-SiYuan: SQL Query in Block Search Exposes Hidden Published Document Content

siyuan-note/siyuan · GHSA-h89q-4j2h-7h88

medium2026-09-02

CVE-2026-32773-Apache Spark History Server allows stored cross-site scripting through unescaped application names

apache/spark · GHSA-9437-39hj-3c93

high2026-09-01

CVE-2026-84304-gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

grpc/grpc-go · GHSA-vp52-pcj8-j9qc

high2026-09-01

CVE-2026-19418-TYPO3 CMS - Broken Access Control in Backend and Install Tool

typo3/typo3 · GHSA-68jx-f42c-7599

medium2026-09-01

CVE-2026-84306-Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

filamentphp/filament · GHSA-r3j6-gpjw-qfjr

low2026-09-01

CVE-2026-84307-Filament: Password validity disclosure for accounts denied panel access on login page

filamentphp/filament · GHSA-xwpv-pqxp-5v36

high2026-09-01

CVE-2026-77567-Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

filamentphp/filament · GHSA-52xp-w8hr-xv3c

← Previous 1 91 92 93 94 95 1540 Next →