Security Advisories | GitStock

medium2026-09-01

CVE-2026-84310-pypdf: Possible long runtimes/large memory usage when retrieving outlines

py-pdf/pypdf · GHSA-23w6-3w8w-8484

medium2026-09-01

CVE-2026-84311-pypdf: Possible long runtimes/large memory usage when extracting XForm objects

py-pdf/pypdf · GHSA-763m-79hh-57f2

medium2026-09-01

CVE-2026-84309-pypdf: Possible infinite loop for TreeObject.insert_child

py-pdf/pypdf · GHSA-jp53-mhqp-8xcg

medium2026-09-01

CVE-2026-84305-sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

andialbrecht/sqlparse · GHSA-cfqr-cjx5-5jcm

medium2026-09-01

CVE-2026-84371-ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass

apostrophecms/apostrophe · GHSA-g8qq-57p8-ggw5

critical2026-09-01

CVE-2026-79675-NLTK: JVM argument injection bypass via per-call options in the NLTK Stanford wrappers (incomplete fix of CVE-2026-12841)

nltk/nltk · GHSA-m4rf-3fr8-xwx3

high2026-09-01

league/commonmark: Denial of service via distinctly-named attributes in the Attributes extension

thephpleague/commonmark · GHSA-8rr7-cvq3-gmfh

high2026-09-01

CVE-2026-78680-NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

nltk/nltk · GHSA-6hwm-xvph-95vm

high2026-09-01

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

thephpleague/commonmark · GHSA-jjv6-8j6v-6j52

high2026-09-01

league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed

thephpleague/commonmark · GHSA-f8fg-pg57-v4j8

high2026-09-01

league/commonmark: Denial of service via crafted code fences, reference links, and emphasis delimiters

thephpleague/commonmark · GHSA-j8pm-gj4c-rq4x

medium2026-09-01

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

tornadoweb/tornado · GHSA-8423-8fgw-73vq

low2026-09-01

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

tornadoweb/tornado · GHSA-wwv5-g3v4-889x

medium2026-09-01

CVE-2026-73228-Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`

encode/django-rest-framework · GHSA-2m8g-3cmr-wg3w

medium2026-09-01

CVE-2026-73229-Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

encode/django-rest-framework · GHSA-g47c-3xmw-q6m2

high2026-09-01

CVE-2026-73086-nanoid: Integer Overflow or Wraparound

ai/nanoid · GHSA-xwg4-73v4-xw9w

high2026-09-01

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

pnpm/pnpm · GHSA-vx52-2968-3vc6

high2026-09-01

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

pnpm/pnpm · GHSA-2rx9-3g3h-c2jv

medium2026-09-01

CVE-2026-58191-Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

appium/appium · GHSA-3wgp-x9p5-c7cc

high2026-09-01

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

mlflow/mlflow · GHSA-gqvg-gmmx-x4hm

← Previous 1 92 93 94 95 96 1540 Next →