All pull requests

Pull requests

• [GHSA-7p85-w9px-jpjp] Twig: PHP code injection via {% use %} template name

  #10421·vladko312 opened Oct 17, 2026·

  ·
  1

• [GHSA-45vw-wh46-2vx8] Twig: Arbitrary PHP code execution via _self.(<string>) macro-reference compilation

  #10420·vladko312 opened Oct 17, 2026·

  ·
  1

• [GHSA-9hjg-9r4m-mvj7] Requests vulnerable to .netrc credentials leak via malicious URLs

  #10418·omerlevyk opened Oct 17, 2026·

  ·
  4

• Correct video-stitch npm mapping and 1.7.2 fix for GHSA-8mh7-3vxw-frrx

  #10417·ArsalanDotMe opened Oct 17, 2026·

  ·

• [GHSA-vgf2-gvx8-xwc3] Vyper Does Not Check the Success of Certain Precompile Calls

  #10415·kenny-ish opened Oct 17, 2026·

  ·

• [GHSA-hmj8-5xmh-5573] libp2p: yamux connection DoS via oversized data frame

  #10414·kenny-ish opened Oct 17, 2026·

  ·

• [GHSA-mjfq-3qr2-6g84] Cosmos EVM Allows Partial Precompile State Writes

  #10413·kenny-ish opened Oct 17, 2026·

  ·

• Add fix and release references for GHSA-vqff-r82h-9crc

  #10412·lastwane2 opened Oct 17, 2026·

  ·

• [GHSA-p86c-663x-5pxq] Add SSH and SFTP affected-package metadata

  #10411·ranjiGT opened Oct 17, 2026·

  ·
  1

• [GHSA-h9jr-9j2x-qpfm] VentureDrake Laravel CRM before 2.4.0 contains a missing...

  #10410·fxip opened Oct 17, 2026·

  ·

• [GHSA-x3cj-7rxv-cr85] VentureDrake Laravel CRM before 2.4.0 contains an...

  #10409·fxip opened Oct 17, 2026·

  ·

• [GHSA-phqh-xp3p-h6mr] The gist RubyGem before 6.1.0 contains an improper...

  #10408·fxip opened Oct 17, 2026·

  ·

• [GHSA-rj9j-8772-4h6c] Add fix commit reference

  #10407·stanleys12 opened Oct 16, 2026·

  ·

• [GHSA-6rvj-qwjf-3m4q] Add fix commit reference

  #10406·stanleys12 opened Oct 16, 2026·

  ·

• [GHSA-c9ff-59g8-m36q] Add fix commit reference

  #10405·stanleys12 opened Oct 16, 2026·

  ·

• [GHSA-3hh9-752g-5g22] LMCache: 16-bit multimodal hash collision can poison KV cache entries

  #10404·BoJiang03 opened Oct 16, 2026·

  ·
  1

• [GHSA-h42w-g3ch-rjjm] open-multi-agent (@open-multi-agent/core) 1.5.0 through 1...

  #10403·JackChen-me opened Oct 16, 2026·

  ·

• [GHSA-g9pc-8g42-g6vq] Exclude spiral/roadrunner 3.0.0 from the affected range

  #10401·aln-1 opened Oct 16, 2026·

  ·

• [GHSA-vfj7-8cjw-p6xm] braces vulnerable to stack-exhaustion denial of service through deeply nested patterns

  #10400·jorenbroekema opened Oct 16, 2026·

  ·
  4

• [GHSA-79vw-4xm5-93ph] Add missing PyPI package and source metadata

  #10399·ranjiGT opened Oct 16, 2026·

  ·
  2

• Fix affected range for GHSA-3cj3-hqcr-g934

  #10398·yanjost opened Oct 16, 2026·

  ·
  1

• [GHSA-wrvx-pxxf-g8fg] Insufficient Session Expiration vulnerability in Apache...

  #10397·hara-satoshi-ymr opened Oct 16, 2026·

  ·
  4

• [GHSA-4x29-79gh-6v8q] Detection of Error Condition Without Action vulnerability...

  #10396·hara-satoshi-ymr opened Oct 16, 2026·

  ·
  2

• [GHSA-xjhv-pp2r-6f82] BoxLite has a Timeout Bypass Vulnerability

  #10395·LiveNL opened Oct 16, 2026·

  ·
  1

• [GHSA-h3mr-2w3q-jcv9] Time-of-check Time-of-use (TOCTOU) Race Condition...

  #10394·hara-satoshi-ymr opened Oct 16, 2026·

  ·
  2