All pull requests

Pull requests

• [GHSA-273h-m46v-96q4] ImageMagick: Integer Overflow in PSB (PSD v2) RLE decoding path causes heap Out of Bounds reads for 32-bit builds

  #10828·munimv2 opened Nov 1, 2026·

  ·
  1

• [GHSA-wp74-jgxh-gv4q] Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

  #10827·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-rp2p-6cmp-jxj9] Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

  #10826·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-w7cw-xp7h-6j5j] Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

  #10825·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-2969-4q4w-w5h3] Microsoft Security Advisory CVE-2026-50650 – .NET Elevation of Privilege Vulnerability

  #10824·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-23fw-v26w-5fgq] Microsoft Security Advisory CVE-2026-62900 – .NET Information Disclosure Vulnerability

  #10823·ranjiGT opened Nov 1, 2026·

  ·
  1

• [GHSA-cpm7-cfpx-3hvp] Emissary has Stored XSS via Navigation Template Link Injection

  #10822·ranjiGT opened Nov 1, 2026·

  ·
  2

• [GHSA-6c37-7w4p-jg9v] Emissary has a Command Injection via PLACE_NAME Configuration in Executrix

  #10821·ranjiGT opened Nov 1, 2026·

  ·
  2

• [GHSA-3p24-9x7v-7789] Emissary has an OS Command Injection via Unvalidated IN_FILE_ENDING / OUT_FILE_ENDING in Executrix

  #10820·ranjiGT opened Nov 1, 2026·

  ·
  2

• [GHSA-p458-7748-mcp3] Vitest: Servers misapply server.fs.deny, serving .env, private keys, .git, and the API token file

  #10819·ranjiGT opened Nov 1, 2026·

  ·
  2

• [GHSA-c6q7-wqw2-h65w] NationalSecurityAgency/emissary has an incomplete fix for CVE-2026-35571

  #10818·ranjiGT opened Nov 1, 2026·

  ·
  2

• Add official Django fix references for CVE-2025-26699

  #10817·Cao150702 opened Nov 1, 2026·

  ·
  1

• Add CWE-184 to GHSA-q5mp-gfjf-cf2j

  #10816·17396743 opened Nov 1, 2026·

  ·

• [GHSA-g3hv-75wg-m249] minimatch: affected range starts at 7.0.0

  #10815·phoen-ix opened Nov 1, 2026·

  ·

• [GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

  #10814·mzitsolutions opened Oct 31, 2026·

  ·
  1

• [GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

  #10813·MBassi91 opened Oct 31, 2026·

  ·
  2

• [GHSA-g3hv-75wg-m249] minimatch: affected range starts at 7.0.0

  #10812·Veltrex1 opened Oct 31, 2026·

  ·

• [GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

  #10810·JTW17 opened Oct 31, 2026·

  ·
  1

• [GHSA-g3hv-75wg-m249] minimatch has potential denial of service via globparts amplification

  #10809·poastro opened Oct 31, 2026·

  ·
  1

• [GHSA-jf75-q64q-g65r] Waline login accepts a non-string email as a match-all MongoDB query

  #10808·ranjiGT opened Oct 31, 2026·

  ·
  2

• Fix affected range for GHSA-g3hv-75wg-m249

  #10807·ramonpzg opened Oct 31, 2026·

  ·
  2

• [GHSA-8mgp-746c-j5xp] NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

  #10805·otovar-vc opened Oct 30, 2026·

  ·
  2

• [GHSA-5v8v-66v8-mwm7] Integer overflow in the bundled Brotli C library

  #10804·illia-v opened Oct 30, 2026·

  ·
  3

• [GHSA-r29h-37fj-x2w6] Add the PyPI open-webui package

  #10803·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-cqp4-qqvg-3787] Add the PyPI open-webui package

  #10802·devjoinedthechat opened Oct 30, 2026·

  ·