Vulnerability Intelligence

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

GitHub Advisory Database · 2026-10-23

filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database

GitHub Advisory Database · 2026-10-23

filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break

GitHub Advisory Database · 2026-10-23

virtualenv: Temporary app-data can leave dangling seed package links

GitHub Advisory Database · 2026-10-23

virtualenv: Pip seeding with download omits wheel digest verification

GitHub Advisory Database · 2026-10-23

virtualenv: Downloaded wheel selection and caching precede verification

GitHub Advisory Database · 2026-10-23

virtualenv: Xonsh activation literals depend on the script decoding codec

GitHub Advisory Database · 2026-10-23

virtualenv: Seeded files retain permissions from an older cache

GitHub Advisory Database · 2026-10-23

virtualenv: Bash prompt values can change meaning under older compatibility modes

GitHub Advisory Database · 2026-10-23

virtualenv: Venv configuration readback can reinterpret path boundaries

GitHub Advisory Database · 2026-10-23

virtualenv: Seed replacement does not contain metadata deletion paths

GitHub Advisory Database · 2026-10-23

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

GitHub Advisory Database · 2026-10-23

undici vulnerable to Denial of Service via unhandled error on excessive content-encodings

GitHub Advisory Database · 2026-10-23

undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

GitHub Advisory Database · 2026-10-23

undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

GitHub Advisory Database · 2026-10-23

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

GitHub Advisory Database · 2026-10-23

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

GitHub Advisory Database · 2026-10-23

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

GitHub Advisory Database · 2026-10-23

LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores

GitHub Advisory Database · 2026-10-23

Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution

GitHub Advisory Database · 2026-10-23

Wasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type

GitHub Advisory Database · 2026-10-23

Wasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation

GitHub Advisory Database · 2026-10-23

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

GitHub Advisory Database · 2026-10-23

filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory

GitHub Advisory Database · 2026-10-23

filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files

GitHub Advisory Database · 2026-10-23

Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root

GitHub Advisory Database · 2026-10-23

Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root

GitHub Advisory Database · 2026-10-23

Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution

GitHub Advisory Database · 2026-10-23

postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words

GitHub Advisory Database · 2026-10-23

Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1

GitHub Advisory Database · 2026-10-23

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

GitHub Advisory Database · 2026-10-23

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

GitHub Advisory Database · 2026-10-23

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

GitHub Advisory Database · 2026-10-23

Laravel TokenGuard authentication bypass through non-string API credentials

GitHub Advisory Database · 2026-10-23

Laravel relationship inclusion can trigger unauthorized data destruction

GitHub Advisory Database · 2026-10-23

setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description

GitHub Advisory Database · 2026-10-23

fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

GitHub Advisory Database · 2026-10-23

fast-uri vulnerable to improper path equivalence in relative reference normalization

GitHub Advisory Database · 2026-10-23

fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization

GitHub Advisory Database · 2026-10-23

fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

GitHub Advisory Database · 2026-10-23

FastMCP: Post-transform component authorization is skipped on direct calls

GitHub Advisory Database · 2026-10-23

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

GitHub Advisory Database · 2026-10-23

vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)

GitHub Advisory Database · 2026-10-23

SvelteKit: URL redirection to untrusted site via enhanced form submission

GitHub Advisory Database · 2026-10-23

chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-For

GitHub Advisory Database · 2026-10-23

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

GitHub Advisory Database · 2026-10-23

pypdf: Possible long runtimes for repeated references to the same missing object

GitHub Advisory Database · 2026-10-23

pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)

GitHub Advisory Database · 2026-10-23

pypdf: Possible long runtimes for large xref table header limits

GitHub Advisory Database · 2026-10-23

Tokio: Race condition in `tokio::time::Interval`

GitHub Advisory Database · 2026-10-23

Electron: Mitigation for compromised eMudhra intermediate certificates

GitHub Advisory Database · 2026-10-23

body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

GitHub Advisory Database · 2026-10-23

gitoxide gix: untrusted .git/config disables filesystem .git-protection path checks via unfiltered protect_options()

GitHub Advisory Database · 2026-10-23

Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order

GitHub Advisory Database · 2026-10-23

Echo: X-Real-IP extractor trusts the header value instead of the sending peer

GitHub Advisory Database · 2026-10-23

Echo: WebSocket proxy can retain connections and handlers after client disconnect

GitHub Advisory Database · 2026-10-23

Echo: Decompress permits unbounded gzip expansion in v4

GitHub Advisory Database · 2026-10-23

Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

GitHub Advisory Database · 2026-10-23

Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests

GitHub Advisory Database · 2026-10-23

Echo: BodyDump captures request and response bodies without size limits in v4

GitHub Advisory Database · 2026-10-23

Strands Agents SDK: Exposure of data element to wrong session in the A2A Server

GitHub Advisory Database · 2026-10-23

virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)

GitHub Advisory Database · 2026-10-23

Mistune: Path Traversal and XSS in Include directive

GitHub Advisory Database · 2026-10-23

Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH

GitHub Advisory Database · 2026-10-23

Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer

GitHub Advisory Database · 2026-10-23

Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer

GitHub Advisory Database · 2026-10-23

Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree

GitHub Advisory Database · 2026-10-23

Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value

GitHub Advisory Database · 2026-10-23

vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engine

GitHub Advisory Database · 2026-10-23

SvelteKit : XSS via untrusted cache-control header in prerendered page

GitHub Advisory Database · 2026-10-23

obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes

GitHub Advisory Database · 2026-10-23

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

GitHub Advisory Database · 2026-10-23

SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream

GitHub Advisory Database · 2026-10-23

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

GitHub Advisory Database · 2026-10-23

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

GitHub Advisory Database · 2026-10-23

SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized

GitHub Advisory Database · 2026-10-23

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

GitHub Advisory Database · 2026-10-23

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

GitHub Advisory Database · 2026-10-23

obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP

GitHub Advisory Database · 2026-10-23

obsidian-tc tokens can access arbitrary configured vaults

GitHub Advisory Database · 2026-10-23

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

GitHub Advisory Database · 2026-10-23

obsidian-tc : Symlink read-ACL scope bypass via lexical path checks

GitHub Advisory Database · 2026-10-23

Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive

GitHub Advisory Database · 2026-10-22

virtualenv: Generated files can follow existing destination links

GitHub Advisory Database · 2026-10-22

Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()

GitHub Advisory Database · 2026-10-22

Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive

GitHub Advisory Database · 2026-10-22

Nuxt server islands render `useHeadSafe` input without sanitisation

GitHub Advisory Database · 2026-10-22

Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled

GitHub Advisory Database · 2026-10-22

Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes

GitHub Advisory Database · 2026-10-22

pypdf: Possible long runtimes/large memory usage when retrieving form fields

GitHub Advisory Database · 2026-10-22

pypdf: Possible large memory usage when parsing arrays and dictionaries

GitHub Advisory Database · 2026-10-22

pypdf: Possible large memory usage when parsing content streams

GitHub Advisory Database · 2026-10-22

Electron: SameSite cookie restrictions are not applied to windows opened from links

GitHub Advisory Database · 2026-10-22

Electron: Pointer lock permission requests can be attributed to the wrong frame

GitHub Advisory Database · 2026-10-22

Electron: Extension tabs.query returns tab URLs and titles without the tabs permission

GitHub Advisory Database · 2026-10-22

Electron: Frame subscription trusts GPU-supplied frame geometry

GitHub Advisory Database · 2026-10-22

Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry

GitHub Advisory Database · 2026-10-22

Electron: openExternal permission requests can be attributed to the wrong origin

GitHub Advisory Database · 2026-10-22

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

GitHub Advisory Database · 2026-10-22

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

GitHub Advisory Database · 2026-10-22