Most recent entries from github

GHSA-xxrc-g5c2-523g

2026-09-02T00:31:27+00:00

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154.

GHSA-xx5w-j8g7-4v5f

2023-12-13T18:30:59+00:00

An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SBC) and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain access as an arbitrary (administrative) user.

GHSA-xw3v-hx8p-r8v7

2026-08-04T18:31:29+00:00

A vulnerability allowing remote unauthenticated code execution on the agent host.

GHSA-xvh6-w8q3-q5g8

2026-08-18T15:31:49+00:00

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

GHSA-xvg3-q6r5-8fhf

2023-01-05T15:30:28+00:00

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors.

GHSA-xv32-fpqh-v67r

2025-07-09T21:31:06+00:00

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise.

GHSA-xrc8-933j-f74c

2026-04-03T00:31:09+00:00

Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.

GHSA-xr5v-45r7-33pq

2024-04-04T01:34:12+00:00

NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution.

GHSA-xqpc-xqhc-3crx

2026-06-19T15:33:15+00:00

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

Withdrawn: GHSA-xq74-c7jx-8w5j — Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store

2026-10-01T15:27:12+00:00

Withdrawn by the publisher.

Affected: npm: vm2

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-98xx-8mx4-x7cm. This link is maintained to preserve external references.

## Original Description vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.