Most recent entries from github

GHSA-xxrc-g5c2-523g

Tue, 18 Aug 2026 15:31:45 +0000

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154.

GHSA-xx5w-j8g7-4v5f

Tue, 05 Dec 2023 09:33:27 +0000

An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SBC) and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain access as an arbitrary (administrative) user.

GHSA-xw3v-hx8p-r8v7

Tue, 04 Aug 2026 18:31:29 +0000

A vulnerability allowing remote unauthenticated code execution on the agent host.

GHSA-xvh6-w8q3-q5g8

Tue, 18 Aug 2026 15:31:49 +0000

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

GHSA-xvg3-q6r5-8fhf

Tue, 03 Jan 2023 06:30:21 +0000

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors.

GHSA-xv32-fpqh-v67r

Thu, 26 Jun 2025 21:31:03 +0000

An OS command injection vulnerability exists in EnGenius EnShare Cloud Service version 1.4.11 and earlier. The usbinteract.cgi script fails to properly sanitize user input passed to the path parameter, allowing unauthenticated remote attackers to inject arbitrary shell commands. The injected commands are executed with root privileges, leading to full system compromise.

GHSA-xrc8-933j-f74c

Fri, 03 Apr 2026 00:31:09 +0000

Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.

GHSA-xr5v-45r7-33pq

Tue, 24 May 2022 16:52:41 +0000

NVIDIA Windows GPU Display Driver (all versions) contains a vulnerability in DirectX drivers, in which a specially crafted shader can cause an out of bounds access of an input texture array, which may lead to denial of service or code execution.

GHSA-xqpc-xqhc-3crx

Fri, 19 Jun 2026 15:33:15 +0000

In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible

Withdrawn: GHSA-xq74-c7jx-8w5j — Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store

Thu, 17 Sep 2026 15:32:15 +0000

Withdrawn by the publisher.

Affected: npm: vm2

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-98xx-8mx4-x7cm. This link is maintained to preserve external references.

## Original Description vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.