All pull requests

Pull requests

• [GHSA-334f-vvp4-7g6p] Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability

  #10389·bribrothers opened Oct 15, 2026·

  ·
  2

• [GHSA-8v8x-cx79-35w7] React Router SSR XSS in ScrollRestoration

  #10388·avidpupilskateboards opened Oct 15, 2026·

  ·
  1

• [GHSA-j8rh-479h-cp32] Add affected range for axios 0.x (patched in 0.34.0)

  #10387·akhan-pn opened Oct 15, 2026·

  ·

• [GHSA-44g4-m2mj-wpvx] Add affected range for axios 0.x (patched in 0.34.0)

  #10386·akhan-pn opened Oct 15, 2026·

  ·

• [GHSA-mghh-pgcx-3jjj] Add affected range for axios 0.x (patched in 0.34.0)

  #10385·akhan-pn opened Oct 15, 2026·

  ·

• [GHSA-m358-vx46-jcm4] Add summary

  #10384·ErenYeager1836 opened Oct 15, 2026·

  ·

• [GHSA-fm4g-76c9-7w69] Http4s: DigestAuth nonce map grows unbounded

  #10383·rossabaker opened Oct 15, 2026·

  ·
  2

• [GHSA-9xww-74xv-gjfp] Http4s: DigestAuth allows replay of captured requests

  #10382·rossabaker opened Oct 15, 2026·

  ·
  2

• [GHSA-8xx9-69p8-7jp3] LiquidJS has a renderLimit DoS guard bypass via empty {% for %} body

  #10380·SiteQ8 opened Oct 15, 2026·

  ·
  1

• [GHSA-2qv6-9wx5-cwv4] LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS

  #10379·SiteQ8 opened Oct 15, 2026·

  ·
  1

• [GHSA-9x9p-qf8f-mvjg] LiquidJS's {% render %} tag silently bypasses per-render ownPropertyOnly:true via Context.spawn()

  #10378·SiteQ8 opened Oct 15, 2026·

  ·
  1

• [GHSA-hh27-hf48-9f5q] LiquidJS has a memory and render limit bypass via unbounded width padding in date filter (strftime)

  #10377·SiteQ8 opened Oct 15, 2026·

  ·
  1

• [GHSA-6q5m-63h6-5x4v] LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

  #10376·SiteQ8 opened Oct 15, 2026·

  ·
  1

• [GHSA-9r5m-9576-7f6x] LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

  #10375·SiteQ8 opened Oct 15, 2026·

  ·
  1

• Update introduced field for GHSA-3w5p-95mh-gq75

  #10373·oliviersels opened Oct 15, 2026·

  ·

• [GHSA-3r7j-8mqh-6qhx] Jadx-gui vulnerable to swing HTML Denial of Service (DoS) attack

  #10372·muhammedalikcb opened Oct 15, 2026·

  ·
  2

• [GHSA-5f42-97gr-vfhq] Moquette: Pattern-ACL wildcard injection (cross-tenant authorization bypass) plus a remote-unauthenticated DoS cluster, a Will-message authorization bypass, and a cross-session durable-corruption bug

  #10371·muhammedalikcb opened Oct 15, 2026·

  ·
  4

• [GHSA-j24h-xcpc-9jw8] Eclipse IDE XXE in eclipse.platform

  #10370·muhammedalikcb opened Oct 15, 2026·

  ·
  2

• [GHSA-748c-f84h-hp2v] DOMPurify before 3.4.13 contains a cross-site scripting...

  #10369·sbouchet opened Oct 15, 2026·

  ·

• [GHSA-fx2h-pf6j-xcff] vite: server.fs.deny bypass on Windows alternate paths

  #10368·uasianubong-droid opened Oct 15, 2026·

  ·
  2

• Add npm @actions/glob package data to GHSA-2gwh-2hvc-7qgh (CVE-2025-5890)

  #10367·incr3d1ble opened Oct 15, 2026·

  ·

• [GHSA-88f6-4rjv-x774] Add fix commit reference

  #10365·stanleys12 opened Oct 14, 2026·

  ·

• [GHSA-m469-88xx-8rx2] Add fix commit reference

  #10364·stanleys12 opened Oct 14, 2026·

  ·

• [GHSA-4vh2-39rq-rq8j] Add fix commit reference

  #10363·stanleys12 opened Oct 14, 2026·

  ·

• [GHSA-26hh-7cqf-hhc6] Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

  #10362·ranjiGT opened Oct 14, 2026·

  ·
  2