All pull requests

Pull requests

• Fix affected range for GHSA-g3hv-75wg-m249

  #10807·ramonpzg opened Oct 31, 2026·

  ·

• [GHSA-8mgp-746c-j5xp] NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

  #10805·otovar-vc opened Oct 30, 2026·

  ·
  2

• [GHSA-5v8v-66v8-mwm7] Integer overflow in the bundled Brotli C library

  #10804·illia-v opened Oct 30, 2026·

  ·
  3

• [GHSA-r29h-37fj-x2w6] Add the PyPI open-webui package

  #10803·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-cqp4-qqvg-3787] Add the PyPI open-webui package

  #10802·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-8wvc-869r-xfqf] Add the PyPI open-webui package

  #10801·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-65h7-c7c4-mghx] The mlflow fix first shipped in 3.10.0, not 3.9.0

  #10800·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-p4fx-23fq-jfg6] Add the PyPI open-webui package

  #10799·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-562r-8445-54r2] Correct the package from comfy-cli to comfyui-manager

  #10798·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-3r9x-f23j-gc73] onnx 1.20.1 is still affected

  #10797·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-9r6g-266r-89x4] The nltk fix first shipped in 3.10.3, not 3.9.4

  #10796·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-wqmh-qccw-pqwf] mlflow 3.17.2 does not contain the fix

  #10795·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-m3mh-3mpg-37hw] Correct the year in the affected range (2025.3.23 → 2026.3.23)

  #10794·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-v8hw-mh8c-jxfc] Langflow 1.8.2 through 1.8.4 are still affected; add langflow-base

  #10793·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-m77w-p5jj-xmhg] Correct the npm package from openclaude to @gitlawb/openclaude

  #10792·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-vwmf-pq79-vjvx] Langflow 1.8.3 and 1.8.4 are still affected; add langflow-base

  #10791·devjoinedthechat opened Oct 30, 2026·

  ·

• [GHSA-fwxx-wv44-7qfg] Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection

  #10787·ranjiGT opened Oct 30, 2026·

  ·
  1

• [GHSA-788w-68h3-cvxp] Ghost: Remote Code Execution via Bookmark Card Images

  #10786·ranjiGT opened Oct 30, 2026·

  ·
  2

• [GHSA-q8hq-4h99-fj7x] Keycloak TLS Client-Initiated Renegotiation Denial of Service

  #10785·ranjiGT opened Oct 30, 2026·

  ·
  2

• [GHSA-x8mh-94wc-33gv] apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider

  #10784·ranjiGT opened Oct 30, 2026·

  ·
  1

• [GHSA-799x-qp47-8qwq] Apache Airflow has no certificate validation on SMTP STARTTLS connections

  #10783·ranjiGT opened Oct 30, 2026·

  ·
  1

• [GHSA-qpgp-93vx-g8v8] Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

  #10782·ranjiGT opened Oct 30, 2026·

  ·
  4

• [GHSA-2vqw-3mp8-cgmx] Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

  #10781·ranjiGT opened Oct 30, 2026·

  ·
  4

• [GHSA-7r4p-vjf4-gxv4] Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

  #10780·ranjiGT opened Oct 30, 2026·

  ·
  2

• [GHSA-w5f2-9q9c-ff4h] LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport

  #10779·ranjiGT opened Oct 30, 2026·

  ·
  2