All pull requests

Pull requests

• Add advisory: zip unbounded symlink-target allocation (CVE-2026-115909)

  #3451·li-jin-quan opened Oct 27, 2026·

  ·
  1

• Add pulldown-cmark quadratic-time parsing DoS advisory

  #3444·come-bruneteau opened Oct 25, 2026·3 of 4 tasks·

  ·
  4

• added two new advisories for brotlic & brotli-sys related to CVE-2026-111497

  #3443·6mile opened Oct 25, 2026·

  ·
  5

• owned-alloc: RawVec::resize calls realloc on a dangling pointer

  #3442·hardhus opened Oct 24, 2026·

  ·
  1

• Add advisory for xmloxide DTD content-model stack overflow (CVE-2026-61727)

  #3436·williamareynolds opened Oct 23, 2026·4 tasks done·

  ·
  3

• Add advisory for auth-framework: Debug output prints a TOTP secret and OAuth 1.0a token secrets

  #3427·ciresnave-bot opened Oct 23, 2026·

  ·

• Add advisory for auth-framework: passkey authentication accepts an assertion without verifying it

  #3426·ciresnave-bot opened Oct 23, 2026·

  ·

• Add advisory for ark-groth16 missing public input length check

  #3410·D33BaT0 opened Oct 20, 2026·3 of 4 tasks·

  ·
  1

• Add ligerito advisories: proof forgery, 64-bit Fiat–Shamir challenges

  #3370·hitchho opened Oct 14, 2026·

  ·
  1

• Add advisories for ephemeral-rollups-sdk and ephemeral-rollups-pinocchio: undelegation buffer not validated

  #3356·kriss39 opened Oct 11, 2026·3 of 4 tasks·

  ·
  4

• Added gaoya advisory

  #3350·Ollie-Pearce opened Oct 10, 2026Contributor·3 of 4 tasks·

  ·
  3

• Added advisory for grin_secp256k1zkp

  #3349·Ollie-Pearce opened Oct 10, 2026Contributor·3 of 4 tasks·

  ·
  1

• Added libvips advisory

  #3348·Ollie-Pearce opened Oct 10, 2026Contributor·3 of 4 tasks·

  ·
  2

• Added advisory for pcap-async

  #3347·Ollie-Pearce opened Oct 10, 2026Contributor·3 of 4 tasks·

  ·
  1

• Add advisory for openjp2 memory corruption bug

  #3346·Ollie-Pearce opened Oct 10, 2026Contributor·3 of 4 tasks·

  ·
  1

• Add advisory: finalfusion unbounded allocations (CWE-770)

  #3338·li-jin-quan opened Oct 9, 2026·

  ·
  1

• Add advisory for hecs: double free when a component's Drop panics

  #3323·tooson9010-spec opened Oct 8, 2026Contributor·4 tasks done·

  ·
  1

• Add advisory for a2a-protocol-server (GHSA-hr9h-6jvf-wvg6)

  #3299·tomtom215 opened Sep 30, 2026·4 tasks done·

  ·
  3

• Add advisory for zip: panic in ZipFile::drop on I/O error (0.4.1-1.2.0)

  #3292·h-t-m opened Sep 28, 2026·

  ·
  3

• Add advisory for perpetual: Histogram builders index with get_unchecked from safe fun...

  #3266·lwz23 opened Sep 23, 2026Contributor·3 of 4 tasks·

  ·
  2

• Add advisory for may: wakeup indexes the event-fd vector with get_unchecked

  #3265·lwz23 opened Sep 23, 2026Contributor·3 of 4 tasks·

  ·
  2

• Add advisory for libsql-sqlite3-parser: keyword_token treats arbitrary bytes as UTF-8

  #3264·lwz23 opened Sep 23, 2026Contributor·3 of 4 tasks·

  ·
  2

• Add advisory for gpu-allocator: from_winapi_d3d12_resource_desc dereferenced a caller...

  #3262·lwz23 opened Sep 23, 2026Contributor·3 of 4 tasks·

  ·
  2

• Add advisory for gdal: _string and _pathbuf called CStr::from_ptr on an unchecked...

  #3261·lwz23 opened Sep 23, 2026Contributor·3 of 4 tasks·

  ·
  4

• Add advisory for capnp: set_capability_pointer dereferenced a raw pointer in a safe f...

  #3260·lwz23 opened Sep 23, 2026Contributor·3 of 4 tasks·

  ·
  1