All pull requests

Pull requests

• [GHSA-3fh5-q6fg-w28q] add winter/wn-system-module, which ships the Snowboard framework

  #10965·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-x32g-jvvm-4725] add a2a-java-sdk-compat-0.3-transport-rest, which receives the same fix

  #10964·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-9rhm-2h4x-jwmx] add the three a2a-java modules changed by the fix

  #10963·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-68jx-f42c-7599] add typo3/cms-install and list cms-backend and cms-core for both the 13.x and 14.x ranges

  #10962·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-6qxp-vccf-f47h] add @modelcontextprotocol/core, which the advisory text tells users to upgrade

  #10961·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-j95f-988m-3j2f] add @tiptap/extension-mention, which contains a fixed attribute regex

  #10960·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-58fp-mcx6-7qf9] add winter/wn-system-module, which contains the changed CombineAssets and MailBrandSetting

  #10959·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-xcx6-jx8p-x3h5] @azure/msal-node: the fix shipped in 7.0.2

  #10958·zyl71 opened Nov 7, 2026·

  ·
  2

• [GHSA-8x7x-83cf-c3pg] github.com/hatchet-dev/hatchet: the fix is already in 0.91.1

  #10957·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-27mw-82g8-phjj] @sveltejs/kit: add the 2.x fix released in 2.70.4

  #10956·zyl71 opened Nov 7, 2026·

  ·
  3

• [GHSA-f9x3-7vq9-cph6] laravel/framework: the 13.x fix shipped in 13.27.0, not 13.29.0

  #10955·zyl71 opened Nov 7, 2026·

  ·
  2

• [GHSA-9jg3-g3wh-w9pj] org.yamcs:yamcs-core: set the first patched version to 5.11.13, matching the affected range

  #10954·zyl71 opened Nov 7, 2026·

  ·
  2

• [GHSA-whrx-mmgr-gpcf] snipe/snipe-it: the fix shipped in 8.5.0, not 8.6.2

  #10953·zyl71 opened Nov 7, 2026·

  ·
  3

• [GHSA-3w98-rrpr-fprr] org.hl7.fhir.r5 and org.hl7.fhir.validation: the fix is already in 6.9.11

  #10952·zyl71 opened Nov 7, 2026·

  ·
  1

• [GHSA-5gpm-rgj3-9q76] github.com/zalando/skipper: the fix is already in 0.27.35

  #10951·zyl71 opened Nov 7, 2026·

  ·
  2

• [GHSA-47w9-6r3f-938g] LXD has restricted project bypass leading to arbitrary command execution

  #10950·ultragangster7 opened Nov 7, 2026·

  ·
  5

• [GHSA-qpgp-93vx-g8v8] Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion

  #10949·ultragangster7 opened Nov 7, 2026·

  ·
  5

• Add Django upload-limit fix references for CVE-2026-5766

  #10948·vivanvv opened Nov 7, 2026·

  ·
  1

• Add Django STARTTLS fix references for CVE-2026-7666

  #10947·vivanvv opened Nov 7, 2026·

  ·
  1

• Add missing CVE-2026-48751 alias to GHSA-47w9-6r3f-938g

  #10946·ranjiGT opened Nov 7, 2026·

  ·

• [GHSA-5h23-36rv-pm65] Use released module version 2.11.1 as the fixed boundary

  #10945·mytrashcan opened Nov 7, 2026·

  ·
  1

• [GHSA-rxcj-4pj5-74gr] Use released module version 2.11.1 as the fixed boundary

  #10944·mytrashcan opened Nov 7, 2026·

  ·
  1

• [GHSA-8jjq-8j9w-m2v6] Use released module version 2.11.1 as the fixed boundary

  #10943·mytrashcan opened Nov 7, 2026·

  ·
  1

• [GHSA-x2q3-8cjh-766f] Use released module version 2.11.1 as the fixed boundary

  #10942·mytrashcan opened Nov 7, 2026·

  ·
  1

• [GHSA-c85p-xxjj-2r75] Use released module version 2.11.1 as the fixed boundary

  #10941·mytrashcan opened Nov 7, 2026·

  ·
  1