| Advisory | CVE | Severity | Class | Project |
|---|---|---|---|---|
| GHSA-79wm-x847-7cvg | CVE-2026-73222 | High · 8.8 | Unauthenticated OS command injection → RCE | claude-code-templates |
| GHSA-6c66-jp8x-q8w8 | — | High · 7.6 | Unauthenticated 0.0.0.0 bind + fail-open auth → SSRF proxy / process spawn |
aidevops |
| GHSA-qq8c-fch4-cxq7 | — | High · 7.3 | Broken access control — admin/metrics routes bypass API-key auth + permissive CORS | crw (fastCRW) |
| GHSA-4cfr-w3v5-w5j5 | CVE-2026-77474 | High · 7.1 | Algorithmic-complexity fail-open guard bypass | destructive_command_guard |
| GHSA-cff8-4h3c-9r4q | — | High · 8.5 | Cross-resource IDOR — MediaLibraryController exposes every ActiveStorage::Blob to any authenticated user |
avo |
| GHSA-fwh8-wcr5-q65c | — | Medium · 6.5 | Out-of-bounds read in the v5 CONNACK parser — the resulting length underflow disables the property-length bounds check | async_mqtt |
| GHSA-25rm-9wvm-m38v | CVE-2026-77382 | Medium · 5.9 | Post-quantum cryptography — discrete-Gaussian sampler precision below Falcon's security threshold | falcon-rust |
| GHSA-2697-fm9m-mqvw | — | Medium · 5.5 | Infinite loop (uncontrolled resource consumption) in the PEF loader — a crafted PEF header hangs Ghidra on import | Ghidra (NSA) |
| GHSA-5frc-8c8j-rcvf | — | Medium · 5.5 | Unbounded Brainfuck interpreter — a crafted non-terminating program hangs the whole process (CWE-835) | Ciphey |
| GHSA-r9cf-pw6p-wg4j | — | Low · 2.9 | Buffer underread in sr_xpath_node_name() — an empty xpath reads before the start of the buffer (CWE-786) |
sysrepo |
| GHSA-wj7q-pq96-vq3p | — | Medium · 5.5 | Two heap buffer-overflow writes in the SGI RGB loader, reachable from simage_read_image() — a file-supplied component count reaching 65535 indexes a fixed four-entry array, writing live malloc() pointers past the struct which the close path then free()s; and a signed row-length field whose guard was an upper bound only, so a negative value reached fread()'s size_t (CWE-787, CWE-129, CWE-195; <= 1.8.4, fixed in 1.8.5) |
simage (Coin3D) |
| GHSA-hr48-qwgp-86fx | — | Medium · 4.4 | Two memory-safety issues in the XPath engine, reported together — a heap use-after-free from realloc invalidation during predicate compilation, reachable from a 20-byte input (CWE-416), and a NULL dereference in set_comp_canonize via lyd_value_validate3 on the XPath />*/@* (CWE-476, 3.3) |
libyang (CESNET) |
CVE IDs are issued by GitHub after a compliance review of the published advisory, on their own schedule, and the lag is measured in weeks rather than days: CVE-2026-73222 was assigned four weeks after publication, CVE-2026-77382 five, and CVE-2026-77474 seven. Assignment and ecosystem propagation are separate steps — of the three, only CVE-2026-73222 has so far reached the global GitHub Advisory Database, which is the tier a downstream dependency scanner actually reads; the other two are assigned on the advisory but have not propagated yet. The remaining advisories are in the assignment queue; the Ghidra advisory is not, as the Ghidra Team's policy states they are not authorized to generate CVEs. The Ciphey maintainer has requested a CVE for GHSA-5frc-8c8j-rcvf directly. Further reports are in coordinated disclosure and will be listed here once published.
falcon-sampler-kat — known-answer test vectors that detect a Falcon implementation whose exp() approximation is under-provisioned, the defect class behind the falcon-rust advisory above.
The official Falcon KATs do not catch this class. A sampler running at ~2⁻³³ precision instead of the reference's ~2⁻⁵⁰ still reproduces every published test vector, because the defect only flips a rejection decision about 2⁻³³ of the time, so catching it end-to-end would take ~2³³ samples. These vectors test the arithmetic directly, at the point where the error is deterministic rather than probabilistic, and are built by construction rather than by search.
Validated in both directions, which is the part that matters for a test suite:
| implementation | result |
|---|---|
| falcon-rust v0.3.0 (post-fix) | 20/20 agree |
| falcon-rust v0.1.3 (the GHSA-25rm defect) | 10/20 caught the defect |
pornin/rust-fn-dsa v0.4.0, flr_native and flr_emu |
20/20 agree, z bit-exact |
The vectors were merged into falcon-rust at the maintainer's invitation.
Defects found, reported, and fixed upstream, credited by maintainers via commit, PR, or issue. The reporting channel differs from the advisories above; the work does not.
| Project | Finding | Outcome |
|---|---|---|
| falcon-rust Falcon / FN-DSA, NIST PQC signatures |
Beyond the advisory above: Gaussian acceptance-probability fix (930d766), then a follow-up after re-checking my own fix against the spec and finding the sampler centre still short of Falcon's precision bound (fc60813). Later, an out-of-bounds index in ber_exp: the loop ran eight shifts against a seven-byte buffer, reachable whenever the first seven bytes tie with z, about 2⁻⁵⁶ from the sampler's own RNG, which is why it had never been observed |
Four commits merged with me as git author, including the OOB fix and the precision KAT vectors contributed at the maintainer's invitation. Listed among the repo's contributors |
| PyJWT JWT library |
HMACAlgorithm.prepare_key accepted empty HMAC keys with only a warning |
Fixed in 2.13.0, which credits the report in the release commit. That release has since propagated into the dependency history of 90+ downstream repositories, including Microsoft, Sentry, Apache, PyTorch, Canonical, Bazel and Red Hat projects |
| redis-py official Redis client |
Plaintext password disclosure via ConnectionPool.__repr__ (CWE-532) |
Fixed (#3993) |
| leancrypto PQC for bare-metal and Linux kernel |
Five defects reported and fixed. ASN.1 memory leaks on error paths across six key-parsing modules (ML-DSA, ML-DSA+Ed25519/Ed448, Ed25519, Ed448, SLH-DSA) (6581568); pathLenConstraint not enforced per RFC 5280 §4.2.1.9, so a chain could exceed an intermediate CA's authorised depth (12cc2aea); a GCM buffer overflow where an over-long caller-supplied tag length writes zeros past the tag buffer (4e46730); and a pairwise-consistency-test return check that did not detect failure, fixed at the root in lc_memcmp_secure and therefore covering HQC as well as the ML-KEM path reported (fa8778a). A fifth, an XDRBG instance marking itself initially seeded after a rejected over-long personalization string (b737e9d), the maintainer classed as a correctness bug rather than a security issue, and it is listed here on that basis |
All five fixed upstream, each crediting me in the commit trailer. The path-length fix shipped with a new test-certificate matrix |
| wigolo local-first web-fetch MCP for AI agents |
SSRF fetch path vulnerable to DNS-rebinding / TOCTOU | Hardened via fetch-time address resolution; fix merged |
| libE57Format ASTM E57 point clouds — surveying, BIM, robotics |
Out-of-bounds read in BufferView::read: CheckedFile requests a full physical page regardless of bytes remaining, so a short in-memory buffer reads past its allocation. Reproduced under AddressSanitizer, patched build verified to throw instead |
Fix merged as PR #352 (0e1d480); the maintainer added a regression test adapted from my reproducer |
| tomlkit TOML parser behind Poetry |
Uncontrolled-recursion DoS in parser.py (CWE-674) |
Fixed (#459) |
| whois Python WHOIS client |
SSRF via referral following, plus a follow-up hardening pass | Both merged (#319, #321) |
| enc_rust ML-KEM |
Decapsulation missing Fujisaki–Okamoto implicit rejection | Fix authored and merged (572a37f) |
| libpqc-dyber post-quantum crypto |
FN-DSA / Falcon BerExp sampler precision below the ~2⁻⁴⁰ Rényi-divergence floor the security proof requires (b012e00); then heap overflows in signing, XMSS one-time-key reuse, LMS signatures not verifying, and KEM oracles (ab8614b); an intermittent XMSS verification failure and FN-DSA conversion UB (4eb96fb); and signature-buffer bounds, which was swept across every registered algorithm rather than patched in one place (5b5a6fd) |
Produced the project's 0.2.0 security release. 15 commits carry Reported-by: Conner (Spartan8806) |
| hermes-agent Nous Research agent framework |
Auto-approve edit gate bypassable by a multi-file patch touching a sensitive path | Fix + regression tests submitted, in review |
On calibration: I withdrew one libpqc-dyber finding of my own after re-testing it at runtime rather than from the packing arithmetic, and on libE57Format the maintainer assessed the issue as a plain bug rather than a security one, which I agreed with.
- Android / Pixel — vulnerability research submitted to Google's Android & Devices VRP (Buganizer): firmware reverse engineering, kernel/driver, and device trust-boundary work.
- Windows — local privilege escalation and kernel/driver research (MSRC; ZDI pipeline).
- Focus areas — memory corruption, TOCTOU / logic flaws, cryptanalysis, firmware RE.
Disclosure done cleanly: reported privately where a channel exists, fixes contributed upstream, no public 0-day drops. Additional reports are in coordinated disclosure and are not listed until a maintainer publishes.