GHSL-2026-112_GHSL-2026-113: Cross-thread authorization flaws allow unauthorized pin changes and poll votes in Signal for iOS
GHSL-2026-105: Removed Signal group members can modify previously sent messages on a recipient’s iOS device
GHSL-2026-072: HTML encoding bypass enables cross-site scripting in Orchard CMS
GHSL-2026-065: Unauthorized group assignment enables privilege escalation in Umbraco CMS
GHSL-2025-126_GHSL-2025-127: Unauthorized Mastodon account linking and domain creation in Lobsters
GHSL-2026-226: TOCTOU in the Marimo test release workflow
GHSL-2026-225: Artifact metadata injection in actions/attest
GHSL-2026-204: Artifact poisoning in the SPIFFE SPIRE reviewer assignment workflow
GHSL-2026-191: TOCTOU in the MongoDB JS Kerberos release notes workflow
GHSL-2026-190: TOCTOU in the MongoDB JS mongodb-connection-string-url release notes workflow
GHSL-2026-167: TOCTOU in the MongoDB JS BSON release notes workflow
GHSL-2026-166: TOCTOU in the MongoDB Node.js Driver release notes workflow
GHSL-2026-203: Same-second TOCTOU vulnerability in jupyterlab/maintainer-tools update-snapshots-checkout - CVE-2026-84973
GHSL-2026-199: Code execution in DataDog/trivy API Diff Check workflow
GHSL-2026-152: Privilege escalation via authorization bypass in graphql-ruby
GHSL-2026-140: Heap Buffer Write Overflow in 7-Zip
GHSL-2026-115–GHSL-2026-122: Various memory access violations in 7-Zip
GHSL-2026-059: SQL Injection in Chatwoot
GHSL-2026-002: Unauthorized actions or access in Open WebUI
GHSL-2026-099: Authorization Bypass in Quarkus - CVE-2026-39852
GHSL-2026-052: Stored Cross-Site Scripting (XSS) via MIME Type Spoofing in Docmost - CVE-2026-33193
GHSL-2026-012: Unauthorized Data Exposure via REST API Link Expansion in Frappe - CVE-2026-39351
GHSL-2026-102: Unauthorized exfiltration of decrypted attachments in Signal through Intent redirection
GHSL-2026-031: Stored cross-site scripting (XSS) in NocoDB leading to potential account takeover - CVE-2026-28397
GHSL-2026-030: Stored cross-site scripting (XSS) in NocoDB leading to potential unauthorized script execution - CVE-2026-28401
GHSL-2025-120: Privilege escalation allows unauthorized users to delete events in Sentry
GHSL-2025-093: Code Injection in PraisonAI claude-code-action GitHub Actions Workflow
GHSL-2026-095: Unauthorized message deletion in Signal for iOS
GHSL-2026-082: Unauthorized message deletion in Signal for Android
GHSL-2026-055: Unauthorized access to PII in Sylius - CVE-2026-31820
GHSL-2026-029: Insecure Direct Object Reference (IDOR) in Spree - CVE-2026-25757
GHSL-2026-004_GHSL-2026-005: Authentication bypass in Rocket.Chat - CVE-2026-28514, CVE-2026-30833
GHSL-2025-121_GHSL-2025-123: Cross-Site Scripting (XSS), Unvalidated Redirect, and Extensive Remote Proxy Capabilities in NocoDB - CVE-2026-24769, CVE-2026-24768, CVE-2026-53931
GHSL-2026-049: An Insecure Direct Object Reference (IDOR) in Zammad Leads to Access Control Violations
GHSL-2026-047: SQL Injection in the Zammad Project may Allow Attackers to Leak Sensitive Information
GHSL-2026-045: Server-Side Request Forgery (SSRF) in Wekan - CVE-2026-30844
GHSL-2026-044: Unauthorized Data Manipulation in Wekan - CVE-2026-30843
GHSL-2026-040: Access Control Bypass in AFFINE
GHSL-2026-037: Authentication Token Leak in Wekan - CVE-2026-30846
GHSL-2026-036: Potential Sensitive Token Exposure and Unauthorized Access in Wekan - CVE-2026-30845
GHSL-2026-035: Wekan may Leak Credentials During User Notification Workflow - CVE-2026-30847
GHSL-2026-027: An IDOR Vulnerability in Spree Commerce Allows Unauthorized Access to PII - CVE-2026-25758
GHSL-2025-129: WooCommerce Exposes Sensitive Order Information to any Logged-In Customer - CVE-2025-15033
GHSL-2025-117_GHSL-2025-118: Authorization Issues in Outline - CVE-2025-64487, CVE-2025-68663
GHSL-2025-130: Unauthorized access to event data across organizational boundaries in Sentry - CVE-2026-26004
GHSL-2025-105: Code injection in vets-api
GHSL-2025-102_GHSL-2025-103: Code injection in acl-anthology
GHSL-2025-106: Code Injection in esphome/esphome-docs Github Actions Workflow
GHSL-2025-110: Cross-site scripting (XSS) in OpenLibrary barcode scanner
GHSL-2025-076: Cross-site scripting (XSS) in bit platform Boilerplate WebInteropApp - CVE-2025-64710
GHSL-2025-104: Arbitrary command execution within the CI environment in Weaviate
GHSL-2025-099: Arbitrary code execution in cross-platform-actions/action
GHSL-2025-094: code execution in a privileged context in a GitHub workflow of faststream
GHSL-2025-090: Code injection in Github Actions with privileged context in harvester
GHSL-2025-101: Code injection in a GitHub Actions workflow of homeassistant-tapo-control - CVE-2025-55192
GHSL-2025-091: Code injection vulnerability in a GitHub Actions workflow of ansys/pymapdl
GHSL-2025-084: Untrusted code in Github Actions workflow may lead to secret leak in int128/datadog-actions-metrics
GHSL-2025-082: Unauthorized code execution in ag-grid
GHSL-2025-089: Potential code execution in privileged context in YDB
GHSL-2025-087: Potential code execution in high privilege context in PX4-Autopilot
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
