| standard |
9001_copyparty |
F2 |
9001_copyparty |
confirmed |
yes |
Triage - under maintainer review |
| standard |
cypht-org_cypht |
F2 |
cypht-org_cypht |
confirmed |
yes |
Replied - already known, fix merged, ships next release, credited |
| standard |
cypht-org_cypht |
F3 |
cypht-org_cypht |
confirmed |
yes |
No reply yet - maintainer confirmed received, working on it |
| standard |
cypht-org_cypht |
F5 |
cypht-org_cypht |
confirmed |
yes |
No reply yet - maintainer confirmed received, working on it |
| standard |
cypht-org_cypht |
F6 |
cypht-org_cypht |
confirmed |
yes |
No reply yet - maintainer confirmed received, working on it |
| standard |
dokuwiki_dokuwiki |
F1 |
dokuwiki_dokuwiki |
confirmed |
yes |
not submitted |
| deepscan (deepseek) |
fb55_htmlparser2 |
F1 |
Quadratic CPU in closing-tag handling via lastIndexOf on the open-element stack (unauthenticated DoS) |
confirmed |
yes |
not submitted (email sent to you) |
| standard |
FreshRSS_FreshRSS |
F1 |
FreshRSS_FreshRSS |
confirmed |
yes |
not submitted |
| standard |
FreshRSS_FreshRSS |
F2 |
FreshRSS_FreshRSS |
confirmed |
yes |
not submitted |
| standard |
itteco_iframely |
F1 |
itteco_iframely |
confirmed |
yes |
not submitted |
| standard |
NaturalIntelligence_fast-xml-parser |
F1 |
NaturalIntelligence_fast-xml-parser |
confirmed |
yes |
Published - patched in 5.12.0, CVE requested |
| standard |
phpipam_phpipam |
F1 |
phpipam_phpipam |
confirmed |
yes |
not submitted |
| standard |
phpipam_phpipam |
F3 |
phpipam_phpipam |
confirmed |
yes |
not submitted |
| deepscan (deepseek) |
projectsend_projectsend |
F1 |
Client can publish files by creating a subfolder inside a read-only public folder |
confirmed |
yes |
not submitted (email sent to you) |
| standard |
YOURLS_YOURLS |
F3 |
YOURLS_YOURLS |
confirmed |
yes |
Draft - fix merged (PR #4207), confirmed by maintainer |
| standard |
YOURLS_YOURLS |
F4 |
YOURLS_YOURLS |
confirmed |
yes |
Draft - fix validated, ready to publish |
| standard |
9001_copyparty |
F1 |
9001_copyparty |
confirmed |
no |
not submitted |
| standard |
9001_copyparty |
F3 |
9001_copyparty |
confirmed |
no |
not submitted |
| standard |
9001_copyparty |
F4 |
9001_copyparty |
confirmed |
no |
not submitted |
| standard |
cypht-org_cypht |
F1 |
cypht-org_cypht |
uncertain |
no |
not submitted |
| deepscan (deepseek) |
DaveGamble_cJSON |
F1 |
Incomplete fix: heap-use-after-free in cJSONUtils_MergePatch when an object merge patch is a subtree of the target |
confirmed |
no |
not submitted (email sent to you) |
| deepscan (deepseek) |
DaveGamble_cJSON |
F2 |
Heap-use-after-free in cJSONUtils_ApplyPatches when the patch array is a subtree of the object being patched |
confirmed |
no |
not submitted (email sent to you) |
| deepscan (deepseek) |
fb55_htmlparser2 |
F2 |
Quadratic CPU in duplicate-<form> suppression via stack.includes() (unauthenticated DoS) |
confirmed |
no |
not submitted (email sent to you) |
| deepscan (deepseek) |
fb55_htmlparser2 |
F3 |
Quadratic CPU in SVG tag-name adjustment via stack.includes() inside HTML integration points (DoS) |
confirmed |
no |
not submitted (email sent to you) |
| deepscan (deepseek) |
fb55_htmlparser2 |
F4 |
Quadratic time and memory when completing tokens split across many chunks due to Array.shift() in shiftBuffer (streaming DoS) |
uncertain |
no |
not submitted (email sent to you) |
| standard |
filegator_filegator |
F1 |
filegator_filegator |
uncertain |
no |
not submitted |
| standard |
jbeder_yaml-cpp |
F1 |
jbeder_yaml-cpp |
confirmed |
no |
not submitted |
| standard |
jbeder_yaml-cpp |
F2 |
jbeder_yaml-cpp |
uncertain |
no |
not submitted |
| standard |
NaturalIntelligence_fast-xml-parser |
F2 |
NaturalIntelligence_fast-xml-parser |
uncertain |
no |
not submitted |
| standard |
phpipam_phpipam |
F2 |
phpipam_phpipam |
uncertain |
no |
not submitted |
| deepscan (deepseek) |
vitalik_django-ninja |
F1 |
Awaitable-returning authentication callbacks are accepted as authenticated (authentication bypass) |
rejected |
no |
not submitted (email sent to you) |
| deepscan (deepseek) |
vitalik_django-ninja |
F2 |
Default pagination limit is unbounded, allowing remote resource exhaustion |
confirmed |
no |
not submitted (email sent to you) |
| standard |
YOURLS_YOURLS |
F1 |
YOURLS_YOURLS |
confirmed |
no |
not submitted |