All pull requests

Pull requests

• [AppSecAI Agent] Forge: Denial of service in TLS record processing via call stack exhaustion

  #723·conviso-platform-appsec-staging[bot] opened Oct 31, 2026Bot·

  ·
  1

• [AppSecAI Agent] Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

  #722·conviso-platform-appsec-staging[bot] opened Oct 31, 2026Bot·

  ·
  1

• [AppSecAI Agent] Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

  #721·conviso-platform-appsec-staging[bot] opened Oct 31, 2026Bot·

  ·
  1

• [AppSecAI Agent] minimatch has potential denial of service via globparts amplification

  #720·conviso-platform-appsec-staging[bot] opened Oct 31, 2026Bot·

  ·
  1

• [AppSecAI Agent] Forge: Regular expression denial of service in PEM decoding (pem.decode)

  #719·conviso-platform-appsec-staging[bot] opened Oct 31, 2026Bot·

  ·
  1

• [AppSecAI Agent] GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

  #717·conviso-platform-appsec-staging[bot] opened Oct 29, 2026Bot·

  ·
  1

• [AppSecAI Agent] GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications

  #716·conviso-platform-appsec-staging[bot] opened Oct 29, 2026Bot·

  ·
  1

• [AppSecAI Agent] GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

  #715·conviso-platform-appsec-staging[bot] opened Oct 29, 2026Bot·

  ·
  1

• [AppSecAI Agent] GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller

  #714·conviso-platform-appsec-staging[bot] opened Oct 29, 2026Bot·

  ·
  1

• [AppSecAI Agent] undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

  #713·conviso-platform-appsec-staging[bot] opened Oct 28, 2026Bot·

  ·
  1

• [AppSecAI Agent] qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

  #712·conviso-platform-appsec-staging[bot] opened Oct 28, 2026Bot·

  ·
  1

• [AppSecAI Agent] undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

  #711·conviso-platform-appsec-staging[bot] opened Oct 28, 2026Bot·

  ·
  1

• [AppSecAI Agent] undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

  #710·conviso-platform-appsec-staging[bot] opened Oct 28, 2026Bot·

  ·
  1

• [AppSecAI Agent] deepmerge mergeObject() allows prototype poisoning of returned objects

  #709·conviso-platform-appsec-staging[bot] opened Oct 28, 2026Bot·

  ·
  1

• [AppSecAI Agent] fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding

  #707·conviso-platform-appsec-staging[bot] opened Oct 24, 2026Bot·

  ·
  1

• [AppSecAI Agent] fast-uri vulnerable to improper path equivalence in relative reference normalization

  #706·conviso-platform-appsec-staging[bot] opened Oct 24, 2026Bot·

  ·
  1

• [AppSecAI Agent] Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

  #705·conviso-platform-appsec-staging[bot] opened Oct 24, 2026Bot·

  ·
  1

• [AppSecAI Agent] fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references

  #704·conviso-platform-appsec-staging[bot] opened Oct 24, 2026Bot·

  ·
  1

• [AppSecAI Agent] undici vulnerable to Denial of Service via unbounded memory in the EventSource parser

  #703·conviso-platform-appsec-staging[bot] opened Oct 24, 2026Bot·

  ·
  1

• [AppSecAI Agent] GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

  #699·conviso-platform-appsec-staging[bot] opened Oct 23, 2026Bot·

  ·
  1

• docs(reachability): update path graph screenshot

  #698·firedragon9511 opened Oct 22, 2026Contributor·3 tasks done·

  ·
  1

• [AppSecAI Agent] sharp : Vulnerability in librsvg dependency CVE-2026-96889

  #697·conviso-platform-appsec-staging[bot] opened Oct 22, 2026Bot·

  ·
  1

• [AppSecAI Agent] sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

  #696·conviso-platform-appsec-staging[bot] opened Oct 22, 2026Bot·

  ·
  1

• [AppSecAI Agent] sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545

  #695·conviso-platform-appsec-staging[bot] opened Oct 22, 2026Bot·

  ·
  1

• [AppSecAI Agent] markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

  #693·conviso-platform-appsec-staging[bot] opened Oct 21, 2026Bot·

  ·
  1