CVE-2026-19534 vulnerabilities

Vulnerabilities for packages: kibana, commercial-gitlab-rails-ee-fips, actions-runner, commercial-gitlab-rails-ee, renovate, prism, code-server, npm, homepage...

PT-2026-95096

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An issue exists where the absence of tests/init.py and the lack of --import-mode=importlib cause pytest to place the tests directory at the front of sys.path during...

PT-2026-95095

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description The validation test harness allows the deserialization of tracked pickle cache files via the pickle.load method within the read pickle data function located in tests/pickle...

CVE-2026-54752: Deserialization of Untrusted Data

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

CVE-2026-58502: Improper Neutralization of Special Elements used in an OS Command

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-63187: Improper Control of Generation of Code

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: argo-cd, src, trufflehog, fluent-bit-plugin-loki, flux-kustomize-controller, pgpool2exporter, golangci-lint, crossplane-provider-azure-sql, vcluster, delve, kiali, kaniko, pinact, flyte, kube-fluentd-operator, consul-k8s, helm, kubernetes-csi-livenessprobe,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: src, flux-kustomize-controller, postgres-operator, pgpool2exporter, golangci-lint, crossplane-provider-azure-sql, sbomqs, neuvector-sigstore-interface, sriov-network-device-plugin, ferretdb, scorecard, helm, kubernetes-csi-livenessprobe, kubernetes-dns-node-cache,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, step-ca, sops, crossplane-provider-azure-sql, rabbitmq-messaging-topology-operator, flux-source-controller, neuvector-sigstore-interface, kubescape, fulcio, k3s, actions-runner-controller, sigstore-scaffolding, scorecard, glab, skopeo,...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24059: Improper Privilege Management

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

PT-2026-68302

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40 Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

GHSA-35P6-XMWP-9G52 vulnerabilities

Vulnerabilities for packages: py3-captum, kibana, commercial-gitlab-rails-ee-fips, haraka, saf, actions-runner, commercial-gitlab-rails-ee, renovate, prism, vitess, code-server, npm, pelias-api, gemini-cli, node-gyp...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: py3-captum, kibana, commercial-gitlab-rails-ee-fips, haraka, saf, actions-runner, commercial-gitlab-rails-ee, renovate, prism, vitess, code-server, npm, pelias-api, gemini-cli, node-gyp...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: py3-captum, kibana, commercial-gitlab-rails-ee-fips, haraka, saf, actions-runner, commercial-gitlab-rails-ee, renovate, prism, vitess, code-server, npm, pelias-api, gemini-cli, node-gyp...

GHSA-VXPW-J846-P89Q vulnerabilities

Vulnerabilities for packages: py3-captum, kibana, commercial-gitlab-rails-ee-fips, haraka, saf, actions-runner, commercial-gitlab-rails-ee, renovate, prism, vitess, code-server, npm, pelias-api, gemini-cli, node-gyp...