CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2024-58354

Cal.com (cal.com/cal.diy) is affected by a repository takeover via its GitHub Actions workflow. The pr.yml workflow uses pull_request_target and passes repo default write permissions to check-types.yml, which then dangerous-checks out the attacker PR and executes it (yarn install, package.json sc...

CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...

CVE-2026-16733

The CVE refers to bahmutov find-cypress-specs (up to version 1.54.12) where the function shell.exec in src/index.js of the Branch Handler is vulnerable. Manipulating the --branch argument leads to OS command injection. The attack is described as locally executable, with the exploit publicly avail...

CVE-2026-16733 bahmutov find-cypress-specs Branch index.js shell.exec os command injection

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...

EUVD-2026-48243

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

PT-2026-64180

Name of the Vulnerable Software and Affected Versions cal.com main branch Description A repository takeover issue exists in the GitHub Actions workflows. The pr.yml workflow utilizes the pull request target trigger with default write permissions, which are passed to check-types.yml. This second...

GO-2026-6043 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through modRMRequired and decode in arch/X86/X86DisassemblerDecoder.c. An attacker can crash any application using a reduced X86 Capstone build by supplying crafted x86/x86-64 input containing a 3DNow! opcode...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the vvdecpushdata2 function. An attacker can cause an out-of-bounds heap read by supplying a crafted HEIF file with a VVC track that exploits an integer overflow in the security check, bypassing intended...

EUVD-2026-41636

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write...

GHSA-649P-MMHF-85C7 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------------------------------- | | Vulnerability Title | Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write | | Severity Rating | High | | Bug...

GHSA-XXJV-752H-3VP2 Gitea: Public-only repository tokens can update private PR head branches

Summary Gitea allows a public-only,write:repository token to update a private pull request head branch through a public base repository route. The vulnerable endpoint is: text POST /api/v1/repos/public-owner/public-repo/pulls/index/update Gitea checks the token's public-only restriction against t...

GHSA-W5PG-649R-P6GG Gitea: Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag

Summary Gitea does not re-evaluate the official flag on existing pull request reviews when a PR's target branch is changed. An attacker with write access to a repository can obtain an official: true approval on a PR targeting an unprotected branch, then retarget the PR to a protected branch e.g.,...

PT-2026-63305

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description Gitea fails to re-evaluate the official flag on existing pull request reviews when the target branch of a pull request is changed. An attacker with write access to a repository can obtain an official:...

CVE-2026-47751 Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionall...

CVE-2026-49987

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection th...

CVE-2026-49987

CVE-2026-49987 affects Repomix (npm) where the function execGitShallowClone uses the --remote-branch value directly in git fetch/checkout calls. The input can be injected to pass arbitrary git options (e.g., --upload-pack) to local or SSH transports, enabling remote command execution with the use...

CVE-2026-49987 Repomix: Command Injection (RCE) via `--remote-branch` Argument Injection

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection th...

CVE-2026-49987

Repomix is a tool that packs repositories into AI-friendly files. Prior to 1.14.1, src/core/git/gitCommand.ts execGitShallowClone passes the --remote-branch value directly to git fetch and git checkout without validation or --end-of-options, allowing --upload-pack or other Git option injection th...