Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection

Cybersecurity researchers at Wiz have disclosed a new GitHub Actions workflow injection vulnerability in Snowflake's public snowflakedb/snowflake-connector-net repository that it said could be exploited through a crafted GitHub issue to execute commands in a workflow containing internal Jira...

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

CVE-2026-74870

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...

CVE-2026-74870 openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...

BIT-GITLAB-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

PT-2026-73291

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

MAL-2026-14060 Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: migrate, knative-net-istio, cass-operator-fips, crossplane, commercial-grafana, wave, flagger-fips, teleport-operator-fips, ucd, cluster-api, kustomize, terraform-provider-sendgrid-fips, pguser, kubeflow, gitleaks-fips, hey, emqx-exporter, knative-eventing-fips,...

CVE-2026-22555

A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...

GO-2026-5486 vulnerabilities

Vulnerabilities for packages: tkn-fips, tkn, tekton-pipelines-fips, tekton-chains, tekton-chains-fips, tekton-pipelines...

GO-2026-4678 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, argo-workflows-fips...

GO-2025-3720 vulnerabilities

Vulnerabilities for packages: argo-cd, argocd-image-updater-fips, argocd-image-updater...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: grype-db, aws-otel-collector, kargo, splunk-otel-collector, syft-fips, tw, dagger, beats-fips, buf, cadvisor-fips, trivy-fips, goreleaser, trufflehog, opentelemetry-collector-contrib-fips, docker-compose-fips, spire-server-fips, falcoctl, openfga-fips,...

GO-2023-1754 vulnerabilities

Vulnerabilities for packages: apko, aactl, ko...

GO-2026-5751 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GO-2025-4245 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, nats, jaeger, argo-workflows, k3s, opentelemetry-collector, datadog-agent, kine, kubeflow-pipelines, argo-cd, coredns, k8sgateway, argo-rollouts, grafana-alloy, k8sgpt, kserve, kargo, vale, amazon-cloudwatch-agent,...

GHSA-P28V-F755-9QRG

creationtimestamp| type| source ---|---|--- 2026-08-13 21:32:39+00:00| seen| https://gist.github.com/alon710/9ad8f19dc4256e5aad5d6b3105b603da...

semgrep v1.173.0

Code scanning at ludicrous speed. Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows. Semgrep is...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...