31103 matches found
CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`
Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...
EUVD-2026-83981
Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...
CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`
Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...
CVE-2026-55563
Feast , an open-source feature store for AI/ML, is vulnerable in versions prior to 0.65.0 through its GitHub Actions workflow (.github/workflows/pr_integration_tests.yml). The workflow uses pull_request_target with the synchronize event and preserves approval labels (ok-to-test, approved, lgtm) a...
CVE-2026-55870
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...
CVE-2026-55625
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...
CVE-2026-55870
GoCD , a continuous delivery server, prior to version 26.1.0 , can expose unmasked credentials that administrators embedded in the userinfo portion of source control material URLs through several read-only APIs accessible to regular authenticated users. The root cause is that legacy configuration...
EUVD-2026-83953
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...
CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...
CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...
CVE-2026-55870 GoCD is vulnerable to credential exposure when admins insecurely configure material URLs
GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control material URLs through several read-only APIs available to regular authenticated users. Although GoCD recommends dedicated username and...
CVE-2026-55625
GoCD , a continuous delivery server, is affected by an authorization bypass in its internal material connection test APIs (/go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test) from version 16.1.0 through 26.1.0 . The APIs accept an arbitrary pipeline or pipeline...
CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...
EUVD-2026-83952
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...
CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...
CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...
Gemini’s breach of real companies exposes an AI guardrail problem
Google says one of its Gemini models accessed systems belonging to three real companies during a cybersecurity evaluation in May. The model reportedly guessed credentials in one case, while finding exposed credentials in public repositories in two others. Google says Gemini stopped once it...
CVE-2026-94379
The login function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The original code used an allowlist approach, checking only for specific HTTP methods POST and PUT before enforcing bruteforce protection, email one-time-passwo...
OPENSUSE-SU-2026:21899-1 Security update for alloy
This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...
SUSE-SU-2026:23853-1 Security update for alloy
This update for alloy fixes the following issues: - CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs bsc1265542. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad...