GHSA-84X2-RFRF-6F2C vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-qemu, linux-gcp...

GHSA-59F6-F4PC-WW92 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-qemu, linux-gcp...

GHSA-FCV2-XGW5-PQXF vulnerabilities

Vulnerabilities for packages: skopeo, timestamp-authority, policy-controller-fips, tkn, undock, goreleaser, cosign, slsa-verifier, kyverno-notation-aws, cloudbeat-fips, sigstore-scaffolding, zarf, zot, fulcio, ko, spire-server-fips, trivy-operator-fips, neuvector-sigstore-interface-fips,...

AI-supported vulnerability triage with the GitHub Security Lab Taskflow Agent

Triaging security alerts is often very repetitive because false positives are caused by patterns that are obvious to a human auditor but difficult to encode as a formal code pattern. But large language models LLMs excel at matching the fuzzy patterns that traditional tools struggle with, so we at...

GHSA-JM66-CG57-JJV5 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, authentik, awx, duplicity, kserve, barman, open-webui, datadog-agent, datadog-agent-fips, request-1276, az, airflow, authentik-fips, pgadmin4...

GHSA-VH2P-4GFM-V9V7 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-qemu, linux-gcp...

GHSA-MQW7-C5GG-XQ97

creationtimestamp| type| source ---|---|--- 2026-01-13 14:36:18+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115888290409404878...

GHSA-527X-5WRF-22M2 vulnerabilities

Vulnerabilities for packages: cloudflared...

GHSA-74P9-4V44-WWX5 vulnerabilities

Vulnerabilities for packages: python...

GHSA-9WX5-5C3V-3QMX vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-vmware, linux-qemu...

GHSA-G7MW-CR59-R458 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-vmware, linux-qemu...

CVE-2022-31524

The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31529

The cinemaproject/monorepo repository through 2021-03-03 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2021-41188

Shopware is open source e-commerce software. Versions prior to 5.7.6 contain a cross-site scripting vulnerability. This issue is patched in version 5.7.6. Two workarounds are available. Using the security plugin or adding a particular following config to the .htaccess file will protect against...

CVE-2023-25560

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

GHSA-36HM-QXXP-PG3M vulnerabilities

Vulnerabilities for packages: langfuse...

GHSA-5FP7-G646-CCF4

creationtimestamp| type| source ---|---|--- 2026-01-08 21:31:12+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115861610292219134 2026-01-10 04:02:47+00:00| published-proof-of-concept| Telegram/xCOXvC0nHIdc2RZU8QnHf4AhOuGrMPNqhpiQVHQJKZvyIjM...

GHSA-3C6G-7V4G-5XCM vulnerabilities

Vulnerabilities for packages: postgresql...

GHSA-JF52-3F2H-H9J5

creationtimestamp| type| source ---|---|--- 2026-01-08 11:01:23+00:00| published-proof-of-concept| Telegram/2H0tuRFHJAYb3wZdMSBr18E38TWvMjuQyl8zYKGkwJ2kf8 2026-01-24 21:26:43+00:00| seen| https://gist.github.com/alon710/b58086582ecd8cde824806d1ad4c5b1c 2026-01-24 22:42:07+00:00| seen|...

GHSA-36HM-QXXP-PG3M

creationtimestamp| type| source ---|---|--- 2026-01-08 01:59:08+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3mbuv2h3plo2x 2026-01-08 16:03:29+00:00| seen| Telegram/eK7Ikx8B4zhc3RXJcMY-EZtQzuwPO0YG4YMu0LZCUnsVEJo 2026-01-24 21:26:46+00:00| seen|...