CVE-2026-58427 Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Private org member list leaked via /members API endpoint — incomplete fix for PR 38145...

CVE-2026-58416

CVE-2026-58416 (Gitea) describes a read-access leak in the Fork-PR Actions path: when a private repo B lists A as a collaborative owner, GetActionsUserRepoPermission on the collaborative-owner branch returns code-read permissions even if the fork PR is involved, enabling an attacker to clone a th...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

EUVD-2026-58149

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897

CVE-2026-57897 describes a Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs in Gitea. Connected sources confirm the issue affects Gitea’s org-level Actions Run/Job API surface, enabling information disclosure across repositories. The vulnerability’s exact root cause is not exh...

CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content

Cross-repository issue/comment attachment re-linking can expose private attachment content...

EUVD-2026-58142

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

What 50 open source projects taught us about security in the AI era

AI is changing the pace of open source development and the security challenges that come with it. Maintainers are reviewing unfamiliar contributions, managing new attack surfaces, and responding to vulnerabilities with limited time and resources. Session 4 of the GitHub Secure Open Source Fund...

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...

CVE-2026-30965

creationtimestamp| type| source ---|---|--- 2026-08-13 09:00:07+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-30965.yaml 2026-08-14 00:00:09+00:00| confirmed|...

ROOT-APP-PYPI-GHSA-2F96-G7MH-G2HX GHSA-2f96-g7mh-g2hx in GitPython - Patched by Root

Root has patched GHSA-2f96-g7mh-g2hx in the GitPython package for Root:PyPI. Multiple fixed versions available...

Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery

Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins. id: CVE-2018-1000600...

PT-2026-71699

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-73425

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-hp3v-mfqw-h74c...

CVE-2026-73306

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:36+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm...

CVE-2026-73410

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:06+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435...

[SECURITY] [DSA 6434-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6434-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 12, 2026 https://www.debian.org/security/faq -...