31588 matches found
CVE-2026-16085
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be performed locally. The exploit has be...
CVE-2026-16085 Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be performed locally. The exploit has be...
EUVD-2026-45359
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The attack may be launched remotely. The...
CVE-2026-16083
Affected software: Sipeed PicoClaw up to version 0.2.9, specifically the LINE Webhook component (webhook.ParseRequest in pkg/channels/line/line.go). Vulnerability: Authentication bypass via capture-replay. Remote exploitable condition reported; exploit released publicly. Impact: Authentication by...
CVE-2026-54547
creationtimestamp| type| source ---|---|--- 2026-07-17 20:35:06+00:00| published-proof-of-concept| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-2v2f-mvfg-ph56...
CVE-2026-54546
creationtimestamp| type| source ---|---|--- 2026-07-17 20:35:03+00:00| published-proof-of-concept| https://github.com/dfpc-coe/CloudTAK/security/advisories/GHSA-vqrw-qphh-p34v...
GHSA-XXVR-RJCX-VQW8 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-46420
setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...
CVE-2026-46420 setup-php: Command Injection in Repository-Derived PHP Version Resolution
setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...
CVE-2026-46420
setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...
GO-2026-6011 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure in github.com/envoyproxy/gateway...
GO-2026-6007 Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway
Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass in github.com/envoyproxy/gateway...
GO-2026-5935 netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil
netfoil: Attacker controlled data written to logs in github.com/tinfoil-factory/netfoil...
GO-2026-5934 netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil
netfoil has a domain name filter bypass via multiple questions in github.com/tinfoil-factory/netfoil...
GO-2026-5980 yutu: Arbitrary File Write via MCP `caption-download` Tool in github.com/eat-pray-ai/yutu
yutu: Arbitrary File Write via MCP caption-download Tool in github.com/eat-pray-ai/yutu...
GO-2026-5956 OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect in github.com/openrundev/openrun
OpenRun: Redirect URL validation bypass using //host paths leads to Open Redirect in github.com/openrundev/openrun...
GO-2026-5948 Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in github.com/enchant97/note-mark/backend
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in github.com/enchant97/note-mark/backend...
GO-2026-5991 nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh
nebula-mesh: Operator session tokens stored in plaintext in the database in github.com/forgekeep/nebula-mesh...