31508 matches found
CVE-2026-17556
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...
CVE-2026-48168
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...
CVE-2026-98198
creationtimestamp| type| source ---|---|--- 2026-08-05 19:00:06+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96789 2026-08-06 00:00:26+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/96789 2026-08-07 10:17:15+00:00| seen|...
CVE-2026-70610
creationtimestamp| type| source ---|---|--- 2026-08-05 18:40:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jjgjr26rddg7p 2026-08-05 20:32:27+00:00| seen| https://gist.github.com/alon710/70dbe55592bff589cc8e0ec9c8957411...
CVE-2026-70612
creationtimestamp| type| source ---|---|--- 2026-08-05 18:31:28+00:00| seen| https://gist.github.com/alon710/665009967811310873cc6bc149b1a673...
CVE-2026-48168
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...
CVE-2026-48168 PraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...
ROOT-APP-NPM-GHSA-WQVQ-JVPQ-H66F GHSA-wqvq-jvpq-h66f in nodemailer - Patched by Root
Root has patched GHSA-wqvq-jvpq-h66f in the nodemailer package for Root:npm. Multiple fixed versions available...
Malicious code in pp-react-worldready-v5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39 The tarball contains only package.json and vishu.js; the declared main index.js is absent, so the package has no library functionality...
ROOT-APP-PYPI-GHSA-F4XH-W4CJ-QXQ8 GHSA-f4xh-w4cj-qxq8 in langsmith - Patched by Root
Root has patched GHSA-f4xh-w4cj-qxq8 in the langsmith package for Root:PyPI. Multiple fixed versions available...
MAL-2026-12085 Malicious code in @wethenorth12/bip39-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...
GHSA-CJ62-HVV2-2Q5H
creationtimestamp| type| source ---|---|--- 2026-08-05 03:31:03+00:00| seen| https://gist.github.com/alon710/7709dc60acce15f366b5c87665dcce14...
GHSA-MX64-MJ3Q-7PRJ vulnerabilities
Vulnerabilities for packages: dapr...
osbuild-composer security update
175-1.0.1 - Track github upstream...
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...
GHSA-CHGM-3698-JM42
creationtimestamp| type| source ---|---|--- 2026-08-04 23:31:07+00:00| seen| https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a 2026-08-05 00:00:39+00:00| seen| https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a...
CVE-2026-70489
creationtimestamp| type| source ---|---|--- 2026-08-04 22:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-73cq-mcgh-379c...
CVE-2026-70492
creationtimestamp| type| source ---|---|--- 2026-08-04 21:55:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bzto3ybcv52fo 2026-08-04 22:35:08+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-pwxh-7358-jq2x 2026-08-05...