32229 matches found
GHSA-GC25-M8G6-JP4F vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-C8GQ-RHQH-WGWM vulnerabilities
Vulnerabilities for packages: dotnet-bootstrap...
CVE-2024-30464
creationtimestamp| type| source ---|---|--- 2026-03-13 18:23:34+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-30464.yaml...
Exploit for Improper Input Validation in Toolkit_Project Toolkit
gha-exploit-guard Standalone GitHub Action that scans GitHub...
GHSA-P9X5-JP3H-96MM
creationtimestamp| type| source ---|---|--- 2026-03-13 01:50:05+00:00| seen| https://gist.github.com/alon710/dd7ce6343fb3c4caed99cdfa0a07695a...
Linux Distros Unpatched Vulnerability : CVE-2026-31900
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, usepyproject: true, for...
org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-2229 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)
org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...
GO-2026-4670 OliveTin's unsafe parsing of UniqueTrackingId can be used to write files in github.com/OliveTin/OliveTin
OliveTin's unsafe parsing of UniqueTrackingId can be used to write files in github.com/OliveTin/OliveTin...
GO-2026-4678 Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows
Unauthorized access to Argo Workflows Template in github.com/argoproj/argo-workflows...
GO-2026-4671 Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval in github.com/anchore/quill
Quill vulnerable to SSRF via unvalidated URL from Apple notarization log retrieval in github.com/anchore/quill...
org.webjars.npm:actions__core (>=1.10.0, <=1.11.1), org.webjars.npm:actions__http-client (>=2.2.1, <=2.2.3) +14 more potentially affected by CVE-2026-1525 via org.webjars.npm:undici (>=4.12.2, <=5.29.0)
org.webjars.npm:undici MAVEN version =4.12.2, =1.10.0, =2.2.1, =0.1.16, =0.1.28 - org.webjars.npm:elasticelasticsearch 8.6.0 - org.webjars.npm:elastictransport 8.3.1 - org.webjars.npm:firebase 10.13.0 - org.webjars.npm:firebaseauth 1.7.7 - org.webjars.npm:firebaseauth-compat 0.5.12 -...
GHSA-92GP-JFGX-9QPV
creationtimestamp| type| source ---|---|--- 2026-03-12 19:10:05+00:00| seen| https://gist.github.com/alon710/81922f2048444626dde8917d1920b821...
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
In this article 1. From search to stolen credentials: Storm-2561 attack chain 2. Defending against credential theft campaigns 3. Microsoft Defender detection and hunting guidance 4. Indicators of compromise In mid-January 2026, Microsoft Defender Experts identified a credential theft campaign tha...
Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
In this article 1. From search to stolen credentials: Storm-2561 attack chain 2. Defending against credential theft campaigns 3. Microsoft Defender detection and hunting guidance 4. Indicators of compromise In mid-January 2026, Microsoft Defender Experts identified a credential theft campaign tha...
SUSE CVE-2026-31900
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, usepyproject: true, for reading the version of Black to use from the repository pyproject.toml. A malicious pull request could edit pyproject.toml to use a direct...
GHSA-VRQC-59MW-QQG7
creationtimestamp| type| source ---|---|--- 2026-03-12 11:40:06+00:00| seen| https://gist.github.com/alon710/ac739fc815a71a1bbc17c69f0d2579f2...
CVE-2026-31833
creationtimestamp| type| source ---|---|--- 2026-03-12 11:40:06+00:00| seen| https://gist.github.com/alon710/ac739fc815a71a1bbc17c69f0d2579f2...
CVE-2026-32614
creationtimestamp| type| source ---|---|--- 2026-03-12 03:40:38+00:00| published-proof-of-concept| https://github.com/emmansun/gmsm/security/advisories/GHSA-5xxp-2vrj-x855...
xygeni-action v5 tag poisoned with C2 backdoor
Description On March 3, 2026, an attacker with access to compromised credentials created a series of pull requests 46, 47, 48 injecting obfuscated shell code into action.yml. The PRs were blocked by branch protection rules and never merged into the main branch. However, the attacker used the...