31499 matches found
What 50 open source projects taught us about security in the AI era
AI is changing the pace of open source development and the security challenges that come with it. Maintainers are reviewing unfamiliar contributions, managing new attack surfaces, and responding to vulnerabilities with limited time and resources. Session 4 of the GitHub Secure Open Source Fund...
How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...
CVE-2026-30965
creationtimestamp| type| source ---|---|--- 2026-08-13 09:00:07+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-30965.yaml 2026-08-14 00:00:09+00:00| confirmed|...
ROOT-APP-PYPI-GHSA-2F96-G7MH-G2HX GHSA-2f96-g7mh-g2hx in GitPython - Patched by Root
Root has patched GHSA-2f96-g7mh-g2hx in the GitPython package for Root:PyPI. Multiple fixed versions available...
Jenkins GitHub Plugin <=1.29.1 - Server-Side Request Forgery
Jenkins GitHub Plugin 1.29.1 and earlier is susceptible to server-side request forgery via GitHubTokenCredentialsCreator.java, which allows attackers to leverage attacker-specified credentials IDs obtained through another method and capture the credentials stored in Jenkins. id: CVE-2018-1000600...
PT-2026-71699
The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...
CVE-2026-73425
creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-hp3v-mfqw-h74c...
CVE-2026-73306
creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:36+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm...
CVE-2026-73410
creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:06+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435...
[SECURITY] [DSA 6434-1] lemonldap-ng security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6434-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 12, 2026 https://www.debian.org/security/faq -...
CVE-2026-47132
creationtimestamp| type| source ---|---|--- 2026-08-12 16:35:05+00:00| published-proof-of-concept| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w...
CVE-2026-11325
The CVE-2026-11325 entry concerns Cloudflare’s cloudflare/pages-action, an archived repository deprecated since 2024. A remote code execution vulnerability was reported in src/index.ts that could be reachable via certain GitHub Actions workflow configurations, potentially exposing workflow secret...
EUVD-2026-57178
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...
CVE-2026-11325 cloudflare/pages-action is deprecated — migration required by September 18th, 2026
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...
CVE-2026-11325
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...
Mlflow <2.9.2 - Path Traversal
Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6909 info: name: Mlflow 2.9.2 - Path Traversal author: Hyunsoo-ds severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Successful...
Microsoft Open Management Infrastructure - Remote Code Execution
Microsoft Open Management Infrastructure is susceptible to remote code execution OMIGOD. id: CVE-2021-38647 info: name: Microsoft Open Management Infrastructure - Remote Code Execution author: daffainfo,xstp severity: critical description: Microsoft Open Management Infrastructure is susceptible t...
Debian dsa-6434 : lemonldap-ng - security update
The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6434 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6434-1 [email protected] https://www.debian.org/securit...
PT-2026-71049
Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...
