GHSA-W8W6-F4MM-HW75 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-vmware, linux-aws, linux-gcp, linux-qemu...

GHSA-QC6F-VG59-3945 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-vmware, linux-gcp, linux-qemu...

PT-2026-57006

Name of the Vulnerable Software and Affected Versions GitHub CLI gh versions 2.10.0 through 2.95.0 Description Connecting to a malicious Codespace using the gh codespace jupyter command can lead to command execution. This occurs because the tool opens a JupyterLab URL provided by a process within...

CVE-2026-53600

creationtimestamp| type| source ---|---|--- 2026-07-08 22:35:10+00:00| published-proof-of-concept| https://github.com/dignifiedquire/async-tar/security/advisories/GHSA-35rm-7j9c-2f7m...

CVE-2026-49455

creationtimestamp| type| source ---|---|--- 2026-07-08 22:35:05+00:00| published-proof-of-concept| https://github.com/wakujs/waku/security/advisories/GHSA-75w3-gmqx-993q...

GHSA-VMWX-M75V-QVCH

creationtimestamp| type| source ---|---|--- 2026-07-08 22:12:23+00:00| seen| https://gist.github.com/alon710/f5073530cad3dd719e641dcee2ba88b8...

GHSA-MXWC-WH95-PW4G

creationtimestamp| type| source ---|---|--- 2026-07-08 21:12:14+00:00| seen| https://gist.github.com/alon710/f9b0746c1419f68b39813326daf32fa7...

GHSA-MX76-R943-RF8G vulnerabilities

Vulnerabilities for packages: opensearch...

GHSA-G4RG-993R-MGX7 vulnerabilities

Vulnerabilities for packages: py3-captum...

DEBIAN-CVE-2026-59947

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

CVE-2026-59947 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

CVE-2026-59947 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

CVE-2026-59947 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug outp...

CVE-2026-59947

Composer is affected: prior to versions 2.2.29 and 2.10.2, running with -vvv could leak credentials embedded in the username slot of a repository or package URL (e.g., https://TOKEN@host/) to debug logs because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL cred...

Malicious code in @luminarycloudinternal/frodo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58ed68e675b2b6cde30e6b7c8e34077eda805a4bde64ca7cd2c68c6f4370ee5f Package published under a scope shadowing internal Luminary Cloud packages @luminarycloudinternal at version 9999.0.1 — the canonical...

CVE-2026-14967

BBOT's githubworkflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODEREPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...

github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability

A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability...

CVE-2026-54344

CVE-2026-54344 affects ToolJet prior to version 3.20.180. The render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, enabling any GitHub user who can comment on an open PR with a deploy command to execute shell commands on the CI ...

EUVD-2026-42299

ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a...

CVE-2026-14967

BBOT’s github_workflows module has a path-traversal vulnerability: the path-containment check fails to resolve ‘..’, allowing a crafted CODE_REPOSITORY URL to traverse out of the configured output directory. The write is bounded to two directory levels above the output location and the target is ...