CVE-2026-14967

BBOT’s github_workflows module has a path-traversal vulnerability: the path-containment check fails to resolve ‘..’, allowing a crafted CODE_REPOSITORY URL to traverse out of the configured output directory. The write is bounded to two directory levels above the output location and the target is ...

EUVD-2026-42296

BBOT's githubworkflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODEREPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...

CVE-2026-14967 Path traversal in github_workflows allows writing artifacts outside output directory

BBOT's githubworkflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODEREPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...

GHSA-RMMH-P597-PPVV vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards...

GHSA-CWX4-F9X9-PQHH vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-vmware, linux-aws, linux-gcp, linux-qemu...

GHSA-JMF6-3V74-7X28 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-vmware, linux-aws, linux-gcp, linux-qemu...

GHSA-3J9Q-258H-4V38 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-vmware, linux-aws, linux-gcp, linux-qemu...

GHSA-WWC5-7R8X-52GG vulnerabilities

Vulnerabilities for packages: linux-azure, linux-qemu-melange, linux-vmware, linux-aws, linux-gcp, linux-qemu...

CVE-2026-53530

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:13+00:00| published-proof-of-concept| https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj...

CVE-2026-53531

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:11+00:00| published-proof-of-concept| https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7...

CVE-2026-53487

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:09+00:00| published-proof-of-concept| https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8...

CVE-2026-53553

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:05+00:00| published-proof-of-concept| https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw...

GO-2026-5799 Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus

Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus...

GO-2026-5924 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

Coder's session token leaked to arbitrary hosts via coder open app for external workspace apps in github.com/coder/coder...

GO-2026-5921 Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints in github.com/coder/coder...

GO-2026-5806 Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus

Incus has an arbitrary file write on its client due to trusted image hash in github.com/lxc/incus...

GO-2026-5570 Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf

Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf...

GO-2026-5925 Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder

Suspended Coder users retain access to AI Bridge LLM proxy endpoints in github.com/coder/coder...

GO-2026-5922 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers in github.com/coder/coder...

GO-2026-5918 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder...