CVE-2026-47067

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:54+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62...

CVE-2026-49342

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:42+00:00| published-proof-of-concept| https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8...

CVE-2026-53522

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:22+00:00| published-proof-of-concept| https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq...

CVE-2026-49338

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:07+00:00| published-proof-of-concept| https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95...

CVE-2026-49340

creationtimestamp| type| source ---|---|--- 2026-06-26 23:42:14+00:00| seen| https://gist.github.com/alon710/aef49efca881722a2606f374108f34f4 2026-06-27 00:00:58+00:00| seen| https://gist.github.com/alon710/aef49efca881722a2606f374108f34f4 2026-06-27 00:35:12+00:00| published-proof-of-concept|...

GHSA-HWX4-2J3J-G496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install - ignore-scripts to replace...

GHSA-M727-PCJM-J28H

creationtimestamp| type| source ---|---|--- 2026-06-26 22:45:45+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mp7zjccddf2o...

CVE-2026-48990

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:29+00:00| published-proof-of-concept| https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5...

CVE-2026-47071

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:15+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr...

CVE-2026-47076

creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:12+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-pj7v-xfvx-wmjq...

CVE-2026-49359

creationtimestamp| type| source ---|---|--- 2026-06-26 22:28:37+00:00| seen| https://bsky.app/profile/suriq.io/post/3mp7ykmyves2b 2026-06-27 00:35:49+00:00| published-proof-of-concept| https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36...

EUVD-2026-39497

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile...

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Summary A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. Details The lockfile does not store the hash of the dependencies from https://codeload.github.com This means that if this server was compromised or a person's...

GHSA-HG3W-7F8C-63HP pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Summary A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. Details The lockfile does not store the hash of the dependencies from https://codeload.github.com This means that if this server was compromised or a person's...

CVE-2026-48749

creationtimestamp| type| source ---|---|--- 2026-06-26 20:35:27+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv 2026-07-07 20:48:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3i2ziva52f...

CVE-2026-48756

creationtimestamp| type| source ---|---|--- 2026-06-26 20:35:10+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-xhqx-mgh3-3h7q...

CVE-2026-48769

creationtimestamp| type| source ---|---|--- 2026-06-26 20:35:07+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x 2026-07-01 02:15:18+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mpkh3n7jjr2b 2026-07-01 02:31:46+00:00...

GHSA-JM82-FX9C-MX94 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-55448

mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...

CVE-2026-48529

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...