34890 matches found
GHSA-F5F4-3HH4-F54M Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...
Malicious Package
Overview mcp-server-github is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
PT-2026-79116
Name of the Vulnerable Software and Affected Versions appwrite/templates affected versions not specified Description The github-issue-bot templates contain a logic error in the GitHub webhook signature verification process. The verifyWebhook function in node/github-issue-bot/src/github.js and...
CVE-2026-72861: Improper Verification of Cryptographic Signature
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...
PT-2026-80743
Name of the Vulnerable Software and Affected Versions Pipelines-as-Code versions prior to 0.48.0 Description Installations using the GitHub App provider are susceptible to credential exfiltration via the webhook endpoint. The system accepted the X-GitHub-Enterprise-Host request header as the API...
PT-2026-80744
Name of the Vulnerable Software and Affected Versions Tekton Pipelines-as-Code versions prior to 0.48.0 Description When configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by...
PT-2026-80235
Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...
PT-2026-80272
Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...
CGA-2VM8-W2XQ-P3R6
Bulletin has no description...
CVE-2026-63187
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...
CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...
EUVD-2026-62865
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...
CVE-2026-63187
Logto (open-source auth infrastructure) versions 1.40.1 through 1.41.0 contain an OS command injection in the .github/workflows/commitlint.yml workflow. The github.event.pull_request.title value was directly interpolated into an inline echo command before being piped to npx commitlint. A pull req...
CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...
CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...
Malicious Package
Overview github-policy-bot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
GHSA-W27M-RMMF-G5W4
creationtimestamp| type| source ---|---|--- 2026-08-19 13:32:06+00:00| seen| https://gist.github.com/alon710/af2c8d3762565eaa4715277e9dc15159...
GHSA-5RW4-4665-CVWF
creationtimestamp| type| source ---|---|--- 2026-08-19 12:33:17+00:00| seen| https://gist.github.com/alon710/ac73b2e180b3b5bc212b2c31ca85b161...