CVE-2026-19349 Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormIn...

PT-2026-73165

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormIn...

CVE-2026-19349: Authentication Bypass by Primary Weakness

Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormIn...

MAL-2026-14051 Malicious code in @velliajs/discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d The package presents itself as a discord.js clone repository field points at the real github.com/discordjs/discord.js.git, README instructs import...

ROOT-APP-PYPI-GHSA-X284-J5P8-9C5P GHSA-x284-j5p8-9c5p in pypdf - Patched by Root

Root has patched GHSA-x284-j5p8-9c5p in the pypdf package for Root:PyPI. Multiple fixed versions available...

CGA-5JV8-2R2W-W96F

Bulletin has no description...

CGA-4HQ2-XFH8-48P2

Bulletin has no description...

CGA-3WRW-J3V8-82P9

Bulletin has no description...

GO-2024-3310 vulnerabilities

Vulnerabilities for packages: gh...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: datadog-agent, github-mcp-server, gptscript, osv-scanner, opencost, jaeger, ferretdb...

GHSA-MXCG-P696-RM94

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

GHSA-RM3M-9MVW-68FH

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

GHSA-J8XF-5FW2-F99Q

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

GHSA-P28V-F755-9QRG

creationtimestamp| type| source ---|---|--- 2026-08-13 21:32:39+00:00| seen| https://gist.github.com/alon710/9ad8f19dc4256e5aad5d6b3105b603da...

CVE-2026-73561

creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:18+00:00| published-proof-of-concept| https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78...

GHSA-48P8-G2FX-3WWM

creationtimestamp| type| source ---|---|--- 2026-08-13 17:32:46+00:00| seen| https://gist.github.com/alon710/ee760ed8dd4e3944f68b62f514473cdc...

CVE-2026-58440

Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...

CVE-2026-58443

Public-only repository tokens can update private PR head branches...

CVE-2026-58416

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...

CVE-2026-56443

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...