34890 matches found
CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-58416
The Gitea git repository management system contains a vulnerability in the Fork-PR Actions task where it can be exploited to read data from a third private repository. This is caused by a missing guard preventing unauthorized access via the collaborative-owner branch . A remote attacker could lev...
CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
CVE-2026-57897
A flaw in Gitea allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job APIs . An attacker could exploit this vulnerability to gain unauthorized access to sensitive information across different repositories. To mitigate this risk, you can globally disable G...
EUVD-2026-58149
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...
CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content...
EUVD-2026-58142
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
What 50 open source projects taught us about security in the AI era
AI is changing the pace of open source development and the security challenges that come with it. Maintainers are reviewing unfamiliar contributions, managing new attack surfaces, and responding to vulnerabilities with limited time and resources. Session 4 of the GitHub Secure Open Source Fund...
How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...
zizmor v1.30.0-rc1
🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...
CVE-2026-30965
creationtimestamp| type| source ---|---|--- 2026-08-13 09:00:07+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-30965.yaml 2026-08-14 00:00:09+00:00| confirmed|...
PT-2026-71699
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The API scope middleware incorrectly classifies the 'GET /api/v1/user/actions/runners/registration-token' endpoint, as well as its owner- and repository-level...
CVE-2026-73425
creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-hp3v-mfqw-h74c...
CVE-2026-73306
creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:36+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm...
CVE-2026-73410
creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:06+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435...