CVE-2026-38931

A stored cross-site scripting XSS vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff Latest as of 2026-02-27 via injecting a crafted payload...

Jenkins GitHub Integration Plugin 安全漏洞

The Jenkins GitHub Integration Plugin is an open-source integration plugin for Jenkins. Versions of the Jenkins GitHub Integration Plugin prior to 0.7.3 have security vulnerabilities; these vulnerabilities stem from cross-site request forgery attacks, which could allow attackers to trigger build...

PT-2026-43571

The Github Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'repo' shortcode attribute in the 'github' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-8606

A Server-Side Request Forgery (SSRF) in GitHub Enterprise Server was exposed via the security advisories package lookup endpoint, allowing an attacker to issue HTTP requests to internal services. By directing requests to an internal management service and measuring response timing, an attacker co...

CVE-2026-8606 Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and...

EUVD-2026-32025

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and...

CVE-2026-8606 Server-Side Request Forgery in GitHub Enterprise Server via Advisory Package URL Endpoint

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and...

CVE-2026-8606

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and...

CVE-2026-3515

A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper...

GHSA-Q8MJ-M7CP-5Q26 vulnerabilities

Vulnerabilities for packages: thingsboard, prism, kubeflow-centraldashboard, tileserver-gl, code-server, saf, opensearch-dashboards, sqlpad, py3-jupyterlab, kubeflow-pipelines, renovate, argo-workflows, json-server, kubeflow-katib, langfuse...

WordPress Github Shortcode plugin <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Github Shortcode versions = 0.1...

-GodSearch

󰓾 GodSearch v20.0 — THE SOVEREIGN 💀 Universal Exploit Sear...

GodSearch

󰓾 GodSearch v20.0 — THE SOVEREIGN 💀 Universal Exploit Sear...

EUVD-2026-31902

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/pythonchecks.yml embeds $ github.event.pullrequest.title directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script...

CVE-2026-44723 Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/pythonchecks.yml embeds $ github.event.pullrequest.title directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script...

CVE-2026-45162

creationtimestamp| type| source ---|---|--- 2026-05-26 14:09:06+00:00| published-proof-of-concept| https://github.com/pimcore/pimcore/security/advisories/GHSA-36fc-7wjg-mfvj 2026-07-18 20:00:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqx2jeapih2w...

CVE-2026-45704

creationtimestamp| type| source ---|---|--- 2026-05-26 14:01:06+00:00| published-proof-of-concept| https://github.com/pimcore/pimcore/security/advisories/GHSA-jwcc-gv4m-93x6...

GHSA-CW25-2P92-7F75 Prefect has an Argument Injection issue

A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper...

GHSA-R5VF-GRCX-5VQP Mattermost allows authenticated users to gain access to private repositories

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL...

CVE-2026-27384

creationtimestamp| type| source ---|---|--- 2026-05-26 09:00:05+00:00| seen| https://t.me/GithubRedTeam/85938 2026-05-27 21:10:45+00:00| seen| Telegram/GF77XqZ1LHaWDL2kD1JemKeP32DvhHpTDQqckw5Eq33XXvc...