31546 matches found
TeamPCP Compromises Checkmarx Jenkins AST Plugin Weeks After KICS Supply Chain Attack
Checkmarx has confirmed that a modified version of the Jenkins AST plugin was published to the Jenkins Marketplace. "If you are using Checkmarx Jenkins AST plugin, you need to ensure that you are using the version 2.0.13-829.vc72453fa1c16 that was published on December 17, 2025 or previously," th...
GHSA-9CCR-R5HG-74GF GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
Summary A security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory...
@senoldogann/code-companion (>=0.1.38 <=0.1.56), @treeseed/agent (>=0.8.5 <=0.10.0) +6 more potentially affected by CVE-2026-45033 via @github/copilot (>=1.0.27 <=1.0.40)
@github/copilot NPM version =1.0.27, =0.1.38, =0.8.5, =0.6.0, =0.6.1, =0.6.8, =1.0.0, =2.0.0 - @vibe-forge/client =1.0.0 - bitbucket-copilot-pr-review =0.5.1 Source cves: CVE-2026-45033 Source advisory: SNYK:JS-GITHUBCOPILOT-16642141...
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
Summary A security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent performs git operations. By exploiting git's automatic bare repository discovery during directory...
Incorrect Behavior Order
Overview @github/copilot is a GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal. Affected versions of this package are vulnerable to Incorrect Behavior Order that enables code execution via the core.fsmonitor configuration key in a nested bare git repository. A...
CVE-2026-46510
creationtimestamp| type| source ---|---|--- 2026-05-11 16:10:55+00:00| published-proof-of-concept| https://github.com/kaspernj/form-data-objectizer/security/advisories/GHSA-m2hg-wjq3-28wq 2026-05-29 15:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmyshpa7fd2v...
GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Summary The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...
GHSA-587R-MC96-6F2P GuardDog has a blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration
Summary The programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an attacker who can influence the scanned repository URL to trigger SSRF and...
CVE-2026-45548
creationtimestamp| type| source ---|---|--- 2026-05-11 10:41:34+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-rpj4-7x2v-wjrf...
Comment and Control: Hijacking Agentic Workflows Via Context-Grounded Evolution
Automation platforms such as GitHub Actions and n8n are increasingly adopting so-called agentic workflows, which integrate Large Language Model LLM agents for tasks such as code review and data synchronization. While bringing convenience for developers, this integration exposes a new risk: An...
PT-2026-39901
Name of the Vulnerable Software and Affected Versions GitHub Copilot CLI versions prior to 1.0.43 Description An issue exists where a malicious bare git repository nested inside a project directory can lead to arbitrary code execution when the agent performs git operations. By exploiting git's...
PT-2026-39677
Name of the Vulnerable Software and Affected Versions GuardDog versions 1.0.0 through 2.9.0 Description The programmatic remote project scanning path in the ProjectScanner.scan remote function rewrites attacker-controlled repository URLs using blind string replacement before sending the caller's...
CVE-2026-36980
creationtimestamp| type| source ---|---|--- 2026-05-10 21:00:04+00:00| seen| https://t.me/GithubRedTeam/83710 2026-05-10 23:00:14+00:00| seen| Telegram/4E6rSRxwI8rbj53U5V5E-Exh2Wmlv2Bw5SwE4GoCs4Wb5U 2026-05-11 03:00:06+00:00| seen| Telegram/mGI2CRHqQCjyvA6ju1XF5IWDLp0GZA5xrkAMw9kytXRmaE...
CVE-2026-45395
creationtimestamp| type| source ---|---|--- 2026-05-10 19:34:01+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-p4fx-23fq-jfg6...
CVE-2026-45387
creationtimestamp| type| source ---|---|--- 2026-05-10 19:31:55+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-h2cw-7qw9-56xr...
CVE-2026-45385
creationtimestamp| type| source ---|---|--- 2026-05-10 19:29:59+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-wwhq-cx22-f7vv...
CVE-2026-45375
creationtimestamp| type| source ---|---|--- 2026-05-10 15:32:12+00:00| published-proof-of-concept| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-27qc-m5gf-jv5r 2026-06-25 01:39:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp3cbffawf2p...
CVE-2026-45373
creationtimestamp| type| source ---|---|--- 2026-05-10 07:52:37+00:00| published-proof-of-concept| https://github.com/Hmbown/DeepSeek-TUI/security/advisories/GHSA-88gh-2526-gfrr...
