GHSA-V898-XG3C-W4RJ vulnerabilities

Vulnerabilities for packages: glibc...

CVE-2026-44426

creationtimestamp| type| source ---|---|--- 2026-05-01 15:17:47+00:00| published-proof-of-concept| https://github.com/shellhub-io/shellhub/security/advisories/GHSA-vwx9-7qcf-gg7f...

CVE-2026-41888

creationtimestamp| type| source ---|---|--- 2026-05-01 14:27:56+00:00| published-proof-of-concept| https://github.com/distribution/distribution/security/advisories/GHSA-6pjf-3r9x-m592...

Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft

A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, GitHub Actions tampering, and SSH persistence. The activity has been attributed to the GitHub account "BufferZoneCorp ," which h...

GHSA-MQQ7-WXX5-MP8H

creationtimestamp| type| source ---|---|--- 2026-05-01 06:10:28+00:00| seen| https://gist.github.com/alon710/63a0b9d45c1b8aff3ea39f384d9c8809...

CVE-2026-40893

creationtimestamp| type| source ---|---|--- 2026-05-01 05:46:38+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-62p3-hvxx-fxg4...

CVE-2026-44312

creationtimestamp| type| source ---|---|--- 2026-05-01 03:40:10+00:00| published-proof-of-concept| https://github.com/premailer/cssparser/security/advisories/GHSA-ff6c-w6qf-7xqc...

GHSA-48WR-P98V-9W5H vulnerabilities

Vulnerabilities for packages: ffmpeg...

GHSA-4WRG-8WPC-H923 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, apache-nifi...

GitHub Enterprise 3.x < 3.14.25 / 3.15.x < 3.15.20 / 3.16.x < 3.16.16 / 3.17.x < 3.17.13 / 3.18.x < 3.18.7 / 3.19.x < 3.19.4 RCE (CVE-2026-3854)

The version of GitHub Enterprise installed on the remote host is affected by a remote code execution vulnerability: - An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an attacker with push access to a repository to achieve remote...

CVE-2026-3143

creationtimestamp| type| source ---|---|--- 2026-04-30 23:00:04+00:00| seen| https://t.me/GithubRedTeam/82241 2026-04-30 23:00:10+00:00| seen| Telegram/P45NJHmymloXtZIQDhqedqgrJijkJmCthR1UJzeSteIHM 2026-05-07 20:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/83256 2026-05-08...

GHSA-V4P8-MG3P-G94G vulnerabilities

Vulnerabilities for packages: litellm, airflow...

GHSA-XQMJ-J6MV-4862 vulnerabilities

Vulnerabilities for packages: litellm, airflow...

CVE-2026-42594

creationtimestamp| type| source ---|---|--- 2026-04-30 18:32:12+00:00| published-proof-of-concept| https://github.com/gotenberg/gotenberg/security/advisories/GHSA-r33j-c622-r6qp...

PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials

In yet another software supply chain attack, threat actors have managed to compromise the popular Python package Lightning to push two malicious versions to conduct credential theft. According to Aikido Security, OX Security, Socket, and StepSecurity, the two malicious versions are versions 2.6.2...

The (In)security Landscape of AI-Powered GitHub Actions (Part 2/2)

When AI meets CI/CD: permission bypasses, prompt injection, and what to do about it...

EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades

Intro A sophisticated, high-resilience malicious campaign was identified by Atos Threat Research Center TRC in March 2026. This operation specifically targets the high-privilege professional accounts of enterprise administrators, DevOps engineers, and security analysts by impersonating...

CVE-2026-37572

creationtimestamp| type| source ---|---|--- 2026-04-30 08:49:10+00:00| seen| https://gist.github.com/sgInnora/5aa1682c359a4f4ced53fc2408936e82...

Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution

Google has addressed a maximum severity security flaw in Gemini CLI -- the "@google/gemini-cli" npm package and the "google-github-actions/run-gemini-cli" GitHub Actions workflow -- that could have allowed attackers to execute arbitrary commands on host systems. "The vulnerability allowed an...

Cross-site Scripting (XSS)

Overview com.coravy.hudson.plugins.github:github is a Jenkins GitHub plugin Affected versions of this package are vulnerable to Cross-site Scripting XSS via JavaScript validation logic for the “GitHub hook trigger for GITScm polling” feature. An attacker can execute arbitrary JavaScript code by...