31492 matches found
CVE-2026-35580
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflowdispatch inputs were interpolated directly into shell commands via $ expression syntax. An attacker with repository write access could...
UBUNTU-CVE-2026-33816
Memory-safety vulnerability in github.com/jackc/pgx/v5...
CVE-2026-35580
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflowdispatch inputs were interpolated directly into shell commands via $ expression syntax. An attacker with repository write access could...
CVE-2026-35580 Emissary has GitHub Actions Shell Injection via Workflow Inputs
Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflowdispatch inputs were interpolated directly into shell commands via $ expression syntax. An attacker with repository write access could...
CVE-2026-35580
Emissary (a P2P data-driven workflow engine) contains a shell-injection vulnerability in GitHub Actions workflow files prior to version 8.39.0. User-controlled workflow_dispatch inputs could be interpolated directly into shell commands via ${{ }} expressions in run blocks, enabling an attacker wi...
CVE-2026-33816 CVE-2026-33816 in github.com/jackc/pgx
Memory-safety vulnerability in github.com/jackc/pgx/v5...
GO-2026-4790 Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service in github.com/elastic/beats
Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service in github.com/elastic/beats...
GO-2026-4882 Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus
Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus...
GO-2026-4885 Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus
Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus...
GO-2026-4772 CVE-2026-33816 in github.com/jackc/pgx
Memory-safety vulnerability in github.com/jackc/pgx/v5...
GO-2026-4736 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute in github.com/osrg/gobgp
GoBGP vulnerable to a denial of service via the NEXTHOP path attribute in github.com/osrg/gobgp...
GO-2026-4886 Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus
Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus...
GO-2026-4881 Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus
Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus...
The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines
By Diana Brown Cisco Talos has recently observed an increase in activity that is leveraging notification pipelines in popular collaboration platforms to deliver spam and phishing emails. These emails are transmitted using the legitimate mail delivery infrastructure associated with GitHub and Jira...
GHSA-C427-H43C-VF67 vulnerabilities
Vulnerabilities for packages: airflow, kubeflow-pipelines-visualization-server, dask-kubernetes, kserve, checkov, open-webui, py3-cassandra-medusa...
GHSA-M5QP-6W8W-W647 vulnerabilities
Vulnerabilities for packages: airflow, kubeflow-pipelines-visualization-server, dask-kubernetes, kserve, checkov, open-webui, py3-cassandra-medusa...
PT-2026-31009
Name of the Vulnerable Software and Affected Versions dbt affected versions not specified Description dbt allows data analysts and engineers to transform data using software engineering practices. A command injection issue exists in the workflow located at...
Emissary 命令注入漏洞
Emissary is a distributed P2P data-driven workflow framework developed by the National Security Agency. Versions of Emissary prior to 8.39.0 contained a command injection vulnerability. This vulnerability stemmed from shell injection points in the GitHub Actions workflow files. User-controlled...
