GHSA-RRVG-CXH4-QHRV vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

GHSA-6326-W46W-PPJW

creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:44+00:00| seen| Telegram/RmP7l-K41x9UoCBscD5W8eizA4yDJaPJqAKKOeWwXNyu-8...

GHSA-V8X3-W674-55P5

creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:29+00:00| published-proof-of-concept| Telegram/0wjdVVOdHVRh-NR-AUdnOvXJcqqbi6lE8Vl80iGy2s6Zy0...

GHSA-WC4H-2348-JC3P

creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:09+00:00| seen| Telegram/t1F-Vxaulmn07lvg5ppSTSOssGvqtwkUpkkBVUVRjFPlk...

CVE-2026-27124

A flaw was found in FastMCP and FastMCP OAuthProxy. The OAuthProxy, used for GitHub OAuth authentication, does not properly validate a user's consent after receiving an authorization code from GitHub. This, combined with GitHub's behavior of skipping the consent page for previously authorized...

GHSA-W88V-VQHQ-5P24

creationtimestamp| type| source ---|---|--- 2026-04-06 17:32:38+00:00| seen| Telegram/n5Nok-XlRHEre5O89LvYLplT02rw8wZYprnGR4USXlLgM...

DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea

Threat actors likely associated with the Democratic People's Republic of Korea DPRK have been observed using GitHub as command-and-control C2 infrastructure in multi-stage attacks targeting organizations in South Korea. The attack chain, per Fortinet FortiGuard Labs, involves obfuscated Windows...

CVE-2026-39365

creationtimestamp| type| source ---|---|--- 2026-04-06 12:13:21+00:00| published-proof-of-concept| https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 2026-04-06 12:13:21+00:00| published-proof-of-concept| https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9...

github-repo-scanner

No d...

GHSA-VGPV-F759-9WX3 vulnerabilities

Vulnerabilities for packages: ruby4.0-rack, ruby3.2-rack, ruby3.4-rack, pact-broker-docker, gitlab-cng, ruby3.2-rails, gitlab-rails-ce, ruby3.3-rack, kube-fluentd-operator, gitlab-rails-ce-fips, ruby3.4-rails, pact-broker-docker-fips, logstash...

GHSA-QV7J-4883-HWH7 vulnerabilities

Vulnerabilities for packages: ruby4.0-rack, ruby3.2-rack, ruby3.4-rack, pact-broker-docker, gitlab-cng, ruby3.2-rails, gitlab-rails-ce, ruby3.3-rack, kube-fluentd-operator, gitlab-rails-ce-fips, ruby3.4-rails, pact-broker-docker-fips, logstash...

LLM-Enabled Open-Source Systems in the Wild: An Empirical Study of Vulnerabilities in GitHub Security Advisories

Large language models LLMs are increasingly embedded in open-source software OSS ecosystems, creating complex interactions among natural language prompts, probabilistic model outputs, and execution-capable components. However, it remains unclear whether traditional vulnerability disclosure...

GHSA-6P2J-742G-835F actions-mkdocs: Command Injection via issue title in internal GitHub Actions workflow

Summary External input from github.event.issue.title is used unsafely in a shell command in .github/workflows/release-candidate.yaml, allowing command injection during workflow execution. Details In .github/workflows/release-candidate.yaml, the issue title is interpolated directly into a shell...

GHSA-9WFR-W7MM-PC7F

creationtimestamp| type| source ---|---|--- 2026-04-04 01:18:49+00:00| seen| Telegram/Wq2MikHHjaMT3QcZYic1EqOjYlzbZBeR3fuLUZ6lQSb49CA...

GHSA-67JX-R9PV-98RJ

creationtimestamp| type| source ---|---|--- 2026-04-03 19:24:00+00:00| published-proof-of-concept| Telegram/l2CWtN20f6D8WOiAClhqJgrdc6BQljDZCBDw2ZgpHM67Hss...

Do not get high(jacked) off your own supply (chain)

In the span of just a few weeks, we have observed a dizzying array of major supply chain attacks. Prominent examples include the malicious modification of Axios, a popular HTTP client library for JavaScript, as well as cascading compromises from TeamPCP, a "chaos-as-a-service" group that injected...

GHSA-GJW9-34GF-RP6M

creationtimestamp| type| source ---|---|--- 2026-04-03 17:26:40+00:00| published-proof-of-concept| Telegram/DJsg5Qi7j92DgCP14lqfeXU4IPClBfbIww0fpCMr4ueipk0...

GHSA-RWW4-4W9C-7733

creationtimestamp| type| source ---|---|--- 2026-04-03 17:26:40+00:00| published-proof-of-concept| Telegram/DJsg5Qi7j92DgCP14lqfeXU4IPClBfbIww0fpCMr4ueipk0...

North Korean Hackers Abuse GitHub to Spy on South Korean Firms

Researchers from FortiGuard Labs have uncovered a high-severity spying campaign targeting South Korean companies. Discover how North Korean…...

CVE-2026-33544

Tinyauth is an authentication and authorization server. Prior to version 5.0.5, all three OAuth service implementations GenericOAuthService, GithubOAuthService, GoogleOAuthService store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent...