PT-2026-28615

Name of the Vulnerable Software and Affected Versions wenxian versions 0.3.1 and earlier Description wenxian is a tool used to generate BIBTEX files from identifiers such as DOI, PMID, arXiv ID, or paper titles. A GitHub Actions workflow in the software uses untrusted user input from the issue...

GHSA-6FMV-XXPF-W3CW vulnerabilities

Vulnerabilities for packages: wso2is, maven-stage0, kafka, gradle, apache-camel-karavan-devmode, akhq, clojure-tools, gradle-stage0, logstash, leiningen, kafka-fips, dependency-track-apiserver, dependency-track, druid, maven, confluent-kafka, maven-ecosystems-test, confluent-kafka-jre-bcfips...

CVE-2026-33029

creationtimestamp| type| source ---|---|--- 2026-03-28 03:20:34+00:00| published-proof-of-concept| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cp8r-8jvw-v3qg...

CVE-2026-33027

creationtimestamp| type| source ---|---|--- 2026-03-28 03:19:28+00:00| published-proof-of-concept| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357...

GHSA-8C4J-F57C-35CF

creationtimestamp| type| source ---|---|--- 2026-03-27 23:28:03+00:00| seen| Telegram/EI25wC4yN3TaatXDJQ6U03Lar3nhYMfqPNXio5Iaw2cNO8...

GHSA-4GMR-2VC8-7QH3

creationtimestamp| type| source ---|---|--- 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU...

GHSA-RWCR-RPCC-3G9M

creationtimestamp| type| source ---|---|--- 2026-03-27 21:23:14+00:00| published-proof-of-concept| Telegram/B1-lnNSHplGL4tzlck3EB0WXwjfJllp4cXItiyc0oKB0vU...

GHSA-CR5G-9FRG-Q8M8 vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-C97J-HMJ5-572H vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-PQFX-CWF8-965Q vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-MRRG-439G-X65P vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

act: Unrestricted set-env and add-path command processing enables environment injection

Summary act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which GitHub Actions disabled in October 2020 CVE-2020-15228, GHSA-mfwh-5m23-j46w due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject...

GHSA-XMGR-9PQC-H5VW act: Unrestricted set-env and add-path command processing enables environment injection

Summary act unconditionally processes the deprecated ::set-env:: and ::add-path:: workflow commands, which GitHub Actions disabled in October 2020 CVE-2020-15228, GHSA-mfwh-5m23-j46w due to environment injection risks. When a workflow step echoes untrusted data to stdout, an attacker can inject...

CVE-2026-34396

creationtimestamp| type| source ---|---|--- 2026-03-27 18:49:12+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-v4h7-3x43-qqw4...

GO-2026-4859 BuildKit Git URL subdir component can cause access to restricted files in github.com/moby/buildkit

BuildKit Git URL subdir component can cause access to restricted files in github.com/moby/buildkit...

EUVD-2025-209105

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUBTOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits...

CVE-2025-15617

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUBTOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits...

CVE-2025-15617 Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUBTOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits...

CVE-2025-15617

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUBTOKEN from uploaded artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits...

CVE-2025-15617

CVE-2025-15617 concerns Wazuh v4.12.0, where a vulnerability in GitHub Actions workflow artifacts allows extraction of the GITHUB_TOKEN from uploaded artifacts. This exposed token, obtainable within a limited time window, could enable attackers to perform unauthorized actions such as pushing mali...