31502 matches found
PT-2026-23732
Name of the Vulnerable Software and Affected Versions GitHub Copilot CLI versions prior to 0.0.423 Description The shell tool within GitHub Copilot CLI is susceptible to arbitrary code execution through crafted bash parameter expansion patterns. An attacker influencing commands executed by the...
CVE-2026-30824
creationtimestamp| type| source ---|---|--- 2026-03-05 21:31:50+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-5f53-522j-j454 2026-04-15 07:09:15+00:00| confirmed|...
Incorrect Regular Expression
Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Incorrect Regular Expression in the Content-Type header validation. An attacker can cause the server to incorrectly process requests with malformed Content-Type headers by sending value...
GHSA-HFPC-8R3F-GW53 vulnerabilities
Vulnerabilities for packages: garage, linkerd2-cni-plugin, linkerd-extension-init, py3-xet-core, uv, nushell, zizmor, efs-utils, linkerd2, ntpd-rs, buck2, komodo, linkerd2-proxy, lychee, deno, rustup, ztunnel, cargo-audit, pixi, zellij, linkerd-network-validator, zed, rustls-ffi, parseable...
GHSA-747P-WMPV-9C78 vulnerabilities
Vulnerabilities for packages: localstack...
GHSA-95V5-PRP4-5GV5 Backstage vulnerable to potential reading of SCM URLs using built in token
Impact A vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended...
Backstage vulnerable to potential reading of SCM URLs using built in token
Impact A vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended...
GHSA-WF45-3GPW-VRQV
creationtimestamp| type| source ---|---|--- 2026-03-05 00:10:05+00:00| seen| https://gist.github.com/alon710/ae14f3ab86f97e851dfebe5b270a8a84...
New BoryptGrab Stealer Targets Windows Users via Deceptive GitHub Pages
The BoryptGrab campaign uses fake SEO‑optimized GitHub repositories and deceptive download pages to distribute a data‑stealing malware family that delivers multiple payloads, including a reverse SSH backdoor, to Windows users...
The Iranian Cyber Capability 2026
The Iranian Cyber Capability 2026 By John Fokker and Ernesto Fernández Provecho · March 5, 2026 Introduction In 2024, we published an assessment of the Islamic Republic of Iran’s cyber capabilities, outlining the structure, tradecraft, and strategic intent of Iranian-aligned threat actors. The co...
GHSA-33R2-HFPX-FX7H vulnerabilities
Vulnerabilities for packages: libvips...
GHSA-55XF-4PMG-V3XM vulnerabilities
Vulnerabilities for packages: libvips...
📄 WordPress AI Feeds 1.0.11 Shell Upload
Proof of concept exploit for an unauthenticated arbitrary file upload vulnerability in the AI Feeds plugin for WordPress versions 1.0.11 and earlier. The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP webshells, by exploiting the GitHub integration...
📄 WordPress AI Bud 1.8.5 Shell Upload
WordPress AI Bud plugin version 1.8.5 suffers from an unauthenticated shell upload vulnerability. The vulnerability exists in the actualizadorgit.php file which provides unauthenticated access to download and execute files from arbitrary GitHub repositories without proper security controls...
📄 WordPress Cibeles AI 1.10.8 Shell Upload
An unauthenticated arbitrary file upload vulnerability exists in the Cibeles AI plugin for WordPress versions 1.10.8 and earlier. The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP webshells, by exploiting the GitHub integration functionality, leading to...
PT-2026-24344
Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.14.25 GitHub Enterprise Server versions prior to 3.15.20 GitHub Enterprise Server versions prior to 3.16.16 GitHub Enterprise Server versions prior to 3.17.13 GitHub Enterprise Server versions prior...
Incorrect Authorization
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the toolsBySender process when untyped sender keys are used. An attacker can gain unauthorized access to privileged group tool permissions by causing an...
Replay Attack
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Replay Attack via the webhook replay handling. An attacker can cause duplicate inbound actions to be processed by replaying previously valid signed webhook requests after the replay windo...