CVE-2026-77912: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

CVE-2026-75101: Authorization Bypass Through User-Controlled Key

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

ROS-20260922-73-0113

The vulnerability in golang-github-rancher-local-path-provisioner is related to errors in handling relative pathnames to the directory. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

OPENSUSE-SU-2026:11853-1 golang-github-v2fly-v2ray-core-5.54.2-1.1 on GA media

These are all security issues fixed in the golang-github-v2fly-v2ray-core-5.54.2-1.1 package on the GA media of openSUSE Tumbleweed...

Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows | Cloud Foundry

Severity CVSSv3.1 | 9.8 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ---|--- Vendor CloudFoundry Foundation Versions Affected The Cloud Foundry build infrastructure was affected. The Cloud Foundry product is not affected. Description GitHub Actions workflows were configured to trigger on pullrequesttarg...

GHSA-JR34-H97M-9HPX

creationtimestamp| type| source ---|---|--- 2026-09-21 23:31:26+00:00| seen| https://gist.github.com/alon710/ad227f40c773c675cce4604553df73dc 2026-09-22 00:01:48+00:00| seen| https://gist.github.com/alon710/ad227f40c773c675cce4604553df73dc...

CVE-2026-61629

creationtimestamp| type| source ---|---|--- 2026-09-21 22:35:04+00:00| published-proof-of-concept| https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-jr34-h97m-9hpx 2026-09-21 23:31:26+00:00| seen| https://gist.github.com/alon710/ad227f40c773c675cce4604553df73dc 2026-09-22...

CVE-2026-61628

creationtimestamp| type| source ---|---|--- 2026-09-21 22:32:02+00:00| seen| https://gist.github.com/alon710/c22586b9d9c77f8331c17f01285d9c0d 2026-09-21 22:35:02+00:00| published-proof-of-concept| https://github.com/lucasdillmann/nginx-ignition/security/advisories/GHSA-pxcx-fv34-x9p5 2026-09-21...

CVE-2026-46649

creationtimestamp| type| source ---|---|--- 2026-09-21 21:57:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6edxc5mjk3766 2026-09-21 22:07:23+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mw2pwrg2qz2g 2026-09-21 22:20:05+00:00| seen|...

GHSA-X5FP-WJ9C-MXMX

creationtimestamp| type| source ---|---|--- 2026-09-21 19:09:37+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5 2026-09-28 18:39:22+00:00| seen| https://gist.github.com/tomasantunes/b27c1462edf01f28a31f453280d86577...

GHSA-V245-V573-V5VM

creationtimestamp| type| source ---|---|--- 2026-09-21 19:09:16+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5...

GHSA-22P9-WV53-3RQ4

creationtimestamp| type| source ---|---|--- 2026-09-21 19:08:55+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5...

GHSA-6V5V-WF23-FMFQ

creationtimestamp| type| source ---|---|--- 2026-09-21 19:08:32+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5 2026-10-01 02:50:35+00:00| seen| https://gist.github.com/sjl75050101-netizen/3ab4749268f0ca0bc82ea9748a2e6b25...

GHSA-Q8MJ-M7CP-5Q26

creationtimestamp| type| source ---|---|--- 2026-09-21 19:08:10+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5...

GHSA-4MJR-XMP4-GH2G

creationtimestamp| type| source ---|---|--- 2026-09-21 19:07:49+00:00| seen| https://gist.github.com/konard/c8a6ea404fcd2d5d08c042df8a4bdcd5 2026-09-28 18:39:22+00:00| seen| https://gist.github.com/tomasantunes/b27c1462edf01f28a31f453280d86577...

CVE-2026-61687

creationtimestamp| type| source ---|---|--- 2026-09-21 16:31:47+00:00| seen| https://gist.github.com/alon710/cd3d4f295cb3f81bbf208f1f924aafe9...

CVE-2026-16651

creationtimestamp| type| source ---|---|--- 2026-09-21 16:01:32+00:00| seen| https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a 2026-09-22 11:40:51+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mw45fe6kuf2k...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

EUVD-2026-83981

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

owasp-ctf

OWASP CTF セキュリティ学習イベントのためのセルフホスト型コントロールプレーン — 1 台のマシン、1 つの無料 GitHub org で完結。 大学、高校、OWASP チャプター、ミートアップで運用できます。 キットでの作業 人間とエージェント コードを書く前に AGENTS.md を読んでください。これは運用マニュアルであり、 CI が実行する正確なコマンド、このリポジトリがすでに遭遇した障害モード、 そして docs/reviewing.md にあるレビュー不変条件が記載されています。 CLAUDE.md は同じファイルへのポインタです。 変更が準備完了となるのは、CI...