CVE-2026-92791

creationtimestamp| type| source ---|---|--- 2026-09-17 00:01:47+00:00| seen| https://gist.github.com/ichintu/0a4ecacd8285eafd21cb342d1792e68e...

CVE-2026-54916: Uncontrolled Search Path Element

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-54752: Deserialization of Untrusted Data

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

PT-2026-95095

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description The validation test harness allows the deserialization of tracked pickle cache files via the pickle.load method within the read pickle data function located in tests/pickle...

CVE-2026-54594: Improper Control of Interaction Frequency

OmniBlocks is a monorepo for the OmniBlocks project. Prior to the June 6, 2026 workflow remediation, .github/workflows/disc.yml runs for the issues opened event and the issues edited event and invokes the createDiscussion mutation whenever an issue is classified as off-topic, without recording th...

PT-2026-95094

Name of the Vulnerable Software and Affected Versions OmniBlocks versions prior to June 6, 2026 Description The .github/workflows/disc.yml workflow triggers on issues opened and edited events. When an issue is classified as off-topic, it invokes the createDiscussion mutation. Because the system...

PT-2026-95096

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An issue exists where the absence of tests/init.py and the lack of --import-mode=importlib cause pytest to place the tests directory at the front of sys.path during...

GHSA-G3PG-FRFM-PR2M

creationtimestamp| type| source ---|---|--- 2026-09-16 23:32:21+00:00| seen| https://gist.github.com/alon710/578422b703a61d9f7998d7bc971d97e1 2026-09-17 00:00:36+00:00| seen| https://gist.github.com/alon710/578422b703a61d9f7998d7bc971d97e1...

CVE-2026-61709

creationtimestamp| type| source ---|---|--- 2026-09-16 23:32:20+00:00| seen| https://gist.github.com/alon710/578422b703a61d9f7998d7bc971d97e1 2026-09-17 00:00:36+00:00| seen| https://gist.github.com/alon710/578422b703a61d9f7998d7bc971d97e1...

Malicious code in kartyk-github-single-ver-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc583cefb03bc649c96d2e8b48cc2bd5d73d8f6c489ded9b46c217ba1f212ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartyk-github-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cf7fd25b60cd680892113ab7de697ebe897542c013c8c4a977bb4852a593619 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16245 Malicious code in kartyk-github-single-ver-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc583cefb03bc649c96d2e8b48cc2bd5d73d8f6c489ded9b46c217ba1f212ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16246 Malicious code in kartyk-github-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cf7fd25b60cd680892113ab7de697ebe897542c013c8c4a977bb4852a593619 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartyk-github-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0bc4570b5c41bc6a589bf16daea1a90f52e57b878fe6219afb1102ec24c535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16244 Malicious code in kartyk-github-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0bc4570b5c41bc6a589bf16daea1a90f52e57b878fe6219afb1102ec24c535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-XHHM-F6HP-2QWJ

creationtimestamp| type| source ---|---|--- 2026-09-16 22:31:42+00:00| seen| https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a 2026-09-17 00:00:37+00:00| seen| https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a...

CVE-2026-61594

creationtimestamp| type| source ---|---|--- 2026-09-16 22:31:42+00:00| seen| https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a 2026-09-17 00:00:37+00:00| seen| https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a 2026-09-17 00:09:20+00:00| seen|...

CVE-2026-85469

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

Malicious Package

Overview kartyk-github-token-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview kartyk-github-oidc-test-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...