Malicious Package

Overview kartyk-github-single-ver-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Exploit for Injection in Dkfz Nnu-Net

Agentic workflow injection: fixtures and a coverage comparison...

CVE-2026-92773

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-85469 Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-86865

creationtimestamp| type| source ---|---|--- 2026-09-16 21:00:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvnzuc4xxg2o 2026-09-17 00:01:47+00:00| seen| https://gist.github.com/ichintu/0a4ecacd8285eafd21cb342d1792e68e...

CVE-2026-92802

kan (kanbn/kan) through version 0.6.0 contains an authorization bypass in the GitHub project import endpoint. The root cause is a failure to properly validate board creation permissions in the importProjects mutation , allowing guests to create boards despite lacking the board:create permission. ...

CVE-2026-61590

creationtimestamp| type| source ---|---|--- 2026-09-16 20:32:38+00:00| seen| https://gist.github.com/alon710/ef6456b2c611c3d15ec3538b07012ea5...

GHSA-8G2F-G3GQ-5RJV

creationtimestamp| type| source ---|---|--- 2026-09-16 20:32:38+00:00| seen| https://gist.github.com/alon710/ef6456b2c611c3d15ec3538b07012ea5...

CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-92773

Trigger.dev before 4.6.0 contains a GitHub App installation takeover vulnerability in its GitHub integration service (gitHub.server.ts). The root cause is a failure to verify that an authenticated user actually controls a GitHub App installation before binding it to their organization. An attacke...

EUVD-2026-81037

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

GHSA-3492-CVG7-9MR2

creationtimestamp| type| source ---|---|--- 2026-09-16 19:33:34+00:00| seen| https://gist.github.com/alon710/add36254cc8a2aecb663b59914ea2d7d...

CVE-2026-68904

creationtimestamp| type| source ---|---|--- 2026-09-16 17:31:30+00:00| seen| https://gist.github.com/alon710/ca48de2f64cb21c4b6fdba639af7e2ac...

GHSA-R2PF-9CW4-5J65

creationtimestamp| type| source ---|---|--- 2026-09-16 17:31:30+00:00| seen| https://gist.github.com/alon710/ca48de2f64cb21c4b6fdba639af7e2ac...

CVE-2026-54168

A flaw was found in Pipelines-as-Code. A GitHub App installation token, created during webhook processing, is not properly scoped when the App is installed across multiple repositories. This allows a user with push access to one repository to access private repositories within the same installati...

CVE-2026-54167

A flaw was found in Pipelines-as-Code. The GitHub App provider incorrectly processes webhook events by accepting an untrusted X-GitHub-Enterprise-Host header as the API host before validating the webhook signature. An unauthenticated attacker can exploit this by sending a specially crafted webhoo...

GO-2026-6448 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail

Identrail Cross-tenant IDOR: Client-supplied GitHub App installationid is bound to the caller's workspace without ownership verification in github.com/identrail/identrail...