GHSA-5HQ8-QHWW-JM7Q

creationtimestamp| type| source ---|---|--- 2026-09-16 07:35:07+00:00| seen| https://gist.github.com/alon710/013ea36d9ece4cb8727c52246b863fd0...

PT-2026-94051

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.6.0 Description An issue exists where the system fails to verify if an authenticated user controls a GitHub App installation before binding it to their organization. An attacker can claim another user's GitHub A...

PT-2026-94091

Name of the Vulnerable Software and Affected Versions quay-builder-qemu affected versions not specified Description A flaw exists where the release workflow uses the upstream Noelware/docker-manifest-action pinned to a mutable branch. A remote attacker could compromise this upstream action to...

CVE-2026-92773: Authorization Bypass Through User-Controlled Key

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-61554

creationtimestamp| type| source ---|---|--- 2026-09-15 22:35:05+00:00| published-proof-of-concept| https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34...

CVE-2026-61568

creationtimestamp| type| source ---|---|--- 2026-09-15 22:35:03+00:00| published-proof-of-concept| https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-vmp7-252j-cwp7 2026-09-16 07:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmlhqrvhm2t...

CVE-2026-61559

creationtimestamp| type| source ---|---|--- 2026-09-15 22:35:01+00:00| published-proof-of-concept| https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj 2026-09-15 22:54:24+00:00| seen| https://bsky.app/profile/standup.thecompound.tech/post/3mvlprcfb7g2w 2026-09-16...

CVE-2026-58502

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-58502

githubtoplanguages , a tool that renders a user's top GitHub languages as an SVG, is affected by a command injection in its .github/workflows/discord-issue.yml GitHub Actions workflow. The workflow interpolates github.event.issue.title directly into a Bash assignment before shell parsing, so any ...

CVE-2026-58502 githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

EUVD-2026-78911

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-58502 githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-58502 githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-59973

creationtimestamp| type| source ---|---|--- 2026-09-15 16:31:12+00:00| seen| https://gist.github.com/alon710/8bd3e264f91a00f434cd5f27c8d28e71...

GHSA-65H7-9WRW-629C

creationtimestamp| type| source ---|---|--- 2026-09-15 16:31:11+00:00| seen| https://gist.github.com/alon710/8bd3e264f91a00f434cd5f27c8d28e71...

CVE-2026-90519

creationtimestamp| type| source ---|---|--- 2026-09-15 16:01:41+00:00| seen| https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb...

CVE-2026-90520

creationtimestamp| type| source ---|---|--- 2026-09-15 16:01:41+00:00| seen| https://gist.github.com/KhoaPhan8I/b7899621299193d7b7079d85f4806beb...

CVE-2026-54167

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-54168

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

GHSA-W6F5-V2H6-G786

creationtimestamp| type| source ---|---|--- 2026-09-15 15:00:06+00:00| seen| https://t.me/bdufstecru/3436 2026-09-16 00:00:29+00:00| published-proof-of-concept| https://t.me/bdufstecru/3436 2026-09-21 21:30:11+00:00| seen| https://bsky.app/profile/scoutmonitoring.bsky.social/post/3mw2nuanygu2x...