34882 matches found
EUVD-2026-78769
Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In...
CVE-2026-55158 Conflibot: Command injection via crafted pull request branch names under pull_request_target
Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In...
CVE-2026-55158
Conflibot (a GitHub Action that warns about merge conflicts among open pull requests) is vulnerable to command injection via crafted pull request branch names. Prior to version 1.2.1, src/index.ts interpolates the attacker-controlled head.ref value into shell strings passed to exec, allowing an a...
CVE-2026-55158 Conflibot: Command injection via crafted pull request branch names under pull_request_target
Conflibot warns in advance when merging a pull request will cause conflicts in other open pull requests. Prior to 1.2.1, src/index.ts builds git checkout, git merge, and git format-patch commands by interpolating the attacker-controlled pull request head.ref value into strings passed to exec. In...
EUVD-2026-78587
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...
CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...
CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...
CVE-2026-54167
Pipelines-as-Code , a CI/CD system for defining Tekton pipelines in source repositories, is affected in its GitHub App provider . Prior to versions 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the provider accepts the X-GitHub-Enterprise-Host request header as the API host before webhook signature validat...
CVE-2026-54167 Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...
CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
EUVD-2026-78586
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
CVE-2026-45052
creationtimestamp| type| source ---|---|--- 2026-09-15 10:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvkf2lbrim24 2026-09-15 12:07:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvklmb5fi32g 2026-09-15 16:01:41+00:00| seen|...
CVE-2026-7646
creationtimestamp| type| source ---|---|--- 2026-09-15 08:01:49+00:00| seen| https://gist.github.com/ichintu/61eae90f050b47deb0b3d5ff8144d16f...
GHSA-9QXX-2FGC-35R8
creationtimestamp| type| source ---|---|--- 2026-09-15 07:04:48+00:00| seen| https://gist.github.com/maxbro1992/6c89390c80f987e251e3979a9c98ceb6...
GHSA-GH8F-V7FJ-8CJ2
creationtimestamp| type| source ---|---|--- 2026-09-15 07:04:48+00:00| seen| https://gist.github.com/maxbro1992/6c89390c80f987e251e3979a9c98ceb6...
CVE-2026-90843
creationtimestamp| type| source ---|---|--- 2026-09-15 04:02:20+00:00| seen| https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621...
CVE-2026-91771
creationtimestamp| type| source ---|---|--- 2026-09-15 04:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvjqfgnwax2z 2026-09-15 04:02:20+00:00| seen| https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621 2026-09-15 12:50:04+00:00| seen|...