GHSA-7RH7-C77V-6434

creationtimestamp| type| source ---|---|--- 2025-08-13 18:35:29+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/115022897353332451...

Exploit for Command Injection in Microsoft

💥 CVE-2025-53773 — Remote Code Execution in GitHub Copilot 💥...

GHSA-QP29-WXP5-WH82

creationtimestamp| type| source ---|---|--- 2025-08-13 14:33:15+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115021944858201050...

GHSA-V393-38QX-V8FP

creationtimestamp| type| source ---|---|--- 2025-08-13 14:31:45+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115021938966211903...

GHSA-GJP6-9CVG-8W93

creationtimestamp| type| source ---|---|--- 2025-08-13 13:51:23+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115021780280718785...

GHSA-8XR5-732G-84PX

creationtimestamp| type| source ---|---|--- 2025-08-13 13:50:59+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115021778727232469...

GHSA-PWQ7-2GVJ-VG9V vulnerabilities

Vulnerabilities for packages: tensorflow-cpu-jupyter...

MAL-2025-191832 Malicious code in pycrackhash (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b3323afe460298d80a354497acdd641752c5fb6bce2dce3d7e7625d7a46f1d7c When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used ...

Malicious code in pycrackhash (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b3323afe460298d80a354497acdd641752c5fb6bce2dce3d7e7625d7a46f1d7c When using methods from the package, it downloads an obfuscated code from Github and puts it in multiple localisation. While it appears that this code is used ...

GHSA-V594-44HM-2J7P vulnerabilities

Vulnerabilities for packages: python...

PT-2025-34541 · Github Actions · Boldestdungeon/Steam-Workshop-Deploy +1

Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...

CVE-2025-53773

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

CVE-2025-53773

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

CVE-2025-53773 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

...

CVE-2025-53773 GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

...

CVE-2025-53773

CVE-2025-53773 describes a command-injection-based remote code execution risk in GitHub Copilot and Visual Studio. The root cause is improper neutralization of elements in prompts/config that Copilot can read and act on, potentially allowing an attacker to cause Copilot to modify project configur...

GHSA-26F4-RX96-XC55

creationtimestamp| type| source ---|---|--- 2025-08-12 16:15:55+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115016686292744862...

CVE-2025-54864

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...

CVE-2025-54864 Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins

Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be...