GO-2025-3605 Vulnerable to Path Traversal via Crafted ZIP File in github.com/mholt/archiver

Vulnerable to Path Traversal via Crafted ZIP File in github.com/mholt/archiver...

PT-2025-32002

Name of the Vulnerable Software and Affected Versions: react-native-bottom-tabs versions 0.9.2 and earlier Description: The react-native-bottom-tabs library improperly used the pull request target event trigger in the github/workflows/release-canary.yml GitHub Actions workflow. This allowed...

Linux Distros Unpatched Vulnerability : CVE-2025-25204

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gh is GitHub's official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact...

python3.11-django-ansible-base: Sensitive Authenticator Secrets Returned in Clear Text via API in AAP

A flaw was found in Ansible Automation Platform AAP where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users...

Malicious code in nr1-github (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6745 Malicious code in nr1-github (npm)

The package communicates with a domain associated with malicious activity...

gh 安全漏洞

gh is a GitHub API library open-sourced by R infrastructure. A security vulnerability exists in gh versions prior to 1.5.0, which stems from the inclusion of the Authorization header in an HTTP response, which could lead to information disclosure...

CVE-2025-54430

dedupe is a python library that uses machine learning to perform fuzzy matching, deduplication and entity resolution quickly on structured data. Before commit 3f61e79, a critical severity vulnerability has been identified within the .github/workflows/benchmark-bot.yml workflow, where a issuecomme...

CVE-2025-54136

Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a...

CVE-2025-54136 Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals

Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a...

CVE-2025-54136 Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals

Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a...

CVE-2025-54796

creationtimestamp| type| source ---|---|--- 2025-08-01 21:32:31+00:00| published-proof-of-concept| https://github.com/9001/copyparty/security/advisories/GHSA-5662-2rj7-f2v6...

CVE-2025-53012

creationtimestamp| type| source ---|---|--- 2025-07-31 15:42:08+00:00| published-proof-of-concept| https://github.com/AcademySoftwareFoundation/MaterialX/security/advisories/GHSA-qc2h-74x3-4v3w...

CVE-2025-7738

A flaw was found in Ansible Automation Platform AAP where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users...

CVE-2025-7738 Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap

A flaw was found in Ansible Automation Platform AAP where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users...

CVE-2025-7738

CVE-2025-7738 affects Red Hat Ansible Automation Platform (AAP) where the Gateway API exposes the client secret for certain GitHub Enterprise authenticators. The underlying issue is that sensitive authenticator secrets are returned in clear text via the API, with exposure limited to privileged us...

CVE-2025-7738 Python3.11-django-ansible-base: sensitive authenticator secrets returned in clear text via api in aap

A flaw was found in Ansible Automation Platform AAP where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users...

N. Korean Hackers Used Job Lures, Cloud Account Access, and Malware to Steal Millions in Crypto

The North Korea-linked threat actor known as UNC4899 has been attributed to attacks targeting two different organizations by approaching their employees via LinkedIn and Telegram. "Under the guise of freelance opportunities for software development work, UNC4899 leveraged social engineering...

CVE-2025-41419

creationtimestamp| type| source ---|---|--- 2025-07-31 06:16:31+00:00| published-proof-of-concept| https://github.com/modelscope/ms-swift/security/advisories/GHSA-7c78-rm87-5673...

GitProxy Hidden Commits Injection

Summary An attacker can inject extra commits into the pack sent to GitHub, commits that aren’t pointed to by any branch. Although these “hidden” commits never show up in the repository’s visible history, GitHub still serves them at their direct commit URLs. This lets an attacker exfiltrate...