GO-2025-3786 filebrowser Allows Shell Commands to Spawn Other Commands in github.com/filebrowser/filebrowser

filebrowser Allows Shell Commands to Spawn Other Commands in github.com/filebrowser/filebrowser...

GO-2025-3796 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...

GO-2025-3773 Ackites KillWxapkg vulnerable to OS Command Injection in github.com/Ackites/KillWxapkg

Ackites KillWxapkg vulnerable to OS Command Injection in github.com/Ackites/KillWxapkg...

GO-2025-3804 Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju

Juju zip slip vulnerability via authenticated endpoint in github.com/juju/juju...

GO-2025-3794 File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser

File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser...

GO-2025-3792 File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser

File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser...

GO-2025-3806 Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju

Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization in github.com/juju/juju...

GO-2025-3797 Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server

Mattermost Incorrect Authorization vulnerability in github.com/mattermost/mattermost-server...

GO-2025-3798 Leaks private key in certs in github.com/juju/utils

Leaks private key in certs in github.com/juju/utils...

Toptal GitHub Breach Exposes 73 Repositories and Injects Malware into 10 npm Packages

In what's the latest instance of a software supply chain attack, unknown threat actors managed to compromise Toptal's GitHub organization account and leveraged that access to publish 10 malicious packages to the npm registry. The packages contained code to exfiltrate GitHub authentication tokens...

CVE-2025-54528

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow...

CVE-2025-54528

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow...

CVE-2025-54528

CVE-2025-54528 affects JetBrains TeamCity prior to version 2025.07, with a cross-site request forgery (CSRF) vulnerability in the GitHub App connection flow. The NVD and vendor-linked records confirm CSRF exposure in TeamCity’s GitHub integration, with the CVSS vectors indicating independently ex...

CVE-2025-54528

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow...

CVE-2025-54528

In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow...

CVE-2025-54415

dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerability has been identified in the cicd.yml workflow within the astronomer/dag-factory GitHub repository. The workflow, specifically when...

CVE-2025-54416

tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary comma...

JetBrains TeamCity 跨站请求伪造漏洞

JetBrains TeamCity is a Continuous Integration CI/CD tool developed by JetBrains, Inc. to automate the software build, test and deployment process. JetBrains TeamCity suffers from a cross-site request forgery vulnerability that stems from a security flaw in the GitHub application connection...

Building a GraphQL API with Fermyon Wasm Functions

Use this step-by-step guide to create a serverless GraphQL client that fetches GitHub repository stargazer data using Rust, WebAssembly, and Fermyon Wasm Functions...

Exploit for CVE-2014-7911

Security-Data-Analysis-and-Visualization 2018-2020青年安全圈-活跃技术博主/博客 声明 所有数据均来自且仅来自公开信息，未加入个人先验知识，如有疑义，请及时联系[email protected]。 公开这批数据是为了大家一起更快更好地学习，请不要滥用这批数据，由此引发的问题，本人将概不负责。 对这批数据的分析文章首发在个人微信公众号，原文为：我分析了2018-2020年青年安全圈450个活跃技术博客和博主，转载请联系作者。 Why - 最初目的：个人日常安全阅读资源不足，需要从博客、Github、Twitter等多个数据源补充。 -...