32162 matches found
GO-2025-3770 Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi
Host header injection which leads to open redirect in RedirectSlashes in github.com/go-chi/chi...
GO-2025-3765 SQL injection vulnerability in github.com/uptrace/bun/driver/pgdriver
SQL injection vulnerability in github.com/uptrace/bun/driver/pgdriver...
PT-2025-31594 · Github Actions · Buildalon/Setup-Steamcmd
Summary Log output includes authentication token that provides full account access Details The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves...
PT-2025-31593 · Github Actions · Rageagainstthepixel/Setup-Steamcmd
Summary Log output includes authentication token that provides full account access Details The post job action prints the contents of config/config.vdf which holds the saved authentication token and can be used to sign in on another machine. This means any public use of this action leaves...
CVE-2025-53832
creationtimestamp| type| source ---|---|--- 2025-07-20 23:48:39+00:00| published-proof-of-concept| https://github.com/translated/lara-mcp/security/advisories/GHSA-xj5p-8h7g-76m7...
Embedded Malicious Package
Overview @toptal/picasso-forms is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
Embedded Malicious Package
Overview @toptal/picasso-quote is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
Embedded Malicious Package
Overview @toptal/picasso-charts is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
Embedded Malicious Package
Overview @toptal/picasso-select is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
Embedded Malicious Package
Overview @toptal/picasso-shared is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
Embedded Malicious Package
Overview @toptal/picasso-tailwind is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
Embedded Malicious Package
Overview @toptal/picasso-typography is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
Embedded Malicious Package
Overview @toptal/picasso-provider is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
CVE-2025-52362
creationtimestamp| type| source ---|---|--- 2025-07-20 03:25:00+00:00| seen| https://gist.github.com/Shulelk/a18c11866be8609b22ff5df780a42422 2025-07-22 18:46:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lul63esm6u2w...
CVE-2025-6981
An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of...
Hackers Use GitHub Repositories to Host Amadey Malware and Data Stealers, Bypassing Filters
Threat actors are leveraging public GitHub repositories to host malicious payloads and distribute them via Amadey as part of a campaign observed in April 2025. "The MaaS malware-as-a-service operators used fake GitHub accounts to host payloads, tools, and Amadey plug-ins, likely as an attempt to...
CVE-2025-53817
creationtimestamp| type| source ---|---|--- 2025-07-17 15:21:08+00:00| seen| https://bsky.app/profile/securitylab.github.com/post/3lu6abggi6s2z 2025-07-18 15:56:31+00:00| seen| https://seclists.org/oss-sec/2025/q3/51 2025-07-18 18:10:46+00:00| seen|...
GitHub Abused to Spread Amadey, Lumma and Redline InfoStealers in Ukraine
Hackers abused fake GitHub accounts to spread Emmenhtal, Amadey, Lumma and Redline infoStealers in attacks linked to a phishing campaign targeting Ukraine in early 2025...
CVE-2024-36675
creationtimestamp| type| source ---|---|--- 2025-07-17 11:50:29+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-36675.yaml 2025-07-18 21:02:28+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lubdsqyf772p 2025-08-12...