ROOT-APP-PYPI-GHSA-HMQ2-W58F-27JC GHSA-hmq2-w58f-27jc in GitPython - Patched by Root

Root has patched GHSA-hmq2-w58f-27jc in the GitPython package for Root:PyPI. Multiple fixed versions available...

CVE-2022-36804

CVE-2022-36804 概念验证 该仓库包含针对近期 BitBucket 远程代码执行漏洞 CVE-2022-36804 的简易概念验证利用代码。利用此漏洞需要能够访问目标实例上的一个仓库；如果你没有凭据，则目标必须具有公开仓库。 用法 root@kitploit: usage: exploit.py -h -p PROJECT -r REPO -u URL -c COMMAND --proxy PROXY --session SESSION --check Exploits the CVE-2022-36804 RCE in vulnerable BitBucket...

CVE-2026-92773

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-92773

Trigger.dev before 4.6.0 contains a GitHub App installation takeover vulnerability in its GitHub integration service (gitHub.server.ts). The root cause is a failure to verify that an authenticated user actually controls a GitHub App installation before binding it to their organization. An attacke...

CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

EUVD-2026-81037

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

GO-2026-6339 Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea

Gitea exposes tracked time entries without repository authorization in code.gitea.io/gitea...

SUSE CVE-2026-77573

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side request forgery against internal services through DNS rebinding during VCS operations. Weblate...

CVE-2026-58416

A flaw was found in Gitea. The Fork-PR Actions task, which handles pull requests from forked repositories, can be exploited to read data from a third private repository. This occurs due to a missing guard that should prevent unauthorized access via the collaborative-owner branch. A remote attacke...

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

EUVD-2026-62933

In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that they are not authorized to view. The vulnerability is possible because Playbook History does not check repository permissions before...

GO-2026-4942 Stale blob descriptor cache invalidation in github.com/distribution/distribution

In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale...

ANT-2026-VN61PHA0 · gitea · IDOR

idor medium CVE-2026-58435 GHSA-rh79-75qm-gwjr Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-VN61PHA0: Gitea LFS Deploy-Ke...

EUVD-2026-60025

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601 Planet9 Hardcoded Credentials Vulnerability Information

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601

CVE-2026-50601 affects the Planet9 desktop application, where a hardcoded read-only API key allows unauthorized access to internal repositories. An attacker could use this access to extract embedded administrative keys and secrets, potentially gaining administrative control over repository infras...

PT-2026-73192

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-58434

Private Repository Metadata Remains Accessible After Access Revocation...

PT-2026-71103

Name of the Vulnerable Software and Affected Versions Puppet affected versions not specified Description An authenticated user can view private Puppet module metadata even if they do not have the required repository read access. Recommendations At the moment, there is no information about a newer...