PT-2026-34196

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner id parameter in the request...

VulnAgent-X: A Layered Agentic Framework for Repository-Level Vulnerability Detection

VulnAgent-X is a layered agentic framework integrating lightweight risk screening, bounded context expansion, specialized analysis agents, selective dynamic verification, and evidence fusion into a unified pipeline. Included in this archive is also a whitepaper from the researchers...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the milestone selection. An attacker can execute arbitrary JavaScript code in the context of another user's browser by storing a crafted HTML or JavaScript payload in a repository's milestone name, which is...

CVE-2026-25921

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2...

Security Bulletin: Vulnerability has been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2025-13333)

Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about a weaker than expected security vulnerability affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the securit...

DEBIAN-CVE-2026-23991

go-tuf is a Go implementation of The Update Framework TUF. Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository or any of its mirrors returns invalid TUF metadata JSON valid JSON but not well formed TUF metadata, the client will panic during parsing, causing a denial of...

CVE-2022-31573

The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-0905

Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4...

CVE-2023-4124

Missing Authorization in GitHub repository answerdev/answer prior to v1.1.1...

CVE-2025-68279 Weblate has an arbitrary file read via symbolic links

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue...

EUVD-2020-7695

Malware in sbrugna...

EUVD-2023-44068

Malicious code in bioql PyPI...

EUVD-2022-7730

Malicious code in bioql PyPI...

EUVD-2023-34031

Malicious code in bioql PyPI...

EUVD-2023-1261

Malicious code in bioql PyPI...

EUVD-2022-0178

Malicious code in bioql PyPI...

EUVD-2023-0366

Malicious code in bioql PyPI...

EUVD-2024-46749

Malicious code in bioql PyPI...

EUVD-2024-41380

Malicious code in bioql PyPI...

EUVD-2024-27390

Malicious code in bioql PyPI...