22718 matches found
CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow
cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...
CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow
cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...
CVE-2024-58354
Cal.com (cal.com/cal.diy) is affected by a repository takeover via its GitHub Actions workflow. The pr.yml workflow uses pull_request_target and passes repo default write permissions to check-types.yml, which then dangerous-checks out the attacker PR and executes it (yarn install, package.json sc...
CVE-2024-58354
cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...
CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow
cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...
CVE-2026-6924 Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path
A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated...
EUVD-2026-48399
A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already deprecated...
Malicious Package
Overview eth-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
brave-browser v1.95.3
Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...
MINI-R7XW-M2C8-JGHP
Bulletin has no description...
gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options
A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive and git.lsremote, potentially leading to arbitrary code execution. Additionally, functions such as...
brave-browser v1.95.1
Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...
PT-2026-64180
Name of the Vulnerable Software and Affected Versions cal.com main branch Description A repository takeover issue exists in the GitHub Actions workflows. The pr.yml workflow utilizes the pull request target trigger with default write permissions, which are passed to check-types.yml. This second...
CVE-2024-58354: Improper Neutralization of Special Elements used in a Command
cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...
PT-2026-64178
Name of the Vulnerable Software and Affected Versions Silicon Labs Matter SiWx917 affected versions not specified Description A bug in the entropy initialization for SiWx917 causes the Deterministic Random Bit Generator DRBG, a mechanism used to produce random numbers, to use a predictable seed...
GHSA-RCV6-PVRJ-4XCG n8n: Authenticated code execution in the n8n Git node
Impact Authenticated n8n users with rights to create and execute workflows could achieve code execution on the n8n host. Using the Git node, under the default git security settings, by staging a crafted local repository, an attacker could cause git to run hooks, executing arbitrary commands as th...
n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
Impact Authenticated n8n users with workflow create/execute rights could use the Git node's fetch, pull, or push-tags operations to bypass the repository-path containment checks that already protected clone and push. By pointing an allowlisted remote configuration value at a local path outside th...
GO-2026-6031 Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea
Gitea: API access token scope enforcement bypass on repository RSS/Atom feed endpoints leaks private repository commit data in code.gitea.io/gitea...
GO-2026-6043 Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea
Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write in code.gitea.io/gitea...