483 matches found
GHSA-39J5-W47M-2GMV vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, wazuh-dashboard-fips, redisinsight, semaphore, langfuse, wazuh-dashboard, gitlab-rails-ce-fips, awx, nextcloud-server, librechat, kibana, opensearch-dashboards, gitlab-rails-ce, langfuse-fips, lerna, kubeflow-centraldashboard,...
GHSA-9WX3-P993-35VP vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, redisinsight, arangodb, wazuh-dashboard, langfuse-fips, lerna, kubeflow-centraldashboard, prism, azurite, librechat, opensearch-dashboards, gitlab-rails-ce-fips, awx, nextcloud-server, wazuh-dashboard-fips, semaphore, langfuse, kibana,...
CVE-2026-67319 vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, redisinsight, arangodb, wazuh-dashboard, langfuse-fips, lerna, kubeflow-centraldashboard, prism, azurite, librechat, opensearch-dashboards, gitlab-rails-ce-fips, awx, nextcloud-server, wazuh-dashboard-fips, semaphore, langfuse, kibana,...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-101979)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101979 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a...
CVE-2026-73682
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2026-73294 published by GitHub...
CVE-2026-73682 Semaphore prior to version 2.18.20 OS Command Injection via git_url Repository Handling
Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...
CVE-2026-73682
This CVE ID is rejected/not used as explicitly stated in the Initial Description.
EUVD-2026-58809
Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...
CVE-2026-73682 Semaphore prior to version 2.18.20 OS Command Injection via git_url Repository Handling
Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...
CVE-2026-73682
Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...
PT-2026-72121
Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20 Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by...
Malicious code in semaphore-job-pool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14010 Malicious code in semaphore-job-pool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious Package
Overview semaphore-job-pool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2026-73293
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/id/roles to create a custom manager role with permission bitmask 15, overridin...
CVE-2026-73292
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...
CVE-2026-73294
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...
CVE-2026-73294
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...
CVE-2026-73294 Semaphore U: OS Command Injection
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository giturl handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/id/repositories and scheduled commit-hash polling, allowing...