CVE-2026-101912 vulnerabilities

Vulnerabilities for packages: actions-runner, sqlpad, lerna, code-server, langfuse, tileserver-gl-fips, opensearch-dashboards, librechat, opensearch-dashboards-fips, unleash, langfuse-fips, unleash-proxy, npm, homepage, kibana...

CVE-2026-102278 vulnerabilities

Vulnerabilities for packages: arangodb, foxx-cli, lerna, langfuse, langfuse-fips, dotstatsuite-supercore, gitlab-rails-ce-fips, kibana, sqlpad, rancher-api-ui, unleash, opensearch-dashboards, unleash-fips, npm, verdaccio, ts-patch, actions-runner, lambda-nodejs, nextcloud-server, gitlab-rails-ce,...

CVE-2026-18540 vulnerabilities

Vulnerabilities for packages: actions-runner, code-server, npm, homepage, kibana...

GHSA-RFGV-XXQX-MFG5 vulnerabilities

Vulnerabilities for packages: actions-runner, code-server, npm, homepage, kibana...

CVE-2026-19534 vulnerabilities

Vulnerabilities for packages: actions-runner, code-server, npm, homepage, kibana...

GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: arangodb, foxx-cli, lerna, langfuse, langfuse-fips, dotstatsuite-supercore, gitlab-rails-ce-fips, kibana, sqlpad, rancher-api-ui, unleash, opensearch-dashboards, unleash-fips, npm, verdaccio, ts-patch, actions-runner, lambda-nodejs, nextcloud-server, gitlab-rails-ce,...

GHSA-R53P-7PC4-XJ5R vulnerabilities

Vulnerabilities for packages: actions-runner, code-server, npm, homepage, kibana...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: arangodb, foxx-cli, lerna, langfuse, langfuse-fips, dotstatsuite-supercore, gitlab-rails-ce-fips, kibana, sqlpad, rancher-api-ui, unleash, opensearch-dashboards, unleash-fips, npm, verdaccio, ts-patch, actions-runner, lambda-nodejs, nextcloud-server, gitlab-rails-ce,...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: arangodb, foxx-cli, lerna, langfuse, langfuse-fips, dotstatsuite-supercore, gitlab-rails-ce-fips, kibana, sqlpad, rancher-api-ui, unleash, opensearch-dashboards, unleash-fips, npm, verdaccio, ts-patch, actions-runner, lambda-nodejs, nextcloud-server, gitlab-rails-ce,...

CVE-2026-101911 vulnerabilities

Vulnerabilities for packages: actions-runner, sqlpad, lerna, code-server, langfuse, tileserver-gl-fips, opensearch-dashboards, librechat, opensearch-dashboards-fips, unleash, langfuse-fips, unleash-proxy, npm, homepage, kibana...

GHSA-H3MG-XC3C-68PW vulnerabilities

Vulnerabilities for packages: actions-runner, sqlpad, lerna, code-server, langfuse, tileserver-gl-fips, opensearch-dashboards, librechat, opensearch-dashboards-fips, unleash, langfuse-fips, unleash-proxy, npm, homepage, kibana...

GHSA-J6R3-76F7-8JCV vulnerabilities

Vulnerabilities for packages: actions-runner, sqlpad, lerna, code-server, langfuse, tileserver-gl-fips, opensearch-dashboards, librechat, opensearch-dashboards-fips, unleash, langfuse-fips, unleash-proxy, npm, homepage, kibana...

CVE-2026-54752: Deserialization of Untrusted Data

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

CVE-2026-58502: Improper Neutralization of Special Elements used in an OS Command

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-63187: Improper Control of Generation of Code

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: delve, crossplane-provider-aws-kms, bento, gogatekeeper, kiali, multus-cni, dask-gateway, fluent-bit-plugin-loki, continuity, crossplane-provider-aws-rds, k9s, kubescape, nri-mssql, pulumi-language-java, spicedb-operator, podinfo, kubevela, cert-manager-webhook-pdns,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: bento, gogatekeeper, dask-gateway, nginx-prometheus-exporter, crossplane-provider-aws-rds, nerdctl, kyverno-policy-reporter-ui, minio-operator, helm-set-status, podinfo, lazygit, cloud-provider-vsphere, boring-registry, bom, ratify, kserve-modelmesh-serving, blobfuse...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-sql, k3d, flux-kustomize-controller, flux, rabbitmq-messaging-topology-operator, goreleaser, spire-server, tkn, vexctl, kargo, kubescape, neuvector-sigstore-interface, k3s, timestamp-authority, nuclei, opentelemetry-collector-contrib, guac,...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24059: Improper Privilege Management

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...