CVE-2026-102278 vulnerabilities

Vulnerabilities for packages: pelias-api, npm, opensearch-dashboards, rancher-api-ui, lambda-nodejs, foxx-cli, verdaccio, unleash, authentik-fips, unleash-fips, arangodb, lerna, kibana, nextcloud-server, gitlab-rails-ce, actions-runner, dotstatsuite-supercore, langfuse, ts-patch, sqlpad,...

GHSA-RFGV-XXQX-MFG5 vulnerabilities

Vulnerabilities for packages: code-server, npm, actions-runner, kibana, homepage...

CVE-2026-18540 vulnerabilities

Vulnerabilities for packages: code-server, npm, actions-runner, kibana, homepage...

CVE-2026-101912 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, unleash-proxy, opensearch-dashboards-fips, code-server, npm, actions-runner, librechat, langfuse-fips, langfuse, lerna, kibana, homepage, opensearch-dashboards, sqlpad, unleash...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: pelias-api, npm, opensearch-dashboards, rancher-api-ui, lambda-nodejs, foxx-cli, verdaccio, unleash, authentik-fips, unleash-fips, arangodb, lerna, kibana, nextcloud-server, gitlab-rails-ce, actions-runner, dotstatsuite-supercore, langfuse, ts-patch, sqlpad,...

GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: pelias-api, npm, opensearch-dashboards, rancher-api-ui, lambda-nodejs, foxx-cli, verdaccio, unleash, authentik-fips, unleash-fips, arangodb, lerna, kibana, nextcloud-server, gitlab-rails-ce, actions-runner, dotstatsuite-supercore, langfuse, ts-patch, sqlpad,...

CVE-2026-19534 vulnerabilities

Vulnerabilities for packages: code-server, npm, actions-runner, kibana, homepage...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: pelias-api, npm, opensearch-dashboards, rancher-api-ui, lambda-nodejs, foxx-cli, verdaccio, unleash, authentik-fips, unleash-fips, arangodb, lerna, kibana, nextcloud-server, gitlab-rails-ce, actions-runner, dotstatsuite-supercore, langfuse, ts-patch, sqlpad,...

GHSA-R53P-7PC4-XJ5R vulnerabilities

Vulnerabilities for packages: code-server, npm, actions-runner, kibana, homepage...

GHSA-H3MG-XC3C-68PW vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, unleash-proxy, opensearch-dashboards-fips, code-server, npm, actions-runner, librechat, langfuse-fips, langfuse, lerna, kibana, homepage, opensearch-dashboards, sqlpad, unleash...

GHSA-J6R3-76F7-8JCV vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, unleash-proxy, opensearch-dashboards-fips, code-server, npm, actions-runner, librechat, langfuse-fips, langfuse, lerna, kibana, homepage, opensearch-dashboards, sqlpad, unleash...

CVE-2026-101911 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, unleash-proxy, opensearch-dashboards-fips, code-server, npm, actions-runner, librechat, langfuse-fips, langfuse, lerna, kibana, homepage, opensearch-dashboards, sqlpad, unleash...

CVE-2026-54752: Deserialization of Untrusted Data

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

CVE-2026-58502: Improper Neutralization of Special Elements used in an OS Command

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-63187: Improper Control of Generation of Code

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: nri-consul, tigera-operator, argo-events, local-path-provisioner, litestream, dbmate, istio, percona-server-mongodb-operator, kube-vip, sftpgo-plugin-auth, aactl, descheduler, amazon-cloudwatch-agent-operator, crossplane-provider-family-azure,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: hydra, nats-top, local-path-provisioner, rancher-telemetry, litestream, dbmate, percona-server-mongodb-operator, sftpgo-plugin-auth, aactl, descheduler, amazon-cloudwatch-agent-operator, terraform-provider-time, wgcf, chisel, crossplane-provider-sql,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, argo-events, crossplane-provider-azure, aactl, kubernetes-event-exporter, neuvector-sigstore-interface, crossplane-provider-family-azure, tkn, flux-helm-controller, cosign, k3d, nuclei, glab, kubescape, rekor, flux, falcoctl,...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24059: Improper Privilege Management

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...