GO-2026-4340 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, dockerize, rabbitmq-messaging-topology-operator, osv-scanner, cosign, kubernetes-event-exporter, src, lvm-driver, kor, lazygit, kubescape-operator, spire-controller-manager, cloud-provider-vsphere, rancher-loglevel, cloud-provider-aws...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, pulumi, rekor, flux-source-controller, gh, falcoctl, cosign, ksops, kubernetes-event-exporter, neuvector-sigstore-interface, opentelemetry-collector-contrib, step-ca, gomplate, flux-image-reflector-controller, slsa-verifier, aact...

CVE-2026-24059 Gitea runner registration-token GET endpoint performs a write under a read-only token scope

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

CVE-2026-24059: Improper Privilege Management

The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...

PT-2026-68302

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40 Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: actions-runner, node-gyp, saf, kibana, py3-captum, pelias-api, gemini-cli, prism, haraka, vitess, renovate, code-server, npm...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: actions-runner, node-gyp, saf, kibana, py3-captum, pelias-api, gemini-cli, prism, haraka, vitess, renovate, code-server, npm...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: actions-runner, node-gyp, saf, kibana, py3-captum, pelias-api, gemini-cli, prism, haraka, vitess, renovate, code-server, npm...

GHSA-35P6-XMWP-9G52 vulnerabilities

Vulnerabilities for packages: actions-runner, node-gyp, saf, kibana, py3-captum, pelias-api, gemini-cli, prism, haraka, vitess, renovate, code-server, npm...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: actions-runner, node-gyp, saf, kibana, py3-captum, pelias-api, gemini-cli, prism, haraka, vitess, renovate, code-server, npm...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: actions-runner, node-gyp, saf, kibana, py3-captum, pelias-api, gemini-cli, prism, haraka, vitess, renovate, code-server, npm...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: actions-runner, node-gyp, saf, kibana, py3-captum, pelias-api, gemini-cli, prism, haraka, vitess, renovate, code-server, npm...

GHSA-VXPW-J846-P89Q vulnerabilities

Vulnerabilities for packages: actions-runner, node-gyp, saf, kibana, py3-captum, pelias-api, gemini-cli, prism, haraka, vitess, renovate, code-server, npm...

GHSA-8Q5R-MMJF-575Q Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

Due to the combination of checking out PR head branches attacker-controlled, reading .mcp.json from the working directory via default setting sources, and unconditionally enabling all project MCP servers via enableAllProjectMcpServers, it was possible for an attacker who opened a PR containing a...

CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, homepage, saf, sqlpad, py3-jupyterlab, librechat, argo-workflows, prism, arangodb, opensearch-dashboards, dbgate, dbgate-fips, npm, actions-runner, kubeflow-pipelines, nextcloud-server, wazuh-dashboard, tensorflow-gpu-jupyter, kibana,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, envoy-ratelimit, victoriametrics-cluster, sftpgo-plugin-eventsearch, flux-source-controller, gh, dkron, osv-scanner, nova, malcontent, stakater-reloader, flux-image-reflector-controller, mariadb-operator, grafana-rollout-operator...