‘Cordyceps’ CI/CD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking

Novee Security reveals Cordyceps, a CI/CD vulnerability in GitHub Actions workflows that let anonymous users poison builds and expose tokens across major projects today...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: saf, npm, prism, node-gyp, kibana, renovate, vitess, pelias-api, haraka, actions-runner, code-server, py3-captum, gemini-cli...

GHSA-VXPW-J846-P89Q vulnerabilities

Vulnerabilities for packages: saf, npm, prism, node-gyp, kibana, renovate, vitess, pelias-api, haraka, actions-runner, code-server, py3-captum, gemini-cli...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: saf, npm, prism, node-gyp, kibana, renovate, vitess, pelias-api, haraka, actions-runner, code-server, py3-captum, gemini-cli...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: saf, npm, prism, node-gyp, kibana, renovate, vitess, pelias-api, haraka, actions-runner, code-server, py3-captum, gemini-cli...

GHSA-35P6-XMWP-9G52 vulnerabilities

Vulnerabilities for packages: saf, npm, prism, node-gyp, kibana, renovate, vitess, pelias-api, haraka, actions-runner, code-server, py3-captum, gemini-cli...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: saf, npm, prism, node-gyp, kibana, renovate, vitess, pelias-api, haraka, actions-runner, code-server, py3-captum, gemini-cli...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: saf, npm, prism, node-gyp, kibana, renovate, vitess, pelias-api, haraka, actions-runner, code-server, py3-captum, gemini-cli...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: saf, npm, prism, node-gyp, kibana, renovate, vitess, pelias-api, haraka, actions-runner, code-server, py3-captum, gemini-cli...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the recordSelectOptionsQuery method. An attacker can bypass intended access restrictions by tampering with the Livewire component's state and submitting out-of-scope values in the Sele...

CVE-2026-48067

Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery method may be used to scope the options available in the Select field for AttachActio...

CVE-2026-48067 Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields

Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery method may be used to scope the options available in the Select field for AttachActio...

CVE-2026-48067

Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tables 3.0.0 until 3.3.51, the recordSelectOptionsQuery method may be used to scope the options available in the Select field for AttachActio...

CVE-2026-48067

CVE-2026-48067 affects Filament components where the recordSelectOptionsQuery() used to scope options in AttachAction and AssociateAction Select fields did not apply the same scope in validation. From filament/actions 4.0.0–4.11.4 and 5.6.4, and filament/tables 3.0.0–3.3.51, an attacker could tri...

CVE-2026-56221 Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts

Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can injec...

CVE-2026-10601

A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...

CVE-2026-56450

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...

CVE-2026-56450

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...

EUVD-2026-38239

AIL did not restrict repeated failed attempts to verify a two-factor authentication OTP code. An attacker who had reached the 2FA verification step, such as after successfully completing the password-authentication stage, could submit an unlimited number of OTP guesses. This could enable...

Malicious code in respects-switch (npm)

respects-switch is a dependency confusion proof-of-concept package published to the public npm registry by the account r0binak and self-labeled "Security research PoC - Dependency Confusion Hunter". It was published at the artificially high version 999.0.0, the canonical floating-version bait use...