CVE-2026-71868 Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-76228

Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...

GHSA-V5RC-CPWC-CFPR

creationtimestamp| type| source ---|---|--- 2026-08-19 07:31:59+00:00| seen| https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad...

GHSA-V2WP-FRMC-5Q3V

creationtimestamp| type| source ---|---|--- 2026-08-19 07:31:59+00:00| seen| https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad...

BIT-GITLAB-2026-15423 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...

GHSA-XV7V-HW45-9JGW vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-70429 vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: step-issuer, nri-kubernetes-fips, wavefront-collector-for-kubernetes, external-dns, crossplane-provider-aws-redshiftserverless, glab-fips, prometheus-process-exporter, chisel-fips, secrets-store-csi-driver, crossplane-provider-aws-directconnect-fips,...

CVE-2026-22555

A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...

GO-2026-5486 vulnerabilities

Vulnerabilities for packages: tekton-pipelines-fips, tekton-chains-fips, tekton-chains, tekton-pipelines, tkn-fips, tkn...

GO-2026-4678 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, kubeflow-pipelines, argo-workflows...

GO-2025-3720 vulnerabilities

Vulnerabilities for packages: argo-cd, argocd-image-updater, argocd-image-updater-fips...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: beats-fips, wolfictl, prometheus, trivy-fips, spire-server-fips, aws-otel-collector-fips, openfga, k9s, splunk-otel-collector, nerdctl, openfga-fips, trufflehog-fips, k9s-fips, buildkitd, grype-fips, buf, cg, docker-compose, syft, buildah, opentelemetry-collector-fip...

GO-2023-1754 vulnerabilities

Vulnerabilities for packages: aactl, ko, apko...

GO-2026-5751 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2025-4245 vulnerabilities

Vulnerabilities for packages: verticadb-operator, k3s, tempo, amazon-cloudwatch-agent, argo-rollouts, argo-cd, grafana-alloy, vale, datadog-agent, opentelemetry-collector, jaeger, kubeflow-pipelines, splunk-otel-collector, coredns, kserve, nats, argo-workflows, aws-otel-collector, kargo,...

GHSA-P28V-F755-9QRG

creationtimestamp| type| source ---|---|--- 2026-08-13 21:32:39+00:00| seen| https://gist.github.com/alon710/9ad8f19dc4256e5aad5d6b3105b603da...

CVE-2026-58416 Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)

Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...