PT-2026-71137

Name of the Vulnerable Software and Affected Versions binutils affected versions not specified Description Multiple Use-After-Free issues exist in the add archive element function within the GNU linker ld, a component of binutils. The problem occurs when plugin maybe claim in ld/plugin.c frees th...

PT-2026-71198

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 19.0 through 19.0.5 GitLab CE/EE versions 19.1 through 19.1.3 GitLab CE/EE versions 19.2 through 19.2.1 Description Improper authorization in pipeline reference validation allows an authenticated user with developer-role...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE GitLab Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE Authorizatio...

GHSA-3GMF-P6R4-Q8M6

creationtimestamp| type| source ---|---|--- 2026-08-11 09:43:37+00:00| seen| https://gist.github.com/hayageek/05ef86a8272d03ab9e54ab5476cf7afe...

Mobile-Security-Framework-MobSF v4.5.2

Mobile Security Framework MobSF Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. MobSF can be used for a variety of use cases such as mobile application security, penetration testing, malware analysis, and privacy analysis...

GitHub Actions Workflow Secrets Detection

Probes common /.github/workflows/.yml paths for exposed CI definitions and flags inline secrets, $ secrets. references, PATs, and private keys. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed GitHub Actions workflow files and CI secret references.""" from kittysploit import from...

strix v1.5.1

Strix The open-source AI pentesting tool. Autonomous AI hackers that find and fix your app’s vulnerabilities. !TIP New! Strix integrates seamlessly with GitHub Actions and CI/CD pipelines. Automatically scan for vulnerabilities on every pull request and block insecure code before it reaches...

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...

akto v2.16.5

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

Malicious code in @nebula.js/sn-tabbed-container (npm)

npm/@nebula.js/sn-tabbed-container is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in picasso.js (npm)

npm/picasso.js is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the...

MAL-2026-11709 Malicious code in @or-sdk/library-types-v1 (npm)

npm/@or-sdk/library-types-v1 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11629 Malicious code in @onereach/si-alert (npm)

npm/@onereach/si-alert is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @or-sdk/event-manager (npm)

npm/@or-sdk/event-manager is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

MAL-2026-11700 Malicious code in @or-sdk/idw-public (npm)

npm/@or-sdk/idw-public is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11724 Malicious code in @or-sdk/sdk-api (npm)

npm/@or-sdk/sdk-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

zizmor v1.29.0

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

GitLab 18.0 < 19.0.5 / 19.1 < 19.1.3 / 19.2 < 19.2.1 (CVE-2026-12436)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an...

vet v1.18.1

Quick Start • Documentation • Community !NOTE vet supports special mode for Agent Skills. Run vet scan --agent-skill to scan an Agent Skill hosted in a GitHub repository. Why vet? 70-90% of modern software is open source code — how do you know it's safe? Traditional SCA tools drown you in CVE...

CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...