GitHub CLI has an incorrect authorization header in API requests to TUF repository mirrors via `gh attestation`, `gh release verify`, and `gh release verify-asset` commands

Summary GitHub CLI incorrectly includes an authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. Affected users: - Authenticated github.com users who previously ran gh attestation commands, gh release verify, or...

CVE-2026-48501

GitHub CLI (gh) prior to 2.93.0 contains a token leakage vulnerability: a shared HTTP client with an authentication layer attaches user tokens to outgoing requests without proper host detection. The host normalization collapses any *.github.com subdomain to github.com, causing requests to tuf-rep...

CVE-2026-48501

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

CVE-2026-48501 GitHub CLI tokens leak via `gh attestation` commands

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

CVE-2026-48501 GitHub CLI tokens leak via `gh attestation` commands

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

CVE-2026-48501

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

CVE-2026-48501 GitHub CLI tokens leak via `gh attestation` commands

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh release verify-asset commands. The CLI uses a shared HTTP client with an authenticati...

OPENSUSE-SU-2026:20841-1 Security update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec

This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues: Changes in apache-commons-lang3: Update to 3.20.0 New features: + Add SystemProperties.getPathString, Supplier + Add...

SUSE-SU-2026:21996-1 Security update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec

This update for apache-commons-lang3, apache-commons-text, apache-commons-configuration2, apache-commons-cli, apache-commons-io, apache-commons-codec fixes the following issues: Changes in apache-commons-lang3: Update to 3.20.0 New features: + Add SystemProperties.getPathString, Supplier + Add...

PT-2026-45054

Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description The direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution. The MentionsParser.process function handles these mentions by performing a direct HTTP...

OPENSUSE-SU-2026:10888-1 argocd-cli-3.4.3-1.1 on GA media

These are all security issues fixed in the argocd-cli-3.4.3-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-45033

Name of the Vulnerable Software and Affected Versions Ouroboros versions prior to 0.39.0 Description A Remote Code Execution issue exists when the software loads a .env file from the current working directory. An attacker can include a malicious script in a repository and use environment variable...

GitHub CLI 安全漏洞

GitHub CLI is an open-source command-line interface for GitHub. Prior to version 2.93.0 of GitHub CLI, there was a security vulnerability. This vulnerability stemmed from incorrect authorization headers in API requests to the TUF repository via the gh attestation, gh release verify, and gh releas...

PT-2026-44905

Name of the Vulnerable Software and Affected Versions GitHub CLI versions prior to 2.93.0 Description GitHub CLI incorrectly includes authorization headers in API requests to TUF repository mirrors when using the gh attestation, gh release verify, and gh release verify-asset commands. The tool...

OPENSUSE-SU-2026:10894-1 kpt-cli-1.0.0~beta.64-1.1 on GA media

These are all security issues fixed in the kpt-cli-1.0.0beta.64-1.1 package on the GA media of openSUSE Tumbleweed...

Malicious code in veloxml-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57a2b332595fb95752df25e794528ff2dd610bf3977b8d4abd7574cb0f21cdff The package advertises fake functionality and exfiltrates the given email and basic information about the host when used. --- Category: MALICIOUS - The campaig...

MAL-2026-4862 Malicious code in veloxml-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57a2b332595fb95752df25e794528ff2dd610bf3977b8d4abd7574cb0f21cdff The package advertises fake functionality and exfiltrates the given email and basic information about the host when used. --- Category: MALICIOUS - The campaig...

CVE-2026-46595 vulnerabilities

Vulnerabilities for packages: kots, external-secrets-operator, kubernetes, cilium-cli, istio, prometheus, containerd, flux-source-controller, snyk-cli, argocd-image-updater, opentelemetry-collector, cert-manager, cilium, skaffold, k3s, kubernetes-dashboard, kyverno, helm, telegraf, gitlab-kas,...

CVE-2026-39832 vulnerabilities

Vulnerabilities for packages: istio, containerd, flux-source-controller, nuclei, snyk-cli, argo-cd, opentofu, loki, knative-serving, dagger, guac, k9s, osv-scanner, act, apko, trivy-operator, trivy, witness, flux-image-automation-controller, kots, nfpm, k3s, kubernetes-dashboard, kyverno, buildah...

CVE-2026-39829 vulnerabilities

Vulnerabilities for packages: k8sgpt, istio, containerd, flux-source-controller, nuclei, snyk-cli, atlantis, argo-cd, age, datadog-agent, opentofu, neuvector-sigstore-interface, loki, knative-serving, dagger, fulcio, guac, gitlab-runner, k9s, osv-scanner, act, chisel, apko, sops,...