gh-dork

gh-dork Proporcione una lista de dorks y, opcionalmente, una de las siguientes opciones: un usuario -u un archivo con una lista de usuarios -uf una organización -org un archivo con una lista de organizaciones -of un repositorio -r También puede pasar: un directorio de salida para almacenar...

gh-safe-repo

gh-safe-repo Crea repositorios de GitHub con configuraciones seguras aplicadas automáticamente. Reemplaza la lista de verificación de configuración posterior a la creación de cinco minutos con un solo comando. gh-safe-repo create root@kitploit: Protección de ramas, etiquetas inmutables, Dependabo...

mini-shai-hulud-detector

Detector de Mini Shai-Hulud Escáner de un solo comando para el ataque a la cadena de suministro de npm Mini Shai-Hulud CVE-2026-45321, CVSS 9.6. Crítico: detectar antes de rotar tokens El gusano instala un demonio de persistencia gh-token-monitor que ejecuta rm -rf si detecta la revocación de...

GO-2026-6354 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, snyk-cli, opentelemetry-collector-contrib-fips, cg, kubescape-server-fips, gitea, opentofu-fips, rancher-fleet, trivy-fips, kube-state-metrics, rootlesskit-fips, apply-cve-bump, gitea-fips, gitlab-runner-fips, splunk-otel-collector, gh...

GO-2026-6355 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, snyk-cli, opentelemetry-collector-contrib-fips, cg, kubescape-server-fips, gitea, opentofu-fips, rancher-fleet, trivy-fips, kube-state-metrics, rootlesskit-fips, apply-cve-bump, gitea-fips, gitlab-runner-fips, splunk-otel-collector, gh...

CVE-2026-78662 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, snyk-cli, opentelemetry-collector-contrib-fips, cg, kubescape-server-fips, gitea, opentofu-fips, rancher-fleet, trivy-fips, kube-state-metrics, rootlesskit-fips, apply-cve-bump, gitea-fips, gitlab-runner-fips, splunk-otel-collector, gh...

CVE-2026-56855 vulnerabilities

Vulnerabilities for packages: apko, external-dns, prometheus-operator, chisel, pulumi-language-yaml, zarf, osv-scanner, kubevela, scorecard, containerd, grype, zot, tfsec, grafana-alloy, flux-source-controller, loki, k9s, opentofu, kyverno, argo-cd, terraform, opentelemetry-collector-contrib,...

GO-2026-6354 vulnerabilities

Vulnerabilities for packages: apko, external-dns, prometheus-operator, chisel, pulumi-language-yaml, zarf, osv-scanner, kubevela, scorecard, containerd, grype, zot, tfsec, grafana-alloy, flux-source-controller, loki, k9s, opentofu, kyverno, argo-cd, terraform, opentelemetry-collector-contrib,...

AZL-99225 CVE-2026-78662 affecting package gh 2.98.0-1

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

AZL-99222 CVE-2026-56855 affecting package gh 2.98.0-1

Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connectio...

Security update for gh (important)

openSUSE Security Update: Security update for gh Announcement ID: openSUSE-SU-2026:0309-1 Rating: important References: 1266618 Cross-References: CVE-2026-39821 CVE-2026-64652 CVE-2026-64653 CVE-2026-64654 CVE-2026-64655 CVSS scores: CVE-2026-39821 SUSE: 9.1...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:21663-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21663-1 advisory. Changes in gh: - Update to version 2.98.0: chore: fix extra whitespace Default Codespaces port forwarding to loopback Bump gh-aw-actions to...

CVE-2026-81100

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81100

tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...

EUVD-2026-67028

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

PT-2026-82573

Name of the Vulnerable Software and Affected Versions tiger-gh-mcp-server versions prior to the commit that implemented the fix Description The MCP HTTP transport was started without enabling the host allow-list provided by the underlying SDK. Specifically, the httpServer.ts file called the...

Security update for gh (important)

openSUSE security update: security update for gh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21663-1 Rating: important References: bsc1266618 bsc1276661 bsc1276662 bsc1276663 bsc1276664 Cross-References: CVE-2026-39821 CVE-2026-64652...

Binding to an Unrestricted IP Address

Overview github.com/cli/cli/cmd/gh is a GitHub on the command line. It brings pull requests, issues, and other GitHub concepts to the terminal next to where you are already working with git and your code. Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address...