CVE-2026-54160: Inclusion of Functionality from Untrusted Control Sphere

Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. Prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was...

PT-2026-99929

Name of the Vulnerable Software and Affected Versions Network UPS Tools affected versions not specified Description A GitHub Actions script used to prepare tarballs and update GitHub Checks statuses and PR comments was mis-structured. The script mixed code running with higher privileges,...

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper...

MemoryOS 2.0.34 was published with a credential-stealing binary

An attacker with write access to the GitHub repository pushed maliciouscommits and tagged v2.0.34, and the project's own GitHub Actions releaseworkflow built and uploaded 2.0.34 to PyPI.Importing the package runs memos/stage0.py, which launchesa bundled sckit binary that collects...

PYSEC-2026-3987 MemoryOS 2.0.34 was published with a credential-stealing binary

An attacker with write access to the GitHub repository pushed malicious commits and tagged v2.0.34, and the project's own GitHub Actions release workflow built and uploaded 2.0.34 to PyPI. Importing the package runs memos/stage0.py, which launches a bundled sckit binary that collects credentials...

Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows | Cloud Foundry

Severity CVSSv3.1 | 9.8 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ---|--- Vendor CloudFoundry Foundation Versions Affected The Cloud Foundry build infrastructure was affected. The Cloud Foundry product is not affected. Description GitHub Actions workflows were configured to trigger on pullrequesttarg...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

EUVD-2026-83981

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-54916

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-54752

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

EUVD-2026-82414

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-54916 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-54916 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-54752 NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

CVE-2026-54752 NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

CVE-2026-54752 NetBox Device Type Library: Insecure Pickle Deserialization in Test Suite Allows Remote Code Execution via Malicious Pull Request

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

EUVD-2026-82413

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

CVE-2026-54752

NetBox Device Type Library is a community-sourced collection of device type definitions for import into NetBox. The vulnerability resides in the read_pickle_data function within tests/pickle_operations.py, which uses pickle.load to deserialize pull-request-controlled tracked pickle cache files. A...

PT-2026-95096

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An issue exists where the absence of tests/init.py and the lack of --import-mode=importlib cause pytest to place the tests directory at the front of sys.path during...

CVE-2026-54916: Uncontrolled Search Path Element

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...