CVE-2026-82856

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. The root cause is the insufficient handling of operators such as ForAnyValue:StringLike , which attackers can exploit to hide wildcard GitHub Actions OIDC subj...

CVE-2026-82856 @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

EUVD-2026-68444

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

MSC-2026-11522

Active npm supply chain compromise of @7nohe/openapi-react-query-codegen 150,000 weekly downloads, linked to the ongoing Mini Shai-Hulud campaign. An unprotected GitHub Actions release workflow let any account publish fork contents under the repository's trusted-publishing identity, producing ten...

Embedded Malicious Code

Overview @7nohe/openapi-react-query-codegen is an OpenAPI React Query Codegen Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a destructive worm and credential harvester. A malicious actor exploited a comment-triggered GitHub Actions workflow by commentin...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

EUVD-2026-67859

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. In versions 1.2.1-beta.1 through 1.3.1-beta.2 , the PR Branch Checker workflow in .github/workflows/pr_checker.yml interpolates untrusted values (github.head_ref and github.event.pull_request.head.repo.full_name) directly into a shell gh pr comm...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378: Improper Neutralization of Special Elements used in an OS Command

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

PT-2026-83240

Name of the Vulnerable Software and Affected Versions JS Recon versions 1.2.1-beta.1 through 1.3.1-beta.1 Description The PR Branch Checker workflow in .github/workflows/pr checker.yml improperly handles untrusted values. Specifically, the github.head ref and github.event.pull...

CVE-2026-76847 act 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

gha-oidc-auditor

gha-oidc-auditor !Licensehttps://img.shields.io/badge/lic...

devsecops-poc-workflows

Laboratorio público DevSecOps Código sintético y educativ...

CVE-2026-63187

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...