CVE-2022-3292

Use of Cache Containing Sensitive Information in GitHub repository ikus060/rdiffweb prior to 2.4.8...

CVE-2022-2290

Cross-site Scripting XSS - Reflected in GitHub repository zadam/trilium prior to 0.52.4, 0.53.1-beta...

CVE-2022-3456

Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0...

CVE-2022-3250

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6...

CVE-2022-0405

Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16...

CVE-2022-0950

Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4...

CVE-2022-0954

Multiple Stored Cross-site Scripting XSS Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11...

CVE-2022-0820

Cross-site Scripting XSS - Stored in GitHub repository orchardcms/orchardcore prior to 1.3.0...

CVE-2022-24813

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the master branch of CreateWiki's GitHub repository...

CVE-2022-2300

Cross-site Scripting XSS - Stored in GitHub repository microweber/microweber prior to 1.2.19...

CVE-2021-3967

Improper Access Control in GitHub repository zulip/zulip prior to 4.10...

CVE-2021-4103

Cross-site Scripting XSS - Stored in GitHub repository vanessa219/vditor prior to 1.0.34...

CVE-2021-4043

NULL Pointer Dereference in GitHub repository gpac/gpac prior to 1.1.0...

CVE-2019-14957

The JetBrains Vim plugin before version 0.52 was storing individual project data in the global vimsettings.xml file. This xml file could be synchronized to a publicly accessible GitHub repository...

Cross-site Scripting (XSS)

github.com/lf-edge/ekuiper is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input sanitization due to injection of malicious scripts in the confKey parameter of the Connection Configuration, which are executed in the browser when accessed by another user...

GO-2025-3684 Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm

Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm...

GO-2025-3688 Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil

Yggdrasil Vulnerable to Local Privilege Escalation in github.com/redhatinsights/yggdrasil...

GO-2025-3686 Babylon Finality Provider `MsgCommitPubRandList` replay attack in github.com/babylonlabs-io/babylon

Babylon Finality Provider MsgCommitPubRandList replay attack in github.com/babylonlabs-io/babylon...

GO-2025-3680 OPKSSH Vulnerable to Authentication Bypass in github.com/openpubkey/opkssh

OPKSSH Vulnerable to Authentication Bypass in github.com/openpubkey/opkssh...

Developer Leaks API Key for Private Tesla, SpaceX LLMs

In AI, as with so many advancing technologies, security often lags innovation. The xAI incident, during which a sensitive API key remained exposed for nearly two months, is a stark reminder of this disconnect. Such oversights not only jeopardize proprietary technologies but also highlight systemi...