securitylab

GitHub Security Lab 这是 GitHub Security Lab 的主要 Git 仓库。 我们将其用于以下主要目的： 在我们的 docs 中与社区分享关于安全研究和漏洞披露的最佳实践。 我们使用 此仓库的 issues 来跟踪 CodeQL 赏金请求。 我们用它来发布一些概念验证漏洞利用（在漏洞修复后）。这些 PoC 可以在 SecurityExploits 子目录中找到。 CodeQL 查询示例，可以在 CodeQLQueries 子目录中找到。 CodeQL 资源 这部分是你们的！ 你想与社区分享一个很酷的 CodeQL...

allstar

Allstar !IMPORTANT 由 OpenSSF 托管的 Allstar GitHub App 已退役。 Allstar 作为 OpenSSF Scorecard 子项目，其本身仍在持续维护中——您现在必须自行运行它，可以 作为 GitHub Action 或 作为服务守护进程 运行。 更多详情请参阅 ossf/allstar881。 如果您的组织一直依赖托管应用，请参阅 从托管应用迁移。 概述 什么是 Allstar？ Allstar 的新功能 whats-new.md 禁用不需要的问题 救命！Allstar 创建了我不想要的问题！ 入门指南 背景 组织级选项 安装选项 创建您...

gitxray

欢迎使用Gitxray Gitxray（Git X-Ray的简称）是一款多功能的GitHub仓库安全工具。它可用于多种用途，包括开源情报（OSINT）和取证分析。gitxray利用公开的GitHub REST API收集原本需要大量手动获取的信息。此外，它还能从非常规位置挖掘信息。 使用场景 Gitxray可用于例如： 在贡献者个人资料中查找意外泄露的敏感信息，例如Armored PGP密钥或密钥名称。 识别仓库中的威胁行为者。可以发现共同拥有或共享的账户，并检查公开事件以发现虚假的标星者。 识别虚假或受感染的仓库。它可以检测被篡改的提交日期，例如发布后更新的发布资产。...

Reposilite >= 3.3.0, < 3.5.12 - Arbitrary File Read

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

ROOT-APP-NPM-GHSA-WQVQ-JVPQ-H66F GHSA-wqvq-jvpq-h66f in nodemailer - Patched by Root

Root has patched GHSA-wqvq-jvpq-h66f in the nodemailer package for Root:npm. Multiple fixed versions available...

Autonomous OSS Threat Detection Via Taxonomy-Aligned LLMs

Open source software OSS ecosystems face growing threats from sophisticated supply chain attacks including typosquatting, dependency confusion, Trojan Source obfuscation, malicious build injection, and CI/CD pipeline poisoning. Existing detection approaches rely on signature-based tools and...

How we found 24 Android vulnerabilities using our open source AI security agent

With the rise of AI in the security space, our team created the GitHub Security Lab Taskflow Agent as a way for security researchers to easily automate, package, and share the AI prompts and workflows that they find effective for their work. In this blog post, I'll share how I created auditing...

GHSA-5V7R-6R5C-R473

creationtimestamp| type| source ---|---|--- 2026-09-20 15:56:42+00:00| seen| https://gist.github.com/konard/4ad360f50626a30518f6308cbbc7cf43 2026-09-29 17:44:54+00:00| seen| https://gist.github.com/konard/e68bf0eca84e532b124333812dc61bdf 2026-09-29 18:32:30+00:00| seen|...

CVE-2026-72701

creationtimestamp| type| source ---|---|--- 2026-09-17 22:35:34+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-38p6-h87p-r4cg...

CVE-2026-69147

creationtimestamp| type| source ---|---|--- 2026-09-17 18:35:09+00:00| published-proof-of-concept| https://github.com/vllm-project/vllm/security/advisories/GHSA-8pw2-6jv3-mj5j...

GHSA-7GCF-G7XR-8HXJ

creationtimestamp| type| source ---|---|--- 2026-09-16 08:42:54+00:00| seen| https://gist.github.com/konard/c75c144385121c66aab9af215012c487 2026-10-03 08:03:43+00:00| seen| https://gist.github.com/citadelculture/7a9642cc5c961c85323065559272c000...

GHSA-V859-C572-QH5P

creationtimestamp| type| source ---|---|--- 2026-09-14 22:32:03+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3 2026-09-15 00:00:09+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3...

GHSA-2883-XCG3-V3HH

creationtimestamp| type| source ---|---|--- 2026-09-13 23:02:40+00:00| seen| https://gist.github.com/konard/3df64f94bedef28845e3787306d32d25 2026-09-14 00:01:28+00:00| seen| https://gist.github.com/konard/3df64f94bedef28845e3787306d32d25 2026-09-15 12:45:46+00:00| seen|...

GHSA-38XV-HF3P-H7MQ

creationtimestamp| type| source ---|---|--- 2026-09-11 11:32:31+00:00| seen| https://gist.github.com/alon710/31db43b5866ca861d12e36661fc88337...

CVE-2026-88017

creationtimestamp| type| source ---|---|--- 2026-09-11 00:35:23+00:00| published-proof-of-concept| https://github.com/rclone/rclone/security/advisories/GHSA-c476-6w5q-jw77 2026-09-11 11:09:30+00:00| seen| https://gist.github.com/alon710/bdeb340c6c170113e47b6e3cbfb5203b 2026-09-11 16:00:46+00:00|...

CVE-2026-88060

creationtimestamp| type| source ---|---|--- 2026-09-10 22:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv72xhjqk72f 2026-09-10 22:35:14+00:00| published-proof-of-concept| https://github.com/angular/angular/security/advisories/GHSA-v3p8-whq6-r5jg...

GHSA-5293-FCM6-FH8V

creationtimestamp| type| source ---|---|--- 2026-09-10 09:00:06+00:00| seen| https://t.me/GithubRedTeam/101902 2026-09-10 23:00:04+00:00| seen| Telegram/IahIDovOHUenK705G5amLwAL2bDi62zGVyXyTFrKtdPZaM 2026-09-11 00:00:09+00:00| published-proof-of-concept|...

GHSA-RVX4-FFVW-M9Q3

creationtimestamp| type| source ---|---|--- 2026-09-09 14:32:49+00:00| seen| https://gist.github.com/alon710/a3c9901fd3145b4f83e29fe00422ecb3 2026-09-15 15:00:05+00:00| seen| https://t.me/bdufstecru/3440 2026-09-16 00:00:29+00:00| published-proof-of-concept| https://t.me/bdufstecru/3440...

GHSA-2X7J-588G-CCC2

creationtimestamp| type| source ---|---|--- 2026-09-09 00:32:15+00:00| seen| https://gist.github.com/alon710/bd83a6e5a1c5d7e3eb1a208578e25c78...

GHSA-WMMP-3585-3RMP

creationtimestamp| type| source ---|---|--- 2026-09-08 23:32:32+00:00| seen| https://gist.github.com/alon710/5d16343ca1e4ea17a35c27f6e94b12c6 2026-09-09 00:00:05+00:00| seen| https://gist.github.com/alon710/5d16343ca1e4ea17a35c27f6e94b12c6...