GitHarvest3r

Simple CVE exploit gathering tool written in python. Installation git clone https://github.com/34zY/GitHarvest3r cd GitHarvest3r/ pip install -r requirements.txt Setup API Key 1. Get your Free Github API Key = 2. Set it in TOKEN variable ; GitHarvest3r.py Usage python GitHarvest3r.py -s python...

CVE-2026-112338

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module wmgithub.c that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts,...

CVE-2026-112338 Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module wmgithub.c that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts,...

CVE-2026-112338 Wazuh from 4.3.0 before 4.14.9 SSRF via GitHub Module Link Pagination

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module wmgithub.c that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts,...

EUVD-2026-118281

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module wmgithub.c that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts,...

CVE-2026-112338

Wazuh versions 4.3.0 through 4.14.8 are vulnerable to a Server-Side Request Forgery (SSRF) in the GitHub module (wm_github.c ). The root cause is the application trusting unvalidated Link rel="next" pagination URLs. An attacker who controls the next-page URL can force the manager to send requests...

CVE-2026-112338: wazuh: Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c)…

Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module wmgithub.c that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token to attacker hosts,...

GithubC2

GithubC2 Github as C2 Demonstration , free API = free C2 Infrastructure Demo https://user-images.githubusercontent.com/110354855/192076474-3c1884f8-4a59-4944-b0d6-9dc59c7692f0.mp4...

gitcolombo

Gitcolombo Herramienta OSINT que extrae identidades — nombres, correos electrónicos y enlaces entre cuentas aparentemente no relacionadas — de repositorios git y GitHub. CLI de Python gitcolombo.py — clona repos, recorre git log y puede llamar a la API de GitHub para señales más ricas. Versión we...

GHSA-M62C-5Q34-F3CF Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Summary Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API...

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Summary Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API...

EUVD-2026-87369

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token...

CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-57449

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When "ACTUALGITHUBTOKEN" is configured, the proxy automatically attaches the...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449

The Actual Sync Server (prior to version 26.7.0 ) is vulnerable to a CORS proxy allowlist bypass. When ACTUAL_GITHUB_TOKEN is configured, the server's CORS proxy uses a raw startsWith() prefix test to validate GitHub repositories against an official plugin allowlist. Because the check fails to re...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-57449: Exposure of Sensitive Information to an Unauthorized Actor

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...