30604 matches found
CVE-2024-58354
cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...
OPENSUSE-SU-2026:21432-1 Security update for gh
This update for gh fixes the following issues: Changes in gh: - CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package regardless of Go's unicode.Version boo1266618...
CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow
cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...
CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow
cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...
CVE-2024-58354
Cal.com (cal.com/cal.diy) is affected by a repository takeover via its GitHub Actions workflow. The pr.yml workflow uses pull_request_target and passes repo default write permissions to check-types.yml, which then dangerous-checks out the attacker PR and executes it (yarn install, package.json sc...
CVE-2026-65900
creationtimestamp| type| source ---|---|--- 2026-07-23 16:35:23+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-gvmj-g25r-r7wr...
CVE-2026-65898
creationtimestamp| type| source ---|---|--- 2026-07-23 14:35:05+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-cmwh-pvxp-8882...
PYSEC-2026-3509 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...
OpenEMR < 7.0.1 - Cross-Site Scripting
Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2948 info: name: OpenEMR 7.0.1 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...
PT-2026-64180
Name of the Vulnerable Software and Affected Versions cal.com main branch Description A repository takeover issue exists in the GitHub Actions workflows. The pr.yml workflow utilizes the pull request target trigger with default write permissions, which are passed to check-types.yml. This second...
CVE-2026-55554
creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:26+00:00| published-proof-of-concept| https://github.com/dompdf/dompdf/security/advisories/GHSA-wvh6-f5jh-8gw4...
GO-2026-6026 File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) in github.com/filebrowser/filebrowser
File Browser: Archive builder turns backslash filenames into path traversal zip-slip in github.com/filebrowser/filebrowser...
GHSA-5GVW-P9QM-JGWH vulnerabilities
Vulnerabilities for packages: apicurio-registry, ruby3.2-jrjackson, strimzi-kafka-operator, zookeeper, tez, gradle, infinispan, keycloak-config-cli, confluent-kafka, cassandra, apache-tika, wavefront-proxy, akhq, ruby3.3-jrjackson...
GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier
Beginning July 27, 2026, GitHub will cut public bug bounty payouts by at least half at every severity level. Critical findings will drop from $20,000-$30,000+ to a fixed $10,000, while its permanent invite-only VIP tier will pay $30,000 or more. Reports filed before that date, including those...
GHSA-JJJ6-MW9F-P565 vulnerabilities
Vulnerabilities for packages: openstack-horizon-2025.2-fips, superset, openstack-horizon-2026.1-fips, mlflow, open-webui, openstack-horizon-2026.1, text-generation-inference, openstack-horizon-2025.2, tensorflow-gpu-jupyter...
PT-2026-64055
These are all security issues fixed in the gh-2.96.0-2.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-58436
creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:50+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-fw57-jgch-pgf3...
CVE-2026-44788
creationtimestamp| type| source ---|---|--- 2026-07-21 22:36:48+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-6c8g-7p36-r338...