GHSA-53R2-MQ99-F532

creationtimestamp| type| source ---|---|--- 2026-09-01 20:01:33+00:00| seen| https://t.me/hackingAttack/63081 2026-09-02 01:01:43+00:00| seen| https://t.me/hackingAttack/63081 2026-09-05 14:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/63081 2026-09-06 00:00:44+00:00|...

GHSA-VVXF-F8Q9-86GH

creationtimestamp| type| source ---|---|--- 2026-09-01 20:00:11+00:00| seen| https://t.me/hackingAttack/184244 2026-09-02 01:00:27+00:00| seen| https://t.me/hackingAttack/184244 2026-09-03 00:00:36+00:00| published-proof-of-concept| https://t.me/hackingAttack/184244...

CVE-2026-73089

creationtimestamp| type| source ---|---|--- 2026-09-01 18:35:04+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-c83g-rgw3-j3cx 2026-09-05 16:13:11+00:00| seen| https://gist.github.com/djlan/e3b6762435f262eb64ea25ec3f8c9d82 2026-09-05 16:19:59+00:00| seen|...

allstar v4.6

Allstar !IMPORTANT The OpenSSF-hosted Allstar GitHub App has been retired. Allstar, the OpenSSF Scorecard subproject, itself continues to be maintained — you must now run it yourself, either as a GitHub Action or as a service daemon. See ossf/allstar881 for more details. If your organization was...

[SECURITY] [DLA 4734-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4734-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard August 12, 2026 https://wiki.debian.org/LTS -...

zizmor v1.30.0

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

PT-2026-84531

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A time-of-check time-of-use TOCTOU race condition—a scenario where a system checks the state of a resource before using it, but the state changes between the check and the use—allows...

CVE-2026-19118: Time-of-check Time-of-use (TOCTOU) Race Condition

A time-of-check time-of-use race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution. Exploitation required an authenticated user with write access to a repository and precise timing of concurrent upload requests. This vulnerability affected all...

CVE-2026-76851: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...

CVE-2026-18730: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause the Manage API to send crafted outbound requests to an attacker-controlled host. An unauthenticated endpoint parsed an attacker-supplied cluster...

PT-2026-84532

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A Server-Side Request Forgery SSRF issue exists where insufficient network isolation allows malicious pre-receive hook code to impersonate an internal service. This enables the...

PT-2026-84530

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A server-side request forgery SSRF issue exists in the Manage API, allowing an unauthenticated attacker to force the server to send crafted outbound requests to a host under their...

CVE-2026-68941

creationtimestamp| type| source ---|---|--- 2026-08-31 22:35:04+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72...

CVE-2026-81889

creationtimestamp| type| source ---|---|--- 2026-08-31 21:09:21+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mufsvnvr7u2v 2026-08-31 22:35:02+00:00| published-proof-of-concept| https://github.com/Studio-42/elFinder/security/advisories/GHSA-8x3q-jpjh-qh5c...

CVE-2026-53507

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

EUVD-2026-68729

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-53507

oasdiff-action , a GitHub Action that detects breaking changes in OpenAPI specs and posts reviews on pull requests, contained a flaw prior to version 0.0.51 where external $refs in the spec were resolved by default (allow-external-refs: true). On a fork pull request in a public repository, an att...

CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...