CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

MAL-2026-15631 Malicious code in nextjsupdater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca The package masquerades as a Next.js updater but its exported downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub...

CVE-2026-19410

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

CVE-2026-82856 @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

CVE-2026-82856

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. The root cause is the insufficient handling of operators such as ForAnyValue:StringLike , which attackers can exploit to hide wildcard GitHub Actions OIDC subj...

CVE-2026-82856 @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

EUVD-2026-68444

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

EUVD-2026-68433

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

CVE-2026-19410 Google Cloud Build Comment Control Bypass via Webhook Suppression

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

CVE-2026-19410

Google Cloud Build on GCP contains an Incorrect Authorization flaw in its GitHub Trigger Comment Control feature. Prior to 24 June 2026, a remote attacker with low privileges could use webhook suppression to bypass comment-based authorization and execute unreviewed code in the build environment. ...

CVE-2026-72924

A flaw was found in GitHub CLI. The gh codespace ports forward command, by default, exposes forwarded services on all local network interfaces. This allows a network-adjacent attacker to access these services through the user's machine while port forwarding is active, even if the original...

android-security-awesome — Updated!

android-security-awesome A collection of Android security-related resources. If you find this project useful, please consider supporting it. 1. Tools 2. Academic/Research/Publications/Books 3. Exploits/Vulnerabilities/Bugs Tools Online Analyzers 1. Appknox - not free 2. Virustotal 3. NowSecure La...

CVE-2026-53507: Exposure of Sensitive Information to an Unauthorized Actor

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

PT-2026-83968

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-19410: Time-of-check Time-of-use (TOCTOU) Race Condition

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and...

CVE-2026-81499

GHSA-6v6x-387m-rj4w: Project restriction bypass on network address sets...

CVE-2026-82856: Improper Access Control

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...

GHSA-P6GQ-J5CR-W38F

creationtimestamp| type| source ---|---|--- 2026-08-30 21:00:04+00:00| seen| https://t.me/GithubRedTeam/100406 2026-08-31 00:00:08+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/100406...

CVE-2026-67363

creationtimestamp| type| source ---|---|--- 2026-08-30 21:00:04+00:00| seen| https://t.me/GithubRedTeam/100404 2026-08-31 00:00:08+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/100404 2026-09-02 01:00:15+00:00| seen| Telegram/1rxP3qIuireobzlbCghqLtlBEvOO40pQENYobB1-OKe51is...