CVE-2026-82289

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-82289

Gitingest (through 0.3.1 ) has a flaw in its _validate_host function that accepts any hostname with a git. , gitlab. , or github. prefix without verifying membership in a known-hosts list. An attacker can supply a URL with a crafted hostname (e.g., github.evil.com), causing the application to ope...

CVE-2026-82289 Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-82282

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

EUVD-2026-67813

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282

Atlantis (through version 0.47.1 ) contains an authentication bypass in the /github-app/setup endpoint. The endpoint fails to require authentication, allowing unauthenticated callers to observe or intercept the GitHub redirect during app setup and extract the RSA private key and webhook secret . ...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

GHSA-Q6FP-RFWR-759P

creationtimestamp| type| source ---|---|--- 2026-08-28 15:25:39+00:00| seen| https://gist.github.com/abhi04anon/8ce0b68a5a7dda8a0501cbaf933173eb...

CVE-2026-77177

creationtimestamp| type| source ---|---|--- 2026-08-28 15:25:39+00:00| seen| https://gist.github.com/abhi04anon/8ce0b68a5a7dda8a0501cbaf933173eb 2026-09-29 22:07:10+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mwotnqy3rw2f...

GHSA-RGW5-RVV9-X895

creationtimestamp| type| source ---|---|--- 2026-08-28 09:36:02+00:00| seen| https://gist.github.com/konard/4ba388beb31caacd09fbc15019f8e274 2026-09-03 19:24:36+00:00| seen| https://gist.github.com/konard/05d19a59942ef51514e30abcc55dbc13 2026-09-03 20:24:38+00:00| seen|...

CVE-2026-56100

creationtimestamp| type| source ---|---|--- 2026-08-28 08:28:59+00:00| seen| https://gist.github.com/sud0why/e73405057dd7414a8c221ef17e0d0059 2026-08-29 12:48:14+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mu7vxqhwb622 2026-08-29 17:03:34+00:00| seen|...

GHSA-M452-Q8C9-RG2F vulnerabilities

Vulnerabilities for packages: pinot, apache-pulsar-fips, druid, tez, pinot-fips, apache-pulsar...

GHSA-GVRW-QQP5-JGC5

creationtimestamp| type| source ---|---|--- 2026-08-28 02:33:07+00:00| seen| https://gist.github.com/alon710/6538c11be757e60d0a7d8025d09bf775...

GHSA-R5PM-VRC5-3M73

creationtimestamp| type| source ---|---|--- 2026-08-28 01:31:29+00:00| seen| https://gist.github.com/alon710/95bf554559835da78ddd9ef64b2fd7a2...

CVE-2026-54713

creationtimestamp| type| source ---|---|--- 2026-08-28 01:31:29+00:00| seen| https://gist.github.com/alon710/95bf554559835da78ddd9ef64b2fd7a2...

CVE-2026-55558

creationtimestamp| type| source ---|---|--- 2026-08-28 00:31:38+00:00| seen| https://gist.github.com/alon710/a5f4630118da96558b479a90bb02c09c...

CVE-2026-55378: Improper Neutralization of Special Elements used in an OS Command

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

PT-2026-83240

Name of the Vulnerable Software and Affected Versions JS Recon versions 1.2.1-beta.1 through 1.3.1-beta.1 Description The PR Branch Checker workflow in .github/workflows/pr checker.yml improperly handles untrusted values. Specifically, the github.head ref and github.event.pull...