34883 matches found
PT-2026-83305
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...
CVE-2026-82282: Missing Authentication for Critical Function
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...
CVE-2026-82289: Server-Side Request Forgery (SSRF)
Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...
CVE-2026-54770
creationtimestamp| type| source ---|---|--- 2026-08-27 23:33:29+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:01:48+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:35:03+00:00| published-proof-of-concept|...
GHSA-Q7M3-RHXG-7VXR
creationtimestamp| type| source ---|---|--- 2026-08-27 22:31:50+00:00| seen| https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8 2026-08-28 00:01:49+00:00| seen| https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8...
CVE-2026-54687
creationtimestamp| type| source ---|---|--- 2026-08-27 22:31:50+00:00| seen| https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8 2026-08-28 00:01:49+00:00| seen| https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8...
GHSA-G7GW-M874-7RMF
creationtimestamp| type| source ---|---|--- 2026-08-27 21:32:59+00:00| seen| https://gist.github.com/alon710/14e4e76cd8061b293a52482e75942e6f...
GHSA-39MM-RWM3-29JP
creationtimestamp| type| source ---|---|--- 2026-08-27 20:32:16+00:00| seen| https://gist.github.com/alon710/bec19cdcf2926727440026551fd338c7...
CVE-2026-54718
creationtimestamp| type| source ---|---|--- 2026-08-27 20:32:16+00:00| seen| https://gist.github.com/alon710/bec19cdcf2926727440026551fd338c7...
CVE-2026-54732
creationtimestamp| type| source ---|---|--- 2026-08-27 19:31:53+00:00| seen| https://gist.github.com/alon710/795619632fe9ba16f51e5c93358e8801...
GHSA-GMXC-R82Q-347R
creationtimestamp| type| source ---|---|--- 2026-08-27 19:31:53+00:00| seen| https://gist.github.com/alon710/795619632fe9ba16f51e5c93358e8801...
CVE-2026-54721
creationtimestamp| type| source ---|---|--- 2026-08-27 17:32:22+00:00| seen| https://gist.github.com/alon710/39b101902c398808f3c4258d20b82798...
pansyhebephrenic23.github.io
Questo repository non contiene un README...
CVE-2026-81100
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
CVE-2026-81100
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
EUVD-2026-67028
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
CVE-2026-81100
tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...