GHSA-MPMW-F6H6-3G26

creationtimestamp| type| source ---|---|--- 2026-08-21 12:31:52+00:00| seen| https://gist.github.com/alon710/67db9159d1345bdc7ca8782a080ca880...

GHSA-FM29-4MQ3-PHG6

creationtimestamp| type| source ---|---|--- 2026-08-21 11:33:52+00:00| seen| https://gist.github.com/alon710/35dc9a9f4fdde910b87a4f845467f8ee...

GHSA-5CWR-5JXG-PCF6

creationtimestamp| type| source ---|---|--- 2026-08-21 10:32:44+00:00| seen| https://gist.github.com/alon710/51fb54a21f3c76c1b91209b9a15704de...

GHSA-P2CH-C2C3-4XM5

creationtimestamp| type| source ---|---|--- 2026-08-21 09:04:13+00:00| seen| https://gist.github.com/alon710/8e50b2fdebb434d200c6fb50163d57dd...

GHSA-HQ84-X37P-J6Q5

creationtimestamp| type| source ---|---|--- 2026-08-21 08:35:07+00:00| seen| https://gist.github.com/alon710/4c9a95ca17a175b6a01393b89f2d4adf...

CVE-2026-55410

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:18+00:00| published-proof-of-concept| https://github.com/nocobase/nocobase/security/advisories/GHSA-p853-83gj-wjj3...

CVE-2026-61798

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:10+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-2mc4-j865-9q4r...

CVE-2026-72861

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

devsecops-poc-workflows

Laboratorio público DevSecOps Código sintético y educativ...

EUVD-2026-63579

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861

In Appwrite templates' github-issue-bot, verifyWebhook uses an inverted condition (typeof signature !== 'string' || (await verify(...))) that short-circuits to success when the X-Hub-Signature-256 header is absent, skipping HMAC verification. Unauthenticated callers can then post arbitrary commen...

GHSA-6F2P-296R-CC28 Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

Tekton Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Impact When Pipelines-as-Code is configured with a GitHub App installed across multiple repositories, the installation token issued during webhook processing is not scoped to the triggering repository by default. The token retains access to all repositories in the GitHub App installation. This...

GHSA-F5F4-3HH4-F54M Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Impact Pipelines-as-Code installations using the GitHub App provider are vulnerable to GitHub App credential exfiltration through the webhook endpoint. Affected versions accepted the X-GitHub-Enterprise-Host request header as the GitHub Enterprise API host during GitHub App token generation. For...

Malicious Package

Overview mcp-server-github is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-79116

Name of the Vulnerable Software and Affected Versions appwrite/templates affected versions not specified Description The github-issue-bot templates contain a logic error in the GitHub webhook signature verification process. The verifyWebhook function in node/github-issue-bot/src/github.js and...