CVE-2026-43979

creationtimestamp| type| source ---|---|--- 2026-05-09 11:08:19+00:00| published-proof-of-concept| https://github.com/LearningCircuit/local-deep-research/security/advisories/GHSA-fj2m-qvh9-jq4q...

CVE-2026-45316

creationtimestamp| type| source ---|---|--- 2026-05-09 08:02:53+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-jx2x-j75f-xq3j...

CVE-2026-45311

creationtimestamp| type| source ---|---|--- 2026-05-09 04:06:06+00:00| published-proof-of-concept| https://github.com/Hmbown/DeepSeek-TUI/security/advisories/GHSA-wx44-2q6h-j6p8 2026-05-28 19:00:51+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmwpgfojvr2c 2026-05-28...

CVE-2026-45310

creationtimestamp| type| source ---|---|--- 2026-05-09 04:05:43+00:00| published-proof-of-concept| https://github.com/Hmbown/DeepSeek-TUI/security/advisories/GHSA-96ff-gc8g-wpvg...

GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: rabbitmq-cluster-operator, helm-operator, authservice, calico, nfpm, delve, cert-exporter, cloudnative-pg, argo-cd, harbor, victoriametrics-cluster, node-problem-detector, aactl, crossplane, kbld, croc, secrets-store-csi-driver-provider-azure, sftpgo-plugin-pubsub,...

CVE-2026-42298

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...

CVE-2026-42298

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...

CVE-2026-42298

CVE-2026-42298 affects Postiz (AI social media scheduling tool). The issue arises in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml), where an unauthenticated user can cause arbitrary code execution during Docker image build by submitting a fork with a malic...

CVE-2026-42298 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...

GHSA-H9HM-M2XJ-4RQ9

creationtimestamp| type| source ---|---|--- 2026-05-08 20:10:29+00:00| seen| https://gist.github.com/alon710/b2fb36b6ecfecf3424b0cb12c54264f5...

GHSA-MPM8-CX2P-626Q

creationtimestamp| type| source ---|---|--- 2026-05-08 19:10:29+00:00| seen| https://gist.github.com/alon710/81381888e21682cdeae4882d5cd6667d...

GHSA-95C3-6VVW-4MRQ MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience

SECURITY registry001 Vulnerability Report While analyzing the code logic, an area that may lead to unintended behavior under specific conditions was discovered. Overview - Verified Version: c5c4b9e8890dd5754bee889b2f1417f4fe3b5ce5 - Vulnerability Type: Authentication bypass via cross-registry OID...

CVE-2026-44334

PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAIALLOWLOCALTOOLS=true in two files toolresolver.py, api/call.py. A third import sink in praisonai/templates/tooloverride.py was missed and remains...

GHSA-XX64-WWV2-HCQQ vulnerabilities

Vulnerabilities for packages: pixi, uv...

GHSA-FP55-JW48-C537 vulnerabilities

Vulnerabilities for packages: pixi, uv...

GHSA-PP6C-GR5W-3C5G vulnerabilities

Vulnerabilities for packages: semgrep, airflow, reflex...

GHSA-2C5C-CHWR-9HQW vulnerabilities

Vulnerabilities for packages: opensearch, spark-kubernetes-operator-fips, spark, camunda-zeebe, apache-hop-fips, druid, spark-fips, camunda, spark-kubernetes-operator, apache-hop, trino...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

GHSA-P3HW-MV63-RF9W vulnerabilities

Vulnerabilities for packages: cargo-audit, jujutsu...

GHSA-P334-GFHQ-C7W6 vulnerabilities

Vulnerabilities for packages: jenkins...