CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897

A flaw in Gitea allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job APIs . An attacker could exploit this vulnerability to gain unauthorized access to sensitive information across different repositories. To mitigate this risk, you can globally disable G...

EUVD-2026-58149

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57897 Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

CVE-2026-57886 Cross-repository issue/comment attachment re-linking can expose private attachment content

Cross-repository issue/comment attachment re-linking can expose private attachment content...

EUVD-2026-58142

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

What 50 open source projects taught us about security in the AI era

AI is changing the pace of open source development and the security challenges that come with it. Maintainers are reviewing unfamiliar contributions, managing new attack surfaces, and responding to vulnerabilities with limited time and resources. Session 4 of the GitHub Secure Open Source Fund...

How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign

A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign...

zizmor v1.30.0-rc1

🌈 zizmor zizmor is a static analysis tool for CI/CD systems. It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. Some of the things zizmor finds: Template injection vulnerabilities, leading to attacker-controlled code execution...

CVE-2026-30965

creationtimestamp| type| source ---|---|--- 2026-08-13 09:00:07+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-30965.yaml 2026-08-14 00:00:09+00:00| confirmed|...

PT-2026-71699

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The API scope middleware incorrectly classifies the 'GET /api/v1/user/actions/runners/registration-token' endpoint, as well as its owner- and repository-level...

CVE-2026-73425

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-hp3v-mfqw-h74c...

CVE-2026-73306

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:36+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-cr7p-cr3q-h5cm...

CVE-2026-73410

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:06+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-v42f-v8xc-j435...

CVE-2026-55071

creationtimestamp| type| source ---|---|--- 2026-08-12 20:35:03+00:00| published-proof-of-concept| https://github.com/SepineTam/mcp-for-stata/security/advisories/GHSA-49m4-vp58-wgc9...

GHSA-PFVM-W89X-94JW

creationtimestamp| type| source ---|---|--- 2026-08-12 20:31:49+00:00| seen| https://gist.github.com/alon710/05e3ea6ef79e0a47d082b88eec33ae87...

[SECURITY] [DSA 6434-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6434-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff August 12, 2026 https://www.debian.org/security/faq -...

CVE-2026-47132

creationtimestamp| type| source ---|---|--- 2026-08-12 16:35:05+00:00| published-proof-of-concept| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w...

CVE-2026-11325

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...

CVE-2026-11325 cloudflare/pages-action is deprecated — migration required by September 18th, 2026

Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue in src/index.ts reachable from certain GitHub Actions workflow configurations. Successful exploitation may expose workflow secrets such as...