Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the backup process. An attacker can obtain sensitive account credentials and configuration secrets by...

External Control of File Name or Path

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

GHSA-F44V-7QGW-9GH9 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...

ROOT-APP-GOBINARY-CVE-2026-34986 CVE-2026-34986 in rootio-github.com/go-jose/go-jose/v4 - Patched by Root

Root has patched CVE-2026-34986 in the rootio-github.com/go-jose/go-jose/v4 package for Root:Go. Multiple fixed versions available...

GHSA-47QP-HQVX-6R3F

creationtimestamp| type| source ---|---|--- 2026-06-18 13:41:25+00:00| seen| https://gist.github.com/alon710/adfa7aacc3b80320d7d38d47591141d2 2026-06-18 14:01:20+00:00| seen| https://gist.github.com/alon710/1009ff77420ca2d3dfc49ca0eb601808...

CVE-2026-55229

creationtimestamp| type| source ---|---|--- 2026-06-18 13:04:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-2mrg-35hw-x3x9 2026-07-11 13:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqeptauyzd2r 2026-07-13 23:37:05+00:00| seen|...

CVE-2026-55832

creationtimestamp| type| source ---|---|--- 2026-06-18 07:13:10+00:00| published-proof-of-concept| https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5...

CVE-2026-54527

creationtimestamp| type| source ---|---|--- 2026-06-18 07:12:58+00:00| published-proof-of-concept| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 2026-07-08 22:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64oaqtfb24 2026-07-09...

CVE-2026-55185

creationtimestamp| type| source ---|---|--- 2026-06-18 03:23:33+00:00| published-proof-of-concept| https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r...

PT-2026-50794

Name of the Vulnerable Software and Affected Versions conda-smithy versions prior to 3.61.0 Description conda-smithy is a tool that combines a conda recipe with configurations to build using freely hosted CI services into a single repository. A flaw in the conda-forge automated webservices allows...

CVE-2026-12567

The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...

CVE-2026-12567

The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...

CVE-2026-12567

CVE-2026-12567 affects the github_workflows module. It constructs local directory paths from user-controlled repository names without validating for symlinks, enabling a local attacker sharing the scan directory to plant a symlink at a predictable output path. This can cause workflow data to be w...

CVE-2026-12567 Symlink-following arbitrary write via github_workflows module

The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...

MAL-2026-6083 Malicious code in syncagents (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aebf468a6887fb09002d4ae4aceab77e347034b389b02e252844f7d0d81fabd6 The PyPI package 'syncagents' impersonates the legitimate PyPI package 'agentsync' — the README, PKG-INFO, CHANGELOG, and project URLs all point at...

GHSA-376J-8F52-GP2X vulnerabilities

Vulnerabilities for packages: openjdk...

CVE-2026-55093

creationtimestamp| type| source ---|---|--- 2026-06-17 15:29:25+00:00| published-proof-of-concept| https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg...

GHSA-8JR5-V98P-W75M

creationtimestamp| type| source ---|---|--- 2026-06-17 14:41:27+00:00| seen| https://gist.github.com/alon710/91c849a1a0fb4322b56402af2c5bb804...

CVE-2026-55471

creationtimestamp| type| source ---|---|--- 2026-06-17 13:06:00+00:00| published-proof-of-concept| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf 2026-07-08 22:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64rso5sc2z...

Malicious code in @mastra/github-signals (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e263abbd9ed9975f3f8aaecfd1a780616bc3aef00238ed9ba9075b5bf4e38f37 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...