34885 matches found
UBUNTU-CVE-2026-64655
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
UBUNTU-CVE-2026-64653
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resourc...
UBUNTU-CVE-2026-64654
GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...
CVE-2026-64654
GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...
UBUNTU-CVE-2026-64652
GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain fine-grained personal access tokens and GitHub App tokens. As a result, part of an affected token could appear in terminal or CI output tha...
CVE-2026-71436
creationtimestamp| type| source ---|---|--- 2026-08-06 20:35:03+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-2v8p-3f2j-5mp7...
Malicious code in vite-plugin-cleaner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35bc445ea196f979ad69189f4498586a09a51855b97e95dea02d01d197620237 package.json declares an optionalDependency vite-cleaning-tools pointing at github:vite-plugins/vite-cleaning-tools with no commit SHA or tag, so npm...
MAL-2026-13463 Malicious code in vite-plugin-cleaner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35bc445ea196f979ad69189f4498586a09a51855b97e95dea02d01d197620237 package.json declares an optionalDependency vite-cleaning-tools pointing at github:vite-plugins/vite-cleaning-tools with no commit SHA or tag, so npm...
GHSA-8RXV-JG7P-WVG3
creationtimestamp| type| source ---|---|--- 2026-08-06 19:32:23+00:00| seen| https://gist.github.com/alon710/73aecb4bf7a9c9303fe6451f784d95ea...
Malicious code in opencode-optimised-toolings (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c On plugin load, [email protected] runs SelfPatchPlugin.runSelfPatch without user prompt. It downloads an OpenCode source tarball from...
MAL-2026-13452 Malicious code in opencode-optimised-toolings (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c On plugin load, [email protected] runs SelfPatchPlugin.runSelfPatch without user prompt. It downloads an OpenCode source tarball from...
CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
CVE-2026-64655
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
EUVD-2026-54222
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
CVE-2026-64655
GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...
CVE-2026-71326
creationtimestamp| type| source ---|---|--- 2026-08-06 18:35:20+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf...
CVE-2026-65600
creationtimestamp| type| source ---|---|--- 2026-08-06 18:31:30+00:00| seen| https://gist.github.com/alon710/1c8a7f596af5fdd35dfa04b0effb7a0b 2026-08-06 18:35:06+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-cxjq-mrr5-89rv...
EUVD-2026-54218
GitHub CLI gh is GitHub's official command line tool. Prior to version 2.97.0, multiple GitHub CLI commands printed externally controlled gist, API, pull request, release, codespace, skill, or agent-task content without neutralizing terminal escape sequences. An attacker who can influence that...