34888 matches found
MAL-2026-12314 Malicious code in @copilot-mcp/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c95a10852a2ffe12a9d2b124d014e2092dc2f2d45821ab92feae8cb5308b94ea install.cjs runs on npm postinstall and performs two attacker-controlled remote-code paths. First, it spawns osascript with 'do shell script' on macO...
CVE-Poc_All_in_One
CVE Poc All in One 🛡️ This is a tool for searching, filtering...
ROOT-APP-PYPI-GHSA-F4XH-W4CJ-QXQ8 GHSA-f4xh-w4cj-qxq8 in langsmith - Patched by Root
Root has patched GHSA-f4xh-w4cj-qxq8 in the langsmith package for Root:PyPI. Multiple fixed versions available...
MAL-2026-12085 Malicious code in @wethenorth12/bip39-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...
Malicious code in @wethenorth12/bip39-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...
GHSA-CJ62-HVV2-2Q5H
creationtimestamp| type| source ---|---|--- 2026-08-05 03:31:03+00:00| seen| https://gist.github.com/alon710/7709dc60acce15f366b5c87665dcce14...
GHSA-MX64-MJ3Q-7PRJ vulnerabilities
Vulnerabilities for packages: bento, dapr, splunk-otel-collector, opentelemetry-collector-contrib...
Malicious code in data-format-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to...
CVE-2026-48168: Missing Authorization
PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...
PT-2026-68311
Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description A path traversal issue allows an unauthenticated attacker with network reachability to delete arbitrary files and directories on the instance, including the user storage directory...
PT-2026-68324
Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An unauthenticated attacker can cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containin...
CVE-2026-15996: Uncontrolled Recursion
A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameter...
PT-2026-68302
Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40 Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or...
CVE-2026-17556: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...
osbuild-composer security update
175-1.0.1 - Track github upstream...
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...
GHSA-CHGM-3698-JM42
creationtimestamp| type| source ---|---|--- 2026-08-04 23:31:07+00:00| seen| https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a 2026-08-05 00:00:39+00:00| seen| https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a...
CVE-2026-70489
creationtimestamp| type| source ---|---|--- 2026-08-04 22:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-73cq-mcgh-379c...
CVE-2026-70492
creationtimestamp| type| source ---|---|--- 2026-08-04 21:55:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bzto3ybcv52fo 2026-08-04 22:35:08+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-pwxh-7358-jq2x 2026-08-05...