GHSA-854V-W859-V99C vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-7H3X-G348-3QM8 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-RXXM-P26X-J53P vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-QC83-G4W3-PXPQ vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-JMG2-VQR6-G8H5 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-J27F-XG68-8FVV vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-FJ5J-5VM7-Q87M vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-Q69J-7XQC-6C6X vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-7V44-Q3V7-22WM vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-3GGW-GM74-WQQP vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-39VG-P77Q-35GX vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-4821

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as httpproxy. Exploitation o...

Miasma Malware Hits 32 Red Hat Packages via Compromised GitHub Account

32 Red Hat npm packages compromised by Miasma malware expose cloud tokens, CI/CD secrets and developer credentials in supply chain attack...

CVE-2026-40903

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUBTOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6...

CVE-2026-40316

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pullrequesttarget trigger to run wit...

CVE-2026-44971

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

CVE-2026-44334

PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAIALLOWLOCALTOOLS=true in two files toolresolver.py, api/call.py. A third import sink in praisonai/templates/tooloverride.py was missed and remains...

CVE-2026-44590

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validatemodifiedtargets.yml is vulnerable to command injection via the pullrequesttarget trigger. Any GitHub user can execute arbitrary commands on the CI runner and exfiltra...

CVE-2026-8034

A server-side request forgery SSRF vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a differe...

CVE-2026-8606

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed an attacker to cause the server to issue HTTP requests to internal services via the security advisories package lookup feature. By directing requests to an internal management service and...