30605 matches found
PT-2026-60782
A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker who had code execution inside the Dependabot updater container to write files to arbitrary repository paths, including GitHub Actions workflow files under .github/workflows/ as the path validation d...
PT-2026-60768
A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool cron.go of the component cron Chat Tool. The manipulation results in missing authorization. The attack may be performed from remote. The exploit has been released to th...
PT-2026-60783
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read metadata from private repositories they did not have access to, including private repository owners and names, branch names, commit SHAs,...
CVE-2026-54540
creationtimestamp| type| source ---|---|--- 2026-07-16 22:35:07+00:00| published-proof-of-concept| https://github.com/pheditor/pheditor/security/advisories/GHSA-9643-6xjp-vx57 2026-07-27 21:27:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrntm3fpuy2i...
CVE-2026-55578
creationtimestamp| type| source ---|---|--- 2026-07-16 22:35:05+00:00| published-proof-of-concept| https://github.com/pheditor/pheditor/security/advisories/GHSA-wg4w-wr5q-6vjc 2026-07-27 21:12:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrnsra2sn72s...
MAL-2026-10745 Malicious code in phantomx-tool-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e528800706b219f69d8bc87eb77203c752c8b4720e8c0b8fc04cad6df8ce1d When the tool-server bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers...
MAL-2026-10750 Malicious code in telemetry-metrics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd215db682d2cc6eb6c9d4f5f704b66503762047ac210160f07559c07e93dea [email protected] impersonates @telemetry-js/telemetry — its package.json repository/homepage/bugs and README badges all reference the legitima...
MAL-2026-10723 Malicious code in @yeaft/webchat-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c505d42f1b2b4f64592abbf753ebf4b8eb5e11d359bc4fb8b8a9a9db3ec36e On startup the agent opens a WebSocket to a configurable server SERVERURL / config.serverUrl, default ws://localhost:3456 and dispatches...
MAL-2026-10746 Malicious code in sakuraai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e When the daemon is started e.g. via sakura daemon start, the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a...
MAL-2026-10753 Malicious code in a3s-code (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6062cbfbdc0c31c48564e4ec850d2ce71996d6cf12373c775aed5560c88e5434 On first import a3scode, top-level init.py invokes bootstrap.ensurenativeloaded, which performs an HTTP GET to...
SUSE CVE-2026-45793
Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...
GHSA-W447-HXJ8-XQ6P vulnerabilities
Vulnerabilities for packages: linux-gcp, linux-qemu...
CVE-2026-54504
creationtimestamp| type| source ---|---|--- 2026-07-16 00:35:05+00:00| published-proof-of-concept| https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7...
CVE-2026-58196
creationtimestamp| type| source ---|---|--- 2026-07-16 00:35:03+00:00| published-proof-of-concept| https://github.com/stacklok/toolhive/security/advisories/GHSA-pr64-jmmf-jp54...
CVE-2026-54450
creationtimestamp| type| source ---|---|--- 2026-07-15 22:35:03+00:00| published-proof-of-concept| https://github.com/stacklok/toolhive/security/advisories/GHSA-pph6-vfjv-vpjw...
CVE-2026-55576
MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pullrequest.title into a run: shell command during the pullrequest opened, reopened, and readyforreview events, s...
CVE-2026-55576
The CVE-2026-55576 entry concerns MaaAssistantArknights. In the dev-v2 workflow, the string from github.event.pull_request.title was inlined into a run: shell command in .github/workflows/release-preparation.yml for PRs opened, reopened, or ready_for_review. A non-draft fork PR with a title start...
GHSA-Q3FV-X8VG-QQM4 vulnerabilities
Vulnerabilities for packages: trivy-operator...