CVE-2026-46426

creationtimestamp| type| source ---|---|--- 2026-05-14 08:35:54+00:00| published-proof-of-concept| https://github.com/Budibase/budibase/security/advisories/GHSA-82rc-gxrg-v4gf 2026-05-27 19:19:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmu7ynnjzd2q...

CVE-2026-45709

creationtimestamp| type| source ---|---|--- 2026-05-14 04:53:50+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc...

CVE-2026-45139

creationtimestamp| type| source ---|---|--- 2026-05-14 01:57:46+00:00| published-proof-of-concept| https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5...

GHSA-V9JR-RG53-9PGP vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server...

GHSA-66FF-XGX4-VCHM vulnerabilities

Vulnerabilities for packages: pulumi, kubeflow-centraldashboard, renovate, vitess...

GHSA-V974-2CJF-22Q5 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws...

PT-2026-41129

Name of the Vulnerable Software and Affected Versions shivammathur/setup-php versions 2.25.0 through 2.37.0 Description Command injection is possible when the action resolves the PHP version from repository-controlled files and incorporates these values into generated shell or PowerShell setup...

CVE-2026-46378

creationtimestamp| type| source ---|---|--- 2026-05-13 20:50:17+00:00| published-proof-of-concept| https://github.com/TomWright/dasel/security/advisories/GHSA-m6xr-fvfg-5g64 2026-07-16 19:41:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrykn3wqb22...

CVE-2026-46377

creationtimestamp| type| source ---|---|--- 2026-05-13 20:39:40+00:00| published-proof-of-concept| https://github.com/TomWright/dasel/security/advisories/GHSA-m5j3-4634-c2vq 2026-07-16 19:58:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqrzidqrfn2w...

MAL-2026-3702 Malicious code in async-http-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 85e8a68bad6595a817f1dabed757662e2a04cfec7b45a86d9bfd61a7a78d14d1 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

Malicious code in web3-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8d6102ae402b2583a01da47e71f41cccba99fb7826dcf360004d8924557e1760 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

Malicious code in math-array-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1b6411ce9c35210436bef6dadb284e5d89ec85c2cc17f970509aa4b5f30c2440 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

Malicious code in graddio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cf6bbc8eaafef42ed4e5740b1ff94df7749de4241d44846467b438db586399ba During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

MAL-2026-3704 Malicious code in graddio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cf6bbc8eaafef42ed4e5740b1ff94df7749de4241d44846467b438db586399ba During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

MAL-2026-3701 Malicious code in api-request-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c8e8b70ac4deca30691d583ac6891034222b7458bf5ba9e7b86cf5e6627d8abb During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

MAL-2026-3700 Malicious code in alembic-util (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8e9b764ee0ccd6a2c6c2db1b7722f083ee9f643cb99d03821d5e6571f68db253 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

CVE-2026-44990

creationtimestamp| type| source ---|---|--- 2026-05-13 19:28:52+00:00| published-proof-of-concept| https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643...

GHSA-8V8J-3HXP-93WR vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe...

CVE-2026-45033

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent...

Malicious Package

Overview github.com/BufferZoneCorp/log-core is a malicious package. This package contains malicious code designed to compromise developer systems and CI environments, specifically targeting GitHub Actions. The threat actor, operating under the GitHub account BufferZoneCorp, published a cluster of...