CVE-2026-57135

creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:08+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gqmf-56h7-rrpf...

CVE-2026-57136

creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:06+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vjv9-7m7j-h833...

CVE-2026-57138

creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:02+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmmj-pfw7-fjwp 2026-09-15 12:08:21+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvklo3gxse2y 2026-09-15...

CVE-2026-57139

creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:57+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j4f3-55x4-r6q2 2026-09-15 12:08:29+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvklodner42t 2026-09-15...

CVE-2026-57141

creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:55+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p69m-4f92-2v84 2026-09-15 12:08:48+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvklovt2vo24 2026-09-15...

CVE-2026-57133

creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:53+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5jv7-2mjm-h6qj...

CVE-2026-57147

creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:44+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-cwj8-7gp2-ggcw 2026-07-23 17:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcz77dbd2q 2026-09-15...

CVE-2026-57209

creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:38+00:00| published-proof-of-concept| https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988...

CVE-2026-57146

creationtimestamp| type| source ---|---|--- 2026-07-20 22:35:36+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jxcw-qp4h-6jfq...

GHSA-G6XQ-892H-64W3 Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Summary When Composer is run with -vvv debug verbosity, it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text...

BIT-COMPOSER-2026-45793 Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...

brave-browser v1.94.85

Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...

CVE-2026-44680

creationtimestamp| type| source ---|---|--- 2026-07-20 20:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/94356 2026-07-21 00:00:20+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/94356 2026-07-22 17:00:05+00:00| seen|...

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence AI skills or Model Context Protocol MCP servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit...

CVE-2026-46412

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

A week in security (July 13 – July 19)

Last week on Malwarebytes Labs: Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords How to use GitHub safely The backlash against Flock cameras is spreading Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom Samsung backs down on threat to delete health data Clau...

golang-github-openprinting-ipp-usb security update

0.9.27-7.2 - rebuilt with golang-1.26.4-1.el102 to fix CVE-2026-33811, CVE-2026-27145 0.9.27-7.1 - rebuilt with golang-1.26.3-4.el102 to fix CVE-2026-32281 0.9.27-7 - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810...

CVE-2026-44359: Improper Control of Generation of Code

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

CVE-2026-44359 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...

CVE-2026-44359 Meshtastic GitHub repo vulnerable to Arbitrary Code Execution via pull_request_target Fork Checkout in CI Workflow

Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's mainmatrix.yml workflow is triggered by pullrequesttarget and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and elevated...