CVE-2026-45793

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the TIFF encoder when a temporary file cannot be created. An attacker can cause a small memory leak by triggering conditions where the encoder attempts to create a temporary file and...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the ICON decoder when a memory allocation fails. An attacker can cause the application to consume excessive memory resources by submitting a specially crafted ICON file. Remediation ...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the freetype initialization. An attacker can cause the application to access freed memory by triggering a failure during image processing, potentially resulting in application crash or denial of service. Remediation A...

CVE-2026-61613

Cursor: Cloud Agent browser sandbox escape where attacker-controlled web content inside the agent container could reach an unauthenticated local agent endpoint, allowing code execution and access to files, repository contents, environment variables, credentials, and GitHub App tokens. Fixed 2026-...

GHSA-RGJC-H3X7-9MWG vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GHSA-C48F-7JV4-R33V vulnerabilities

Vulnerabilities for packages: chromium...

exploit-toolkit

Target Exploitation Toolkit — GitHub Actions Structure...

vulnerability-intel-pipeline

Vulnerability Intelligence Pipeline A real ETL pipeline again...

PT-2026-60238

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged workfl...

CVE-2026-50562: Incorrect Privilege Assignment

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged...

A Measurement Study of AI-Environment Realism Gaps in Malware-Analysis Sandboxes

Sandboxing remains a core technique for observing suspicious program behavior, yet environment-aware malware increasingly suppresses execution when analysis is suspected. Prior generations of sandbox evasion focused on virtualization artifacts, timing discrepancies, and wear-and-tear realism. In...

CVE-2026-45793: Exposure of Sensitive Information to an Unauthorized Actor

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...

CVE-2026-54629

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:09+00:00| published-proof-of-concept| https://github.com/julien040/anyquery/security/advisories/GHSA-mf78-3rpf-r784...

CVE-2026-55512

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:07+00:00| published-proof-of-concept| https://github.com/forgekeep/nebula-mesh/security/advisories/GHSA-m3cx-mwpg-32jg...

CVE-2026-50125

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:09+00:00| published-proof-of-concept| https://github.com/StacklokLabs/mkp/security/advisories/GHSA-qw5r-ppcg-f8rj...

CVE-2026-50006

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:04+00:00| published-proof-of-concept| https://github.com/julien040/anyquery/security/advisories/GHSA-xrcf-6jh3-ggvx 2026-07-14 22:08:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqn7shrlbn2b 2026-09-14...

CVE-2026-50158

creationtimestamp| type| source ---|---|--- 2026-07-14 20:35:02+00:00| published-proof-of-concept| https://github.com/eat-pray-ai/yutu/security/advisories/GHSA-2c7f-fxww-6w6c...

GHSA-P433-FP4G-PC2C

creationtimestamp| type| source ---|---|--- 2026-07-14 18:51:32+00:00| seen| https://gist.github.com/yuriw/cc567f8b243229aaf1def97d7207ea0d 2026-07-14 18:52:20+00:00| seen| https://gist.github.com/yuriw/be55c19caff2bacad733b7df0c67de08 2026-09-02 19:03:42+00:00| seen|...

CVE-2026-45262

creationtimestamp| type| source ---|---|--- 2026-07-14 18:35:12+00:00| published-proof-of-concept| https://github.com/NeoRazorX/facturascripts/security/advisories/GHSA-5qmh-x653-g8qj 2026-07-14 20:08:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmz3x5vth2z...