Malicious Package

Overview @withgoogle/stitch-sdk is a malicious package. Although this package attempts to impersonate Google's Stitch AI design tool, there is no connection between Google and this package. By squatting the @withgoogle npm scope, a malicious actor published @withgoogle/stitch-sdk in an attempt to...

GHSA-C3XH-98XP-6QHF githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and it directly inserts github.event.issue.title into a Bash variable assignment. If an issue title contains command substitution syntax, Bash...

githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow

Summary A GitHub Actions workflow is vulnerable to command injection through the issue title. The workflow is triggered when an issue is opened or closed, and it directly inserts github.event.issue.title into a Bash variable assignment. If an issue title contains command substitution syntax, Bash...

CVE-2026-50519

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

EUVD-2026-38089

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

CVE-2026-50519

Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: zot, descheduler, argocd-image-updater, flux-notification-controller, trivy, cadvisor, trufflehog, crossplane-provider-azure-authorization, crossplane-provider-aws-firehose, addon-resizer, cass-operator, ratify, coredns, grype, harbor-registry,...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the CRI checkpoint restore plugin due to improper validation of symlinked paths. An attacker can access arbitrary files on the host by crafting a malicious checkpoint image and leveraging the...

CVE-2026-12726

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

Improper Handling of Case Sensitivity

Overview @microsoft/kiota-http-fetchlibrary is an implementation using the Fetch API to make requests. Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the executeWithRedirect redirect handling in redirectHandlerOptions.ts. An attacker can capture...

CVE-2026-12726 Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-12726

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-12726 Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses_url exfiltrates pat credential

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

EUVD-2026-38065

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-12726

AWX/AUTOMATION-CONTROLLER GitHub webhook integration vulnerability (CVE-2026-12726): processing of GitHub pull_request webhooks stores statuses_url from the payload without validating it points to a trusted GitHub API endpoint. If a job template uses a GitHub Personal Access Token as the webhook ...

CVE-2026-12726

A flaw was found in the AWX GitHub webhook integration. When processing GitHub pullrequest webhooks, the controller stores the pullrequest.statusesurl value from the webhook payload without validating that it points to a trusted GitHub API endpoint. If a job template is configured with a GitHub...

CVE-2026-55691

creationtimestamp| type| source ---|---|--- 2026-06-19 18:22:24+00:00| published-proof-of-concept| https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-7h5p-637f-jfr7...

CVE-2026-55446

creationtimestamp| type| source ---|---|--- 2026-06-19 13:09:48+00:00| published-proof-of-concept| https://github.com/langflow-ai/langflow/security/advisories/GHSA-qwqc-p3q8-wcg9...

CVE-2026-55770

creationtimestamp| type| source ---|---|--- 2026-06-19 11:28:09+00:00| published-proof-of-concept| https://github.com/openbao/openbao/security/advisories/GHSA-6mwx-4547-5vc9...

CVE-2026-55195

creationtimestamp| type| source ---|---|--- 2026-06-19 09:32:20+00:00| published-proof-of-concept| https://github.com/miurahr/py7zr/security/advisories/GHSA-gjrg-mpp7-g774 2026-07-08 22:31:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq66cvk66i27...