35847 matches found
CVE-2026-46699 conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub...
CVE-2026-46699
CVE-2026-46699 affects the conda-smithy tool. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories due to using mutable GitHub usernames as identifiers for repository invitation routing, instead of stable GitHu...
CVE-2026-46699 conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub...
CVE-2026-46699
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub...
GHSA-R7G4-QG5F-QQM2 vulnerabilities
Vulnerabilities for packages: langfuse...
CVE-2026-54499
creationtimestamp| type| source ---|---|--- 2026-06-18 19:32:55+00:00| published-proof-of-concept| https://github.com/stanfordnlp/stanza/security/advisories/GHSA-v5jw-96jm-7h2c 2026-07-09 01:20:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6hrarjta2z...
ROOT-APP-GOBINARY-CVE-2026-27889 CVE-2026-27889 in rootio-github.com/nats-io/nats-server/v2 - Patched by Root
Root has patched CVE-2026-27889 in the rootio-github.com/nats-io/nats-server/v2 package for Root:Go. Multiple fixed versions available...
opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication
githubreceiver Silently Ignores Configured requiredheaders Authentication Summary The githubreceiver webhook handler does not enforce the requiredheaders configuration. Headers are validated at startup config rejects empty keys/values but never checked on incoming requests. This follows the same...
GHSA-W5CV-PW74-4RXC opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication
githubreceiver Silently Ignores Configured requiredheaders Authentication Summary The githubreceiver webhook handler does not enforce the requiredheaders configuration. Headers are validated at startup config rejects empty keys/values but never checked on incoming requests. This follows the same...
BBOT: Symlink-Following Arbitrary Write via github_workflows Module
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
Symlink Attack
Overview bbot is an OSINT automation for hackers. Affected versions of this package are vulnerable to Symlink Attack via the githubworkflows process. An attacker can cause files to be written to arbitrary locations by planting a symlink at a predictable output path. Remediation Upgrade bbot to...
GHSA-RVP7-W75Q-9FV2 BBOT: Symlink-Following Arbitrary Write via github_workflows Module
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
Insufficiently Protected Credentials
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the backup process. An attacker can obtain sensitive account credentials and configuration secrets by...
CVE-2026-55414
creationtimestamp| type| source ---|---|--- 2026-06-18 14:25:37+00:00| published-proof-of-concept| https://github.com/nl-portal/nl-portal-backend-libraries/security/advisories/GHSA-xm3x-9cfw-jhx4 2026-10-15 17:47:10+00:00| seen| https://infosec.exchange/users/cve/statuses/117446176263991457...
External Control of File Name or Path
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...
GHSA-F44V-7QGW-9GH9 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...
GHSA-47QP-HQVX-6R3F
creationtimestamp| type| source ---|---|--- 2026-06-18 13:41:25+00:00| seen| https://gist.github.com/alon710/adfa7aacc3b80320d7d38d47591141d2 2026-06-18 14:01:20+00:00| seen| https://gist.github.com/alon710/1009ff77420ca2d3dfc49ca0eb601808...
CVE-2026-55229
creationtimestamp| type| source ---|---|--- 2026-06-18 13:04:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-2mrg-35hw-x3x9 2026-07-11 13:00:53+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqeptauyzd2r 2026-07-13 23:37:05+00:00| seen|...
CVE-2026-55832
creationtimestamp| type| source ---|---|--- 2026-06-18 07:13:10+00:00| published-proof-of-concept| https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5...
CVE-2026-54527
creationtimestamp| type| source ---|---|--- 2026-06-18 07:12:58+00:00| published-proof-of-concept| https://github.com/jupyterlab/jupyterlab-git/security/advisories/GHSA-f962-v9hr-pfg5 2026-07-08 22:02:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64oaqtfb24 2026-07-09...