35847 matches found
CVE-2026-55185
creationtimestamp| type| source ---|---|--- 2026-06-18 03:23:33+00:00| published-proof-of-concept| https://github.com/miniflux/v2/security/advisories/GHSA-m999-j542-5w3r...
PT-2026-50794
Name of the Vulnerable Software and Affected Versions conda-smithy versions prior to 3.61.0 Description conda-smithy is a tool that combines a conda recipe with configurations to build using freely hosted CI services into a single repository. A flaw in the conda-forge automated webservices allows...
CVE-2026-46699: Improper Access Control
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub...
PT-2026-53135
Summary PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into /.praison/cache/templates/github//// without...
PT-2026-61767
Name of the Vulnerable Software and Affected Versions PraisonAI versions 2.6.0 through 4.6.57 Description The template loader fails to properly normalize or validate GitHub template URIs, allowing the path and ref variables to be stored verbatim. This leads to a path traversal issue where a craft...
CVE-2026-12567
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
CVE-2026-12567
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
CVE-2026-12567 Symlink-following arbitrary write via github_workflows module
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
CVE-2026-12567 Symlink-following arbitrary write via github_workflows module
The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...
CVE-2026-12567
CVE-2026-12567 affects the github_workflows module. It constructs local directory paths from user-controlled repository names without validating for symlinks, enabling a local attacker sharing the scan directory to plant a symlink at a predictable output path. This can cause workflow data to be w...
MAL-2026-6083 Malicious code in syncagents (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aebf468a6887fb09002d4ae4aceab77e347034b389b02e252844f7d0d81fabd6 The PyPI package 'syncagents' impersonates the legitimate PyPI package 'agentsync' — the README, PKG-INFO, CHANGELOG, and project URLs all point at...
GHSA-376J-8F52-GP2X vulnerabilities
Vulnerabilities for packages: openjdk...
Beyond the benchmark: Advancing security at AI speed
In this article 1. From the lab into the pipeline 2. This month’s set of discoveries 3. Beyond the headline: What the engineering work taught us 4. Where we go next 5. Defense at AI speed 6. Learn more Every vulnerability has two clocks running. One belongs to the defender racing to find it; the...
CVE-2026-55093
creationtimestamp| type| source ---|---|--- 2026-06-17 15:29:25+00:00| published-proof-of-concept| https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg...
GHSA-8JR5-V98P-W75M
creationtimestamp| type| source ---|---|--- 2026-06-17 14:41:27+00:00| seen| https://gist.github.com/alon710/91c849a1a0fb4322b56402af2c5bb804...
CVE-2026-55471
creationtimestamp| type| source ---|---|--- 2026-06-17 13:06:00+00:00| published-proof-of-concept| https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-2f55-g35j-5jmf 2026-07-08 22:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq64rso5sc2z...
Malicious code in @mastra/github-signals (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e263abbd9ed9975f3f8aaecfd1a780616bc3aef00238ed9ba9075b5bf4e38f37 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
GHSA-63HW-FMQ6-XXG2 vulnerabilities
Vulnerabilities for packages: airflow, mlflow, open-webui...
GHSA-9X8Q-7H8H-WCW9 vulnerabilities
Vulnerabilities for packages: airflow, mlflow, open-webui...
CVE-2026-54069
creationtimestamp| type| source ---|---|--- 2026-06-17 04:18:47+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-54069.yaml 2026-07-10 19:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcwdmy6ok2t 2026-07-10...