35876 matches found
GHSA-Q8MJ-M7CP-5Q26 vulnerabilities
Vulnerabilities for packages: sqlpad, saf, tileserver-gl, thingsboard, argo-workflows, jupyter-base-notebook, json-server, code-server, kubeflow-pipelines, prism, kubeflow-centraldashboard, py3-jupyterlab, kubeflow-katib, renovate, opensearch-dashboards, langfuse...
WordPress Github Shortcode plugin <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin Github Shortcode versions = 0.1...
-GodSearch
GodSearch v20.0 — THE SOVEREIGN 💀 Universal Exploit Sear...
GodSearch
GodSearch v20.0 — THE SOVEREIGN 💀 Universal Exploit Sear...
CVE-2026-44723 Vowpal Wabbit: Shell injection via crafted PR title in python_checks.yml allows arbitrary command execution on CI runner
Vowpal Wabbit is a machine learning system. The workflow .github/workflows/pythonchecks.yml embeds $ github.event.pullrequest.title directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script...
EUVD-2026-31902
Vowpal Wabbit is a machine learning system. The workflow .github/workflows/pythonchecks.yml embeds $ github.event.pullrequest.title directly inside double-quoted bash strings in four separate steps across four jobs, each passing it as a CLI argument to the Python test script...
CVE-2026-45162
creationtimestamp| type| source ---|---|--- 2026-05-26 14:09:06+00:00| published-proof-of-concept| https://github.com/pimcore/pimcore/security/advisories/GHSA-36fc-7wjg-mfvj 2026-07-18 20:00:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqx2jeapih2w...
CVE-2026-45704
creationtimestamp| type| source ---|---|--- 2026-05-26 14:01:06+00:00| published-proof-of-concept| https://github.com/pimcore/pimcore/security/advisories/GHSA-jwcc-gv4m-93x6...
GHSA-CW25-2P92-7F75 Prefect has an Argument Injection issue
A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper...
Prefect has an Argument Injection issue
A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the OAuth callback process. An attacker can access unauthorized private repositories by modifying the scope parameter in the GitHub authorization URL. Remediation Upgrade...
GHSA-R5VF-GRCX-5VQP Mattermost allows authenticated users to gain access to private repositories
Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL...
Mattermost allows authenticated users to gain access to private repositories
Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to validate the OAuth token scope on the callback which allows an authenticated Mattermost user to gain access to private repositories via modifying the scope parameter in the GitHub authorization URL...
CVE-2026-27384
creationtimestamp| type| source ---|---|--- 2026-05-26 09:00:05+00:00| seen| https://t.me/GithubRedTeam/85938 2026-05-27 21:10:45+00:00| seen| Telegram/GF77XqZ1LHaWDL2kD1JemKeP32DvhHpTDQqckw5Eq33XXvc...
MAL-2026-4793 Malicious code in vxui-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4af2c5e995ae069d3037f1310d055fac142dd6bb2ccd5ecb7e7f9a518e8022f0 On npm install, package.json's postinstall script runs curl -skL...
CVE-2026-49396
creationtimestamp| type| source ---|---|--- 2026-05-26 07:31:03+00:00| published-proof-of-concept| https://github.com/nezhahq/nezha/security/advisories/GHSA-8qhj-4f8c-j8qg...
CVE-2026-9520
A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible ...
EUVD-2026-31781
A weakness has been identified in blitz-js blitz up to 3.0.2 on GitHub. This impacts an unknown function of the file packages/generator/templates/app/src/app/auth/components/LoginForm.tsx of the component Sign-in. This manipulation of the argument Next causes cross site scripting. It is possible ...
Malicious code in arnext (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d689a27b5cc929562b684a7181549d3770de331a9f57120881d8060294b6e5f package.json declares "preinstall": "./vendor/setup", which runs a 976,568-byte Linux ELF binary on every npm install. The package's stated purpose i...
MAL-2026-4482 Malicious code in arnext (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d689a27b5cc929562b684a7181549d3770de331a9f57120881d8060294b6e5f package.json declares "preinstall": "./vendor/setup", which runs a 976,568-byte Linux ELF binary on every npm install. The package's stated purpose i...