GHSA-MXC8-4JQF-368Q

creationtimestamp| type| source ---|---|--- 2026-01-24 21:22:17+00:00| seen| https://gist.github.com/alon710/538f3bbaec01e73a79181c8d943a0a8b...

Multi-Stage Phishing Campaign Targets Russia with Amnesia RAT and Ransomware

A new multi-stage phishing campaign has been observed targeting users in Russia with ransomware and a remote access trojan called Amnesia RAT. "The attack begins with social engineering lures delivered via business-themed documents crafted to appear routine and benign," Fortinet FortiGuard Labs...

CVE-2026-0756

github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw...

K000159681: Credential harvesting campaign targeting F5 VPN users

On January 13, 2026, researchers identified a large-scale credential harvesting campaign targeting several VPN providers, including F5. The threat actors behind the campaign registered numerous doppelgänger domains designed to mimic legitimate F5 domains. These domains are used to deceive victims...

GHSA-FCV2-XGW5-PQXF vulnerabilities

Vulnerabilities for packages: docker-compose, spire-server, podman, falco-no-driver, crossplane, rekor, kyverno, skopeo, tkn, gitsign, buildah, flux-source-controller, kots, policy-controller, buildkitd, cosign, undock, trivy-operator, zot, vexctl, ratify, gh, trivy, ko, falcoctl, portieris,...

CVE-2026-24117 vulnerabilities

Vulnerabilities for packages: spire-server, crossplane, kyverno, tkn, gitsign, flux-source-controller, policy-controller, cosign, buildkitd, teleport, trivy-operator, zot, vexctl, ratify, gh, trivy, ko, falcoctl, kyverno-notation-aws, skaffold, zarf, goreleaser, kubescape, aactl,...

GHSA-GJ5H-7FQ5-56P5 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

GHSA-84X2-RFRF-6F2C vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

GHSA-59F6-F4PC-WW92 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu...

CVE-2026-24137 vulnerabilities

Vulnerabilities for packages: flux-source-controller, prometheus-podman-exporter-fips, tflint, timestamp-authority-fips, undock, cosign-fips, neuvector-sigstore-interface-fips, buildah, kyverno-policy-reporter-plugins-kyverno, crossplane-fips, gitsign, witness, buildkitd-fips, gh, goreleaser,...

CVE-2026-23831 vulnerabilities

Vulnerabilities for packages: spire-server-fips, tflint-fips, tkn, trivy, kubescape, kyverno-notation-aws-fips, falcoctl-fips, skaffold-fips, flux-source-controller, ratify-fips, tflint, cg, vexctl, kyverno-notation-aws, policy-controller, falcoctl, policy-controller-fips, teleport, cosign-fips,...

GHSA-FCV2-XGW5-PQXF vulnerabilities

Vulnerabilities for packages: flux-source-controller, prometheus-podman-exporter-fips, tflint, timestamp-authority-fips, undock, cosign-fips, neuvector-sigstore-interface-fips, buildah, kyverno-policy-reporter-plugins-kyverno, crossplane-fips, gitsign, witness, buildkitd-fips, gh, goreleaser,...

GitHub: PATs without the required scope can leak issues

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with a classic personal access token PAT lacking the repo scope to retrieve issues and commits from private and internal repositories via the search REST API endpoints. The user...

GHSA-3QMM-R55X-HPXX vulnerabilities

Vulnerabilities for packages: airflow...

OESA-2026-1213 opencc security update

Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library. Security Fixes: A vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer...

OESA-2026-1212 opencc security update

Opencc is for between Traditional Chinese and Simplified Chinese characters and phrases conversion library. Security Fixes: A vulnerability was found in BYVoid OpenCC up to 1.1.9 and classified as critical. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer...

CVE-2020-16248

creationtimestamp| type| source ---|---|--- 2026-01-23 07:34:13+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-16248.yaml 2026-01-25 21:03:01+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mdbmvmjmq52c...

CVE-2026-0927

creationtimestamp| type| source ---|---|--- 2026-01-23 07:23:16+00:00| seen| https://gist.github.com/Darkcrai86/30221df75e8d29c4c44a72efd5f3ce5b 2026-01-23 07:44:49+00:00| seen| https://gist.github.com/Darkcrai86/f6ceca6b6f5861138955c1b1e47ded28 2026-01-23 07:59:20+00:00| seen|...

Command Injection

Overview @sunwood-ai-labs/github-kanban-mcp-server is an A Model Context Protocol server for managing GitHub issues as Kanban using gh CLI Affected versions of this package are vulnerable to Command Injection via the createissue parameter. An attacker can execute arbitrary code in the context of...

CVE-2026-0756

github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw...