GHSA-JM66-CG57-JJV5 vulnerabilities

Vulnerabilities for packages: awx, az, authentik, datadog-agent, py3-cassandra-medusa, airflow, datadog-agent-fips, pgadmin4, barman, open-webui, request-1276, kserve, duplicity, authentik-fips...

North Korea-Linked Hackers Target Developers via Malicious VS Code Projects

The North Korean threat actors associated with the long-running Contagious Interview campaign have been observed using malicious Microsoft Visual Studio Code VS Code projects as lures to deliver a backdoor on compromised endpoints. The latest finding demonstrates continued evolution of the new...

GHSA-73RR-HH4G-FPGX vulnerabilities

Vulnerabilities for packages: npm, renovate, kubeflow-katib, saf, sqlpad, thingsboard, argo-workflows, ts-patch, prism, tileserver-gl, vitess, langfuse...

CVE-2025-14351

creationtimestamp| type| source ---|---|--- 2026-01-20 06:33:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mctjxqpcoc2i 2026-01-20 07:51:41+00:00| seen| https://gist.github.com/Darkcrai86/9a0fa1b491739b4e729d80465cb99f43...

CVE-2020-15081

creationtimestamp| type| source ---|---|--- 2026-01-20 03:57:37+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-15081.yaml 2026-01-23 21:02:59+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3md4lxp2srt2i...

Unpacking Security Scanners for GitHub Actions Workflows

GitHub Actions is a widely used platform that allows developers to automate the build and deployment of their projects through configurable workflows. As the platform's popularity continues to grow, it has become a target of choice for recent software supply chain attacks. These attacks exploit...

GHSA-GFW2-4JVH-WGFG

creationtimestamp| type| source ---|---|--- 2026-01-19 23:20:05+00:00| seen| https://gist.github.com/konard/0d69c914be52c3cee3437d4858b1c259...

PYSEC-2024-250

creationtimestamp| type| source ---|---|--- 2026-01-19 11:35:26+00:00| seen| https://gist.github.com/konard/d776e828509d5f2e3644437ac5400628 2026-01-19 11:37:28+00:00| seen| https://gist.github.com/konard/042845fbf63e049778752df088c0c9e4 2026-01-19 11:37:35+00:00| seen|...

CVE-2026-23845

creationtimestamp| type| source ---|---|--- 2026-01-18 08:34:24+00:00| published-proof-of-concept| https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j 2026-07-20 18:00:49+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mr3urupfyo2u...

AWS CodeBuild Misconfiguration Exposed GitHub Repos to Potential Supply Chain Attacks

A critical misconfiguration in Amazon Web Services AWS CodeBuild could have allowed complete takeover of the cloud service provider's own GitHub repositories, including its AWS JavaScript SDK, putting every AWS environment at risk. The vulnerability has been codenamed CodeBreach by cloud security...

CodeBreach: Infiltrating the AWS Console Supply Chain and Hijacking AWS GitHub Repositories via CodeBuild

Wiz Research discovered a critical supply chain vulnerability that abused a CodeBuild misconfiguration to take over key AWS GitHub repositories - including the JavaScript SDK powering the AWS Console...

CVE-2019-12935

creationtimestamp| type| source ---|---|--- 2026-01-15 07:49:49+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2019/CVE-2019-12935.yaml 2026-01-15 21:03:00+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mciiae22bv22...

GHSA-7RF3-MQPX-H7XG vulnerabilities

Vulnerabilities for packages: druid...

GHSA-9WPJ-H5JQ-88P9 vulnerabilities

Vulnerabilities for packages: redis...

GO-2025-4251 Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama

Ollama has missing authentication enabling attackers to perform model management operations in github.com/ollama/ollama...

CVE-2020-9039

creationtimestamp| type| source ---|---|--- 2026-01-14 19:04:28+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-9039.yaml 2026-01-15 21:03:01+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mciiaea53b2b...

GHSA-VH2P-4GFM-V9V7 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-azure, linux-gcp, linux-vmware, linux-qemu...

CVE-2026-22869

Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow .github/workflows/ci.yml allows arbitrary code execution from fork pull requests with repository write permissions. The vulnerable workflow uses pullrequesttarget trigger combined with checkout of untrusted PR...

CVE-2026-22869

Eigent’s CVE-2026-22869 affects its CI workflow (.github/workflows/ci.yml) used in the Eigent multi‑agent Workforce. The vulnerability arises from using the pull_request_target trigger in combination with checking out untrusted PR code, enabling arbitrary code execution from fork pull requests wi...

CVE-2026-20957

creationtimestamp| type| source ---|---|--- 2026-01-13 18:01:16+00:00| seen| https://www.thezdi.com/blog/2026/1/13/the-january-2026-security-update-review 2026-01-13 18:18:45+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0010 2026-01-13 19:01:58+00:00| seen|...