CVE-2026-44844

creationtimestamp| type| source ---|---|--- 2026-05-08 23:12:51+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-g47v-rwmh-r9f8...

CVE-2026-44323

creationtimestamp| type| source ---|---|--- 2026-05-08 22:52:00+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-4rqf-grm6-vf75...

CVE-2026-44322

creationtimestamp| type| source ---|---|--- 2026-05-08 22:50:57+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-j59f-x285-69jx...

CVE-2026-44321

creationtimestamp| type| source ---|---|--- 2026-05-08 22:47:24+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-44qj-cghf-9p97...

CVE-2026-44320

creationtimestamp| type| source ---|---|--- 2026-05-08 22:46:37+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-wqfh-gq79-j8mf...

CVE-2026-44319

creationtimestamp| type| source ---|---|--- 2026-05-08 22:44:35+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-rxrq-fv76-26pr...

CVE-2026-44317

creationtimestamp| type| source ---|---|--- 2026-05-08 22:40:11+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-wwqh-7jm5-gj7w...

CVE-2026-44316

creationtimestamp| type| source ---|---|--- 2026-05-08 22:39:43+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-wr8j-6chw-gm6p...

CVE-2026-42298 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...

CVE-2026-42298

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...

CVE-2026-42298

CVE-2026-42298 affects Postiz (AI social media scheduling tool). The issue arises in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml), where an unauthenticated user can cause arbitrary code execution during Docker image build by submitting a fork with a malic...

CVE-2026-44209

creationtimestamp| type| source ---|---|--- 2026-05-08 20:36:22+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-gphh-9q3h-jgpp...

GHSA-H9HM-M2XJ-4RQ9

creationtimestamp| type| source ---|---|--- 2026-05-08 20:10:29+00:00| seen| https://gist.github.com/alon710/b2fb36b6ecfecf3424b0cb12c54264f5...

GHSA-MPM8-CX2P-626Q

creationtimestamp| type| source ---|---|--- 2026-05-08 19:10:29+00:00| seen| https://gist.github.com/alon710/81381888e21682cdeae4882d5cd6667d...

GHSA-95C3-6VVW-4MRQ MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience

SECURITY registry001 Vulnerability Report While analyzing the code logic, an area that may lead to unintended behavior under specific conditions was discovered. Overview - Verified Version: c5c4b9e8890dd5754bee889b2f1417f4fe3b5ce5 - Vulnerability Type: Authentication bypass via cross-registry OID...

CVE-2026-44334

PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAIALLOWLOCALTOOLS=true in two files toolresolver.py, api/call.py. A third import sink in praisonai/templates/tooloverride.py was missed and remains...

GHSA-FP55-JW48-C537 vulnerabilities

Vulnerabilities for packages: pixi, uv...

GHSA-XX64-WWV2-HCQQ vulnerabilities

Vulnerabilities for packages: pixi, uv...

GHSA-PP6C-GR5W-3C5G vulnerabilities

Vulnerabilities for packages: reflex, airflow, semgrep...

GHSA-2C5C-CHWR-9HQW vulnerabilities

Vulnerabilities for packages: spark-kubernetes-operator, camunda, apache-hop, druid, opensearch-fips, trino, spark, apache-hop-fips, celeborn, camunda-zeebe, opensearch, spark-fips, spark-kubernetes-operator-fips...