CVE-2026-68904

creationtimestamp| type| source ---|---|--- 2026-09-16 17:31:30+00:00| seen| https://gist.github.com/alon710/ca48de2f64cb21c4b6fdba639af7e2ac...

CVE-2026-54168

A flaw was found in Pipelines-as-Code. A GitHub App installation token, created during webhook processing, is not properly scoped when the App is installed across multiple repositories. This allows a user with push access to one repository to access private repositories within the same installati...

CVE-2026-54167

A flaw was found in Pipelines-as-Code. The GitHub App provider incorrectly processes webhook events by accepting an untrusted X-GitHub-Enterprise-Host header as the API host before validating the webhook signature. An unauthenticated attacker can exploit this by sending a specially crafted webhoo...

GO-2026-6448 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail

Identrail Cross-tenant IDOR: Client-supplied GitHub App installationid is bound to the caller's workspace without ownership verification in github.com/identrail/identrail...

CVE-2026-61593

creationtimestamp| type| source ---|---|--- 2026-09-16 16:32:19+00:00| seen| https://gist.github.com/alon710/4438d7405fbc4cb7f575ade1c1585b2a 2026-09-16 17:26:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/22eovhmpbg6st...

CVE-2026-81192

creationtimestamp| type| source ---|---|--- 2026-09-16 15:32:25+00:00| seen| https://gist.github.com/alon710/d0ed93c28f268e6b433624aa592c6856...

CVE-2026-61598

creationtimestamp| type| source ---|---|--- 2026-09-16 14:31:54+00:00| seen| https://gist.github.com/alon710/17e19a604dba0f2f8107309615c5a1ab...

CVE-2026-69214

creationtimestamp| type| source ---|---|--- 2026-09-16 12:31:32+00:00| seen| https://gist.github.com/alon710/221abefe2acc671410201ad821c4e263...

CVE-2026-69215

creationtimestamp| type| source ---|---|--- 2026-09-16 11:31:08+00:00| seen| https://gist.github.com/alon710/206e1d7f5d7a93ae1831f66088f759d5...

CVE-2026-69216

creationtimestamp| type| source ---|---|--- 2026-09-16 10:31:48+00:00| seen| https://gist.github.com/alon710/6236e1774119e3087877ec4be7fad5a0...

CVE-2026-69218

creationtimestamp| type| source ---|---|--- 2026-09-16 09:31:31+00:00| seen| https://gist.github.com/alon710/1d7bf0359f0215ea04330c59b303d19c...

GHSA-7GCF-G7XR-8HXJ

creationtimestamp| type| source ---|---|--- 2026-09-16 08:42:54+00:00| seen| https://gist.github.com/konard/c75c144385121c66aab9af215012c487 2026-10-03 08:03:43+00:00| seen| https://gist.github.com/citadelculture/7a9642cc5c961c85323065559272c000...

CVE-2026-69201

creationtimestamp| type| source ---|---|--- 2026-09-16 08:31:24+00:00| seen| https://gist.github.com/alon710/fead0572986f52123b115657c419a992...

CVE-2026-86108

creationtimestamp| type| source ---|---|--- 2026-09-16 08:02:29+00:00| seen| https://gist.github.com/ichintu/267a83b424137af67bec5f39bcd35594...

CVE-2026-92773: Authorization Bypass Through User-Controlled Key

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...

CVE-2026-61554

creationtimestamp| type| source ---|---|--- 2026-09-15 22:35:05+00:00| published-proof-of-concept| https://github.com/jm33-m0/emp3r0r/security/advisories/GHSA-4595-rvpx-4q34...

CVE-2026-61568

creationtimestamp| type| source ---|---|--- 2026-09-15 22:35:03+00:00| published-proof-of-concept| https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-vmp7-252j-cwp7 2026-09-16 07:10:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvmlhqrvhm2t...

CVE-2026-61559

creationtimestamp| type| source ---|---|--- 2026-09-15 22:35:01+00:00| published-proof-of-concept| https://github.com/zereight/gitlab-mcp/security/advisories/GHSA-2h44-8472-frjj 2026-09-15 22:54:24+00:00| seen| https://bsky.app/profile/standup.thecompound.tech/post/3mvlprcfb7g2w 2026-09-16...

CVE-2026-58502

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

EUVD-2026-78911

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...