CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

EUVD-2026-78586

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

CVE-2026-45052

creationtimestamp| type| source ---|---|--- 2026-09-15 10:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvkf2lbrim24 2026-09-15 12:07:20+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvklmb5fi32g 2026-09-15 16:01:41+00:00| seen|...

CVE-2026-7646

creationtimestamp| type| source ---|---|--- 2026-09-15 08:01:49+00:00| seen| https://gist.github.com/ichintu/61eae90f050b47deb0b3d5ff8144d16f...

CVE-2026-90843

creationtimestamp| type| source ---|---|--- 2026-09-15 04:02:20+00:00| seen| https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621...

CVE-2026-91771

creationtimestamp| type| source ---|---|--- 2026-09-15 04:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvjqfgnwax2z 2026-09-15 04:02:20+00:00| seen| https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621 2026-09-15 12:50:04+00:00| seen|...

CVE-2026-46696

creationtimestamp| type| source ---|---|--- 2026-09-15 01:32:02+00:00| seen| https://gist.github.com/alon710/a0fdd505cf6388a20a8132f22b04c968...

CVE-2026-49400

creationtimestamp| type| source ---|---|--- 2026-09-15 00:31:20+00:00| seen| https://gist.github.com/alon710/65b5c64d62229349e54e21de9ec5c14b...

CVE-2026-16335

creationtimestamp| type| source ---|---|--- 2026-09-15 00:04:06+00:00| seen| https://gist.github.com/ichintu/bb350504840f7717d8931db615795f78...

CVE-2026-54168: Improper Privilege Management

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...

PT-2026-92173

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE TITLE before shell parsing. An issue title containing...

CVE-2026-54167: Insufficient Verification of Data Authenticity

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...

CVE-2026-58502: Improper Neutralization of Special Elements used in an OS Command

githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...

CVE-2026-84567

creationtimestamp| type| source ---|---|--- 2026-09-14 22:42:31+00:00| seen| https://gist.github.com/ataberk-xyz/2c387bbc201a6ab0d6ed0c4cb610d86a 2026-09-15 00:00:09+00:00| seen| https://gist.github.com/ataberk-xyz/2c387bbc201a6ab0d6ed0c4cb610d86a 2026-09-15 04:50:49+00:00| seen|...

CVE-2026-76081

creationtimestamp| type| source ---|---|--- 2026-09-14 22:32:03+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3 2026-09-15 00:00:09+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3...

GHSA-V859-C572-QH5P

creationtimestamp| type| source ---|---|--- 2026-09-14 22:32:03+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3 2026-09-15 00:00:09+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3...

CVE-2026-90814

A Server-Side Request Forgery (SSRF) vulnerability exists in cosmicstack-labs mercury-agent up to version 1.1.13 . The flaw is in the githubRequest function within the GitHub API Handler component (file src/utils/github.ts), where manipulation of the path argument allows a remote, low-privilege a...

CVE-2026-90814 cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery

A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of...