CVE-2026-44316

creationtimestamp| type| source ---|---|--- 2026-05-08 22:39:43+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-wr8j-6chw-gm6p...

CVE-2026-42298

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...

CVE-2026-42298 Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow .github/workflows/pr-docker-build.yml allows any unauthenticated user to execute arbitrary code during the Docker build process and exfiltrate a...

CVE-2026-42298

CVE-2026-42298 affects Postiz (AI social media scheduling tool). The issue arises in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml), where an unauthenticated user can cause arbitrary code execution during Docker image build by submitting a fork with a malic...

CVE-2026-44209

creationtimestamp| type| source ---|---|--- 2026-05-08 20:36:22+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-gphh-9q3h-jgpp...

GHSA-H9HM-M2XJ-4RQ9

creationtimestamp| type| source ---|---|--- 2026-05-08 20:10:29+00:00| seen| https://gist.github.com/alon710/b2fb36b6ecfecf3424b0cb12c54264f5...

GHSA-MPM8-CX2P-626Q

creationtimestamp| type| source ---|---|--- 2026-05-08 19:10:29+00:00| seen| https://gist.github.com/alon710/81381888e21682cdeae4882d5cd6667d...

GHSA-95C3-6VVW-4MRQ MCP Registry's GitHub OIDC tokens are replayable across registry deployments due to shared audience

SECURITY registry001 Vulnerability Report While analyzing the code logic, an area that may lead to unintended behavior under specific conditions was discovered. Overview - Verified Version: c5c4b9e8890dd5754bee889b2f1417f4fe3b5ce5 - Vulnerability Type: Authentication bypass via cross-registry OID...

CVE-2026-44334

PraisonAI is a multi-agent teams system. From version 4.5.139 to before version 4.6.32, CVE-2026-40287's fix gated tools.py auto-import behind PRAISONAIALLOWLOCALTOOLS=true in two files toolresolver.py, api/call.py. A third import sink in praisonai/templates/tooloverride.py was missed and remains...

GHSA-FP55-JW48-C537 vulnerabilities

Vulnerabilities for packages: pixi, uv...

GHSA-XX64-WWV2-HCQQ vulnerabilities

Vulnerabilities for packages: pixi, uv...

GHSA-PP6C-GR5W-3C5G vulnerabilities

Vulnerabilities for packages: airflow, reflex, semgrep...

GHSA-2C5C-CHWR-9HQW vulnerabilities

Vulnerabilities for packages: apache-hop, trino, spark-fips, opensearch-fips, spark-kubernetes-operator, camunda, spark-kubernetes-operator-fips, apache-hop-fips, camunda-zeebe, celeborn, opensearch, spark, druid...

CGA-4JV6-2PRH-V7MR

Bulletin has no description...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

GHSA-P3HW-MV63-RF9W vulnerabilities

Vulnerabilities for packages: jujutsu, cargo-audit, codex, cargo-c...

GHSA-P334-GFHQ-C7W6 vulnerabilities

Vulnerabilities for packages: jenkins...

CVE-2026-45152

creationtimestamp| type| source ---|---|--- 2026-05-08 05:58:32+00:00| published-proof-of-concept| https://github.com/uniget-org/cli/security/advisories/GHSA-qqq4-5773-pmw5 2026-05-27 23:01:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmumf5pusa2l 2026-05-27...

GHSA-RMX9-2PP3-XHCR vulnerabilities

Vulnerabilities for packages: tekton-chains, tkn...

GHSA-38F8-5428-X5CV vulnerabilities

Vulnerabilities for packages: logstash, sonarqube, spark-fips, commercial-elasticsearch, elasticsearch-fips, nuxeo, apache-nifi, apache-pulsar-fips, docker-selenium, elasticsearch, localstack, management-api-for-apache-cassandra-4.0, knative-kafka-broker, selenium, druid,...