CVE-2026-45008

creationtimestamp| type| source ---|---|--- 2026-05-06 20:47:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-gh9p-q46p-57g2...

CVE-2026-46359

creationtimestamp| type| source ---|---|--- 2026-05-06 20:44:39+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pm8c-3qq3-72w7...

CVE-2026-45009

creationtimestamp| type| source ---|---|--- 2026-05-06 20:37:42+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-jrc5-w569-h7h5...

CVE-2026-46361

creationtimestamp| type| source ---|---|--- 2026-05-06 20:31:54+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pqh6-8fxf-jx22...

CVE-2026-45007

creationtimestamp| type| source ---|---|--- 2026-05-06 20:24:39+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-rm98-82fr-mcfx...

CVE-2026-46360

creationtimestamp| type| source ---|---|--- 2026-05-06 20:18:48+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-whqh-9pq5-c7r3...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the resetuserpassword and gympermissionsuseredit function when both the attacker and victim have gym=None. An attacker can gain unauthorized access to another user's account, obtain their new plaintext passwor...

CVE-2026-44483

creationtimestamp| type| source ---|---|--- 2026-05-06 19:32:52+00:00| published-proof-of-concept| https://github.com/airjp73/rvf/security/advisories/GHSA-c567-44rc-m5hq 2026-05-27 18:01:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mmu3mrz7jk26...

GHSA-XP3W-R5P5-63RR vulnerabilities

Vulnerabilities for packages: vector, guestproxyagent, rpm-sequoia, komodo, sentry-cli, sccache, rustup, sdp-k8s-injector, sqlx, ztunnel-fips, deno, rustls-openssl-client, bootc, typst, valkey-ldap...

CVE-2026-42184

creationtimestamp| type| source ---|---|--- 2026-05-06 16:58:35+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-7gmj-67g7-phm9 2026-07-11 18:55:02+00:00| seen| https://bsky.app/profile/smit-artem.bsky.social/post/3mqfdmjk35d2i...

GHSA-FPJQ-C37H-CQCV vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-notation-aws...

CVE-2026-42339

creationtimestamp| type| source ---|---|--- 2026-05-06 12:19:03+00:00| published-proof-of-concept| https://github.com/QuantumNous/new-api/security/advisories/GHSA-v5c3-6wvc-pc2q...

GHSA-FG3J-5W9G-HMG7

creationtimestamp| type| source ---|---|--- 2026-05-06 07:40:29+00:00| seen| https://gist.github.com/alon710/cdeb633d740e110eed8363124062a03a...

CVE-2026-44897

creationtimestamp| type| source ---|---|--- 2026-05-06 07:13:48+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-v87v-83h2-53w7 2026-08-21 22:43:14+00:00| seen| https://gist.github.com/EbonJaeger/dbd95fac767f33b74282ee64940b0537 2026-08-22...

CVE-2026-44708

creationtimestamp| type| source ---|---|--- 2026-05-06 07:09:57+00:00| published-proof-of-concept| https://github.com/lepture/mistune/security/advisories/GHSA-8g87-j6q8-g93x 2026-08-21 22:43:14+00:00| seen| https://gist.github.com/EbonJaeger/dbd95fac767f33b74282ee64940b0537 2026-08-22...

PT-2026-38304

Name of the Vulnerable Software and Affected Versions PraisonAI versions 4.5.139 through 4.6.31 Description A flaw exists in the multi-agent teams system where an import sink in praisonai/templates/tool override.py remains unguarded. This allows remote attackers to trigger arbitrary code executio...

GHSA-M7HM-VM4X-28JF vulnerabilities

Vulnerabilities for packages: dagdotdev...

@tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin

Summary Anonymous GitHub fetches repository content e.g., markdown files from GitHub's API and renders it without sanitization. On the client side, markdown is parsed with marked with sanitize: false and injected into the DOM via $sce.trustAsHtml + ng-bind-html, bypassing AngularJS's built-in XSS...

GHSA-G485-8J3V-P6X8 @tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin

Summary Anonymous GitHub fetches repository content e.g., markdown files from GitHub's API and renders it without sanitization. On the client side, markdown is parsed with marked with sanitize: false and injected into the DOM via $sce.trustAsHtml + ng-bind-html, bypassing AngularJS's built-in XSS...

Cross-site Scripting (XSS)

Overview @tdurieux/anonymousgithub is an Anonymise Github repositories for double-anonymous reviews Affected versions of this package are vulnerable to Cross-site Scripting XSS via the renderMD function. An attacker can execute arbitrary JavaScript in the application origin by crafting a maliciou...