GHSA-CJ63-JHHR-WCXV vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips...

CVE-2026-35580

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflowdispatch inputs were interpolated directly into shell commands via $ expression syntax. An attacker with repository write access could...

UBUNTU-CVE-2026-33816

Memory-safety vulnerability in github.com/jackc/pgx/v5...

CVE-2026-35580 Emissary has GitHub Actions Shell Injection via Workflow Inputs

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflowdispatch inputs were interpolated directly into shell commands via $ expression syntax. An attacker with repository write access could...

CVE-2026-35580

Emissary is a P2P based data-driven workflow engine. Prior to 8.39.0, GitHub Actions workflow files contained shell injection points where user-controlled workflowdispatch inputs were interpolated directly into shell commands via $ expression syntax. An attacker with repository write access could...

CVE-2026-35580

Emissary (a P2P data-driven workflow engine) contains a shell-injection vulnerability in GitHub Actions workflow files prior to version 8.39.0. User-controlled workflow_dispatch inputs could be interpolated directly into shell commands via ${{ }} expressions in run blocks, enabling an attacker wi...

CVE-2026-33816 CVE-2026-33816 in github.com/jackc/pgx

Memory-safety vulnerability in github.com/jackc/pgx/v5...

GO-2026-4736 GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute in github.com/osrg/gobgp

GoBGP vulnerable to a denial of service via the NEXTHOP path attribute in github.com/osrg/gobgp...

GO-2026-4886 Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus

Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus...

GO-2026-4885 Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus

Incus vulnerable to local privilege escalation through VM screenshot path in github.com/lxc/incus...

GO-2026-4790 Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service in github.com/elastic/beats

Metricbeat Allocates Memory with Excessive Size Value Leading to Denial of Service in github.com/elastic/beats...

GO-2026-4882 Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus

Incus does not verify combined fingerprint when downloading images from simplestreams servers in github.com/lxc/incus...

GO-2026-4881 Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus

Incus vulnerable to arbitrary file read and write through pongo templates in github.com/lxc/incus...

GO-2026-4772 CVE-2026-33816 in github.com/jackc/pgx

Memory-safety vulnerability in github.com/jackc/pgx/v5...

The Trojan horse of cybercrime: Weaponizing SaaS notification pipelines

By Diana Brown Cisco Talos has recently observed an increase in activity that is leveraging notification pipelines in popular collaboration platforms to deliver spam and phishing emails. These emails are transmitted using the legitimate mail delivery infrastructure associated with GitHub and Jira...

GHSA-C427-H43C-VF67 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, dask-kubernetes, checkov, kubeflow-pipelines-visualization-server, open-webui, kserve, airflow...

GHSA-M5QP-6W8W-W647 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, dask-kubernetes, checkov, kubeflow-pipelines-visualization-server, open-webui, kserve, airflow...

Emissary command injection vulnerability

Emissary is a distributed P2P data-driven workflow framework developed by the National Security Agency. Versions of Emissary prior to 8.39.0 contained a command injection vulnerability. This vulnerability stemmed from shell injection points in the GitHub Actions workflow files. User-controlled...

PT-2026-31009

Name of the Vulnerable Software and Affected Versions dbt affected versions not specified Description dbt allows data analysts and engineers to transform data using software engineering practices. A command injection issue exists in the workflow located at...

CVE-2026-39382: Improper Neutralization of Special Elements used in an OS Command

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an...