36499 matches found
GHSA-2WVG-62QM-GJ33
creationtimestamp| type| source ---|---|--- 2026-04-06 21:21:26+00:00| published-proof-of-concept| Telegram/xKxKUYX0BRejEqYlrURXsjCQY9BctYcoeewNmSMWqY7riM...
Exploit for Out-of-bounds Write in Fortinet Fortiproxy
CVE-2023-27997 XORtigate Detection System نظام آلي للكشف عن...
GHSA-RRVG-CXH4-QHRV vulnerabilities
Vulnerabilities for packages: py3-oauthenticator...
GHSA-6326-W46W-PPJW
creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:44+00:00| seen| Telegram/RmP7l-K41x9UoCBscD5W8eizA4yDJaPJqAKKOeWwXNyu-8...
GHSA-V8X3-W674-55P5
creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:29+00:00| published-proof-of-concept| Telegram/0wjdVVOdHVRh-NR-AUdnOvXJcqqbi6lE8Vl80iGy2s6Zy0...
GHSA-WC4H-2348-JC3P
creationtimestamp| type| source ---|---|--- 2026-04-06 19:29:09+00:00| seen| Telegram/t1F-Vxaulmn07lvg5ppSTSOssGvqtwkUpkkBVUVRjFPlk...
CVE-2026-27124
A flaw was found in FastMCP and FastMCP OAuthProxy. The OAuthProxy, used for GitHub OAuth authentication, does not properly validate a user's consent after receiving an authorization code from GitHub. This, combined with GitHub's behavior of skipping the consent page for previously authorized...
GHSA-W88V-VQHQ-5P24
creationtimestamp| type| source ---|---|--- 2026-04-06 17:32:38+00:00| seen| Telegram/n5Nok-XlRHEre5O89LvYLplT02rw8wZYprnGR4USXlLgM...
DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea
Threat actors likely associated with the Democratic People's Republic of Korea DPRK have been observed using GitHub as command-and-control C2 infrastructure in multi-stage attacks targeting organizations in South Korea. The attack chain, per Fortinet FortiGuard Labs, involves obfuscated Windows...
CVE-2026-39365
creationtimestamp| type| source ---|---|--- 2026-04-06 12:13:21+00:00| published-proof-of-concept| https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9 2026-04-06 12:13:21+00:00| published-proof-of-concept| https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9...
github-repo-scanner
No d...
GHSA-QV7J-4883-HWH7 vulnerabilities
Vulnerabilities for packages: gitlab-cng, ruby3.3-rack, ruby3.4-rack, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby3.2-rack, ruby3.4-rails, pact-broker-docker, ruby4.0-rack, ruby3.2-rails, kube-fluentd-operator, gitlab-rails-ce-fips...
GHSA-VGPV-F759-9WX3 vulnerabilities
Vulnerabilities for packages: gitlab-cng, ruby3.3-rack, ruby3.4-rack, logstash, pact-broker-docker-fips, gitlab-rails-ce, ruby3.2-rack, ruby3.4-rails, pact-broker-docker, ruby4.0-rack, ruby3.2-rails, kube-fluentd-operator, gitlab-rails-ce-fips...
LLM-Enabled Open-Source Systems in the Wild: An Empirical Study of Vulnerabilities in GitHub Security Advisories
Large language models LLMs are increasingly embedded in open-source software OSS ecosystems, creating complex interactions among natural language prompts, probabilistic model outputs, and execution-capable components. However, it remains unclear whether traditional vulnerability disclosure...
GHSA-6P2J-742G-835F actions-mkdocs: Command Injection via issue title in internal GitHub Actions workflow
Summary External input from github.event.issue.title is used unsafely in a shell command in .github/workflows/release-candidate.yaml, allowing command injection during workflow execution. Details In .github/workflows/release-candidate.yaml, the issue title is interpolated directly into a shell...
GHSA-9WFR-W7MM-PC7F
creationtimestamp| type| source ---|---|--- 2026-04-04 01:18:49+00:00| seen| Telegram/Wq2MikHHjaMT3QcZYic1EqOjYlzbZBeR3fuLUZ6lQSb49CA...
PT-2026-32614
Summary External input from github.event.issue.title is used unsafely in a shell command in .github/workflows/release-candidate.yaml, allowing command injection during workflow execution. Details In .github/workflows/release-candidate.yaml, the issue title is interpolated directly into a shell...
GHSA-67JX-R9PV-98RJ
creationtimestamp| type| source ---|---|--- 2026-04-03 19:24:00+00:00| published-proof-of-concept| Telegram/l2CWtN20f6D8WOiAClhqJgrdc6BQljDZCBDw2ZgpHM67Hss...
Do not get high(jacked) off your own supply (chain)
In the span of just a few weeks, we have observed a dizzying array of major supply chain attacks. Prominent examples include the malicious modification of Axios, a popular HTTP client library for JavaScript, as well as cascading compromises from TeamPCP, a "chaos-as-a-service" group that injected...