PT-2026-65504

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...

CVE-2026-9830

creationtimestamp| type| source ---|---|--- 2026-07-27 21:00:03+00:00| seen| Telegram/jZonNK9LGMSvoC2Djs86LRDYxmpyv3NgFItsHIOxESbAXI 2026-07-27 21:00:03+00:00| seen| Telegram/MNUQPIGpAGeGg3WQfZgMMHal6jpwzokF-mfI2PhU7te8xo 2026-07-27 21:00:03+00:00| seen| https://t.me/GithubRedTeam/95407 2026-07-2...

GHSA-MFG7-5GFP-C4W3 vulnerabilities

Vulnerabilities for packages: apicurio-registry, keycloak, celeborn, kayenta, s3proxy-fips, elasticsearch, spark-kubernetes-operator, kafka-bridge, traccar, spark-kubernetes-operator-fips, keycloak-fips, conductor-fips, opensearch-fips, strimzi-kafka-operator-fips, apache-nifi, camunda-zeebe,...

GHSA-XCPC-8H2W-3J85 vulnerabilities

Vulnerabilities for packages: sqlpad...

GHSA-MH99-V99M-4GVG vulnerabilities

Vulnerabilities for packages: pulumi, npm, serve, sqlpad, thingsboard, nextcloud-server, lerna, rancher-api-ui, opensearch-dashboards, argo-workflows...

GHSA-G35J-M5XG-VH3Q vulnerabilities

Vulnerabilities for packages: spegel-fips, rke2-runtime, k3s, ipfs-cluster, kubo, ipfs-cluster-fips, rke2-runtime-fips, spegel...

GHSA-P6PH-3JX2-3337

creationtimestamp| type| source ---|---|--- 2026-07-25 16:31:29+00:00| seen| https://gist.github.com/alon710/7ac48e75205a16d278d7edd78b6790dd...

GHSA-Q53C-4PRM-W95Q

creationtimestamp| type| source ---|---|--- 2026-07-25 11:31:34+00:00| seen| https://gist.github.com/alon710/7d82b3a29a466133e3b991f0cb56fd86...

GHSA-JVXP-QMX7-GJPX

creationtimestamp| type| source ---|---|--- 2026-07-25 04:31:18+00:00| seen| https://gist.github.com/alon710/5da01f85fee825f05b5c606f0085a6c9...

GHSA-8Q49-2H5H-434X

creationtimestamp| type| source ---|---|--- 2026-07-25 00:32:46+00:00| seen| https://gist.github.com/alon710/2148318b0f0c526c708bd7a87404909b...

openSUSE 16 Security Update : gh (openSUSE-SU-2026:21432-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21432-1 advisory. Changes in gh: - CVE-2026-39821: reject all-ASCII xn-- Punycode labels in the vendored golang.org/x/net/idna package regardless of Go's unicode.Version...

CVE-2026-62323

creationtimestamp| type| source ---|---|--- 2026-07-24 22:35:05+00:00| published-proof-of-concept| https://github.com/cloudreve/cloudreve/security/advisories/GHSA-c3jm-gv5r-9wcp...

GHSA-4633-3J49-MH5Q vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse...

GHSA-HVRM-45R6-MJFJ vulnerabilities

Vulnerabilities for packages: langfuse...

GO-2026-5471 Kratos has a Confused Deputy issue in github.com/go-kratos/kratos

Kratos has a Confused Deputy issue in github.com/go-kratos/kratos...

CVE-2026-61632

creationtimestamp| type| source ---|---|--- 2026-07-24 18:35:21+00:00| published-proof-of-concept| https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2...

CVE-2026-59220

creationtimestamp| type| source ---|---|--- 2026-07-24 18:35:19+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-ffpj-xv5c-p3gw...

CVE-2026-59714

creationtimestamp| type| source ---|---|--- 2026-07-24 18:35:10+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-x2ff-v5v8-m75m...

GHSA-PG7V-JWJ7-P798 vulnerabilities

Vulnerabilities for packages: open-webui, superset, mlflow...

EUVD-2024-55699

cal.com calcom repository, later renamed cal.diy is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pullrequesttarget trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then...