738 matches found
gh_release_test
GitHub.com Release Test Project This is a demo of the functionality higlighted in the following blog post: https://wwws.nightwatchcybersecurity.com/2021/04/25/supply-chain-attacks-via-github-com-releases/ Please direct any questions to [email protected]...
GO-2026-6237 Denial of service via malformed IPv4 packet in github.com/insomniacslk/dhcp
In github.com/insomniacslk/dhcp/dhcpv4/nclient4, BroadcastRawUDPConn.ReadFrom does not validate that the IPv4 payload length is sufficient to hold a UDP header before calculating the DHCP payload length. A frame with an IPv4 total-length field specifying fewer than eight payload bytes results in ...
GO-2026-5906 Coder: User-admin role can reset owner account password in github.com/coder/coder
Coder: User-admin role can reset owner account password in github.com/coder/coder...
GO-2026-5150 File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser
File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser...
ROOT-APP-GOBINARY-CVE-2026-42306 CVE-2026-42306 in rootio-github.com/docker/docker - Patched by Root
Root has patched CVE-2026-42306 in the rootio-github.com/docker/docker package for Root:Go. Multiple fixed versions available...
PT-2026-42374
DevGuard has an unauthenticated identity assertion via X-Admin-Token header in github.com/l3montree-dev/devguard...
Securing GitHub: Wiz Research uncovers Remote Code Execution in GitHub.com and GitHub Enterprise Server (CVE-2026-3854)
Details on CVE-2026-3854: A critical flaw in GitHub’s internal git infrastructure enabling RCE on GitHub.com and GitHub Enterprise Server...
GO-2026-4489 FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp
FrankenPHP leaks session data between requests in worker mode in github.com/dunglas/frankenphp...
GO-2026-4414 Alist has Insecure TLS Config in github.com/alist-org/alist
Alist has Insecure TLS Config in github.com/alist-org/alist...
PT-2026-6518
Incus container environment configuration newline injection in github.com/lxc/incus...
GO-2025-4003 CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd
CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI in github.com/canonical/lxd...
GO-2025-4036 Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server
Mattermost has an Observable Timing Discrepancy vulnerability in github.com/mattermost/mattermost-server...
EUVD-2023-1536
Malicious code in bioql PyPI...
GO-2025-3967 esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh
esm.sh has arbitrary file write via path traversal in X-Zone-Id header in github.com/esm-dev/esm.sh...
Cross-site Scripting (XSS)
github.com/forceu/gokapi is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the API key renaming feature, which allowed authenticated users to inject JavaScript that would execute when another user accessed the API tab...
GO-2025-3706 Fiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber
Fiber panics when fiber.Ctx.BodyParser parses invalid range index in github.com/gofiber/fiber...
SUSE CVE-2024-53858
The gh cli is GitHub's official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...
GO-2024-3307 CVE-2024-50948 in github.com/mochi-mqtt/server
CVE-2024-50948 in github.com/mochi-mqtt/server...
GO-2024-3310 Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability in github.com/cli/cli...