31395 matches found
CVE-2026-14967
BBOT's githubworkflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODEREPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...
github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability
A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability...
CVE-2026-54344
CVE-2026-54344 affects ToolJet prior to version 3.20.180. The render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, enabling any GitHub user who can comment on an open PR with a deploy command to execute shell commands on the CI ...
EUVD-2026-42299
ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a...
EUVD-2026-42296
BBOT's githubworkflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODEREPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...
CVE-2026-14967 Path traversal in github_workflows allows writing artifacts outside output directory
BBOT's githubworkflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODEREPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...
CVE-2026-14967
BBOT’s github_workflows module has a path-traversal vulnerability: the path-containment check fails to resolve ‘..’, allowing a crafted CODE_REPOSITORY URL to traverse out of the configured output directory. The write is bounded to two directory levels above the output location and the target is ...
GHSA-RMMH-P597-PPVV vulnerabilities
Vulnerabilities for packages: opensearch-dashboards-fips, opensearch-dashboards...
GHSA-CWX4-F9X9-PQHH vulnerabilities
Vulnerabilities for packages: linux-aws, linux-azure, linux-vmware, linux-gcp, linux-qemu-melange, linux-qemu...
GHSA-3J9Q-258H-4V38 vulnerabilities
Vulnerabilities for packages: linux-aws, linux-azure, linux-vmware, linux-gcp, linux-qemu-melange, linux-qemu...
GHSA-JMF6-3V74-7X28 vulnerabilities
Vulnerabilities for packages: linux-aws, linux-azure, linux-vmware, linux-gcp, linux-qemu-melange, linux-qemu...
GHSA-WWC5-7R8X-52GG vulnerabilities
Vulnerabilities for packages: linux-aws, linux-azure, linux-vmware, linux-gcp, linux-qemu-melange, linux-qemu...
CVE-2026-53530
creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:13+00:00| published-proof-of-concept| https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj...
CVE-2026-53531
creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:11+00:00| published-proof-of-concept| https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7...
CVE-2026-53487
creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:09+00:00| published-proof-of-concept| https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8...
CVE-2026-53553
creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:05+00:00| published-proof-of-concept| https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw...
GO-2026-5799 Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus
Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus...
GO-2026-5570 Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf
Free5gc NRF is vulnerable to scope validation bypass via maliciously crafted targetNF value in github.com/free5gc/nrf...
GO-2026-5924 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder
Coder's session token leaked to arbitrary hosts via coder open app for external workspace apps in github.com/coder/coder...