CVE-2026-41053 Over-inclusive team membership expansion in GitHub App authentication provider for Rancher

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2...

CVE-2026-41053

CVE-2026-41053 affects Rancher’s GitHub authentication provider, specifically the team membership expansion, where an incorrect authentication caching flaw could grant principal access to any logged-in user. Affected versions are 2.13 prior to 2.13.6 and 2.14 prior to 2.14.2. Root cause: faulty c...

CVE-2026-41053 Over-inclusive team membership expansion in GitHub App authentication provider for Rancher

Incorrect authentication caching in the team member ship expansion of the Rancher Github authentication provider caused it granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2...

GHSA-HC7R-6254-88W5 vulnerabilities

Vulnerabilities for packages: py3-systemd...

GHSA-43W5-MMXV-CPVH vulnerabilities

Vulnerabilities for packages: airbyte-server-fips, airbyte-server...

PT-2026-54000

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description A stored cross-site scripting issue exists where an authenticated attacker can execute arbitrary JavaScript in another user's browser. This occurs by injecting a crafted payload into...

PT-2026-53989

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An authenticated user can read source code from private repositories they are not authorized to access. The issue occurs because the Copilot pull request description diff summary...

GHSA-PFQ8-H8C4-MPRW

creationtimestamp| type| source ---|---|--- 2026-06-29 16:59:42+00:00| seen| https://gist.github.com/CyberKareem/601501c133cced1fae4f94d24c0da5cd...

GHSA-R8MH-X5QV-7GG2 vulnerabilities

Vulnerabilities for packages: libssh2...

PYSEC-2026-541 Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely

The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

MAL-2026-6582 Malicious code in openai-agents-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 768ddf82a7644f1678a27f3037c8a3fc4fae5f00b6181d6507a49892d20a7fda On npm install, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration files — /.gitconfig and the...

Malicious code in openai-agents-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 768ddf82a7644f1678a27f3037c8a3fc4fae5f00b6181d6507a49892d20a7fda On npm install, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration files — /.gitconfig and the...

Malicious code in @thone33/analytics-injector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcef0ea3fd19d9b238a097485faaf7db52d5aa4363653fd7fb29f4c0ff251f92 Package presents itself as an 'analytics injection helper' with a no-op track export, but its exported activate function fetches a JavaScript file fr...

GHSA-4MR2-FG2P-W63C vulnerabilities

Vulnerabilities for packages: traefik, traefik-fips...

CVE-2026-47067

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:54+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62...

CVE-2026-49342

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:42+00:00| published-proof-of-concept| https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8...

CVE-2026-53522

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:22+00:00| published-proof-of-concept| https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq...

CVE-2026-49338

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:07+00:00| published-proof-of-concept| https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95...

CVE-2026-49340

creationtimestamp| type| source ---|---|--- 2026-06-26 23:42:14+00:00| seen| https://gist.github.com/alon710/aef49efca881722a2606f374108f34f4 2026-06-27 00:00:58+00:00| seen| https://gist.github.com/alon710/aef49efca881722a2606f374108f34f4 2026-06-27 00:35:12+00:00| published-proof-of-concept|...

GHSA-HWX4-2J3J-G496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install - ignore-scripts to replace...