CVE-2026-82289

Gitingest (through 0.3.1 ) has a flaw in its _validate_host function that accepts any hostname with a git. , gitlab. , or github. prefix without verifying membership in a known-hosts list. An attacker can supply a URL with a crafted hostname (e.g., github.evil.com), causing the application to ope...

CVE-2026-82289

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-82289 Gitingest Prefix-Based Git Host Check Enables Request Forgery and Token Disclosure

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-82282

Atlantis (through version 0.47.1 ) contains an authentication bypass in the /github-app/setup endpoint. The endpoint fails to require authentication, allowing unauthenticated callers to observe or intercept the GitHub redirect during app setup and extract the RSA private key and webhook secret . ...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

EUVD-2026-67813

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

CVE-2026-82282 Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...

GHSA-Q6FP-RFWR-759P

creationtimestamp| type| source ---|---|--- 2026-08-28 15:25:39+00:00| seen| https://gist.github.com/abhi04anon/8ce0b68a5a7dda8a0501cbaf933173eb...

CVE-2026-77177

creationtimestamp| type| source ---|---|--- 2026-08-28 15:25:39+00:00| seen| https://gist.github.com/abhi04anon/8ce0b68a5a7dda8a0501cbaf933173eb 2026-09-29 22:07:10+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mwotnqy3rw2f...

GHSA-RGW5-RVV9-X895

creationtimestamp| type| source ---|---|--- 2026-08-28 09:36:02+00:00| seen| https://gist.github.com/konard/4ba388beb31caacd09fbc15019f8e274 2026-09-03 19:24:36+00:00| seen| https://gist.github.com/konard/05d19a59942ef51514e30abcc55dbc13 2026-09-03 20:24:38+00:00| seen|...

CVE-2026-56100

creationtimestamp| type| source ---|---|--- 2026-08-28 08:28:59+00:00| seen| https://gist.github.com/sud0why/e73405057dd7414a8c221ef17e0d0059 2026-08-29 12:48:14+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mu7vxqhwb622 2026-08-29 17:03:34+00:00| seen|...

GHSA-M452-Q8C9-RG2F vulnerabilities

Vulnerabilities for packages: apache-pulsar, tez, druid, apache-pulsar-fips, pinot-fips, pinot...

GHSA-GVRW-QQP5-JGC5

creationtimestamp| type| source ---|---|--- 2026-08-28 02:33:07+00:00| seen| https://gist.github.com/alon710/6538c11be757e60d0a7d8025d09bf775...

GHSA-R5PM-VRC5-3M73

creationtimestamp| type| source ---|---|--- 2026-08-28 01:31:29+00:00| seen| https://gist.github.com/alon710/95bf554559835da78ddd9ef64b2fd7a2...

CVE-2026-54713

creationtimestamp| type| source ---|---|--- 2026-08-28 01:31:29+00:00| seen| https://gist.github.com/alon710/95bf554559835da78ddd9ef64b2fd7a2...

CVE-2026-55558

creationtimestamp| type| source ---|---|--- 2026-08-28 00:31:38+00:00| seen| https://gist.github.com/alon710/a5f4630118da96558b479a90bb02c09c...

CVE-2026-82289: Server-Side Request Forgery (SSRF)

Gitingest through 0.3.1 fails to properly validate hostnames in validatehost, accepting any host with a git., gitlab., or github. prefix regardless of known-hosts list membership. Attackers can submit URLs with attacker-controlled hostnames to trigger outbound connections to arbitrary hosts and...

CVE-2026-82282: Missing Authentication for Critical Function

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...