35881 matches found
CVE-2026-55378: Improper Neutralization of Special Elements used in an OS Command
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...
PT-2026-83240
Name of the Vulnerable Software and Affected Versions JS Recon versions 1.2.1-beta.1 through 1.3.1-beta.1 Description The PR Branch Checker workflow in .github/workflows/pr checker.yml improperly handles untrusted values. Specifically, the github.head ref and github.event.pull...
PT-2026-83305
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token...
CVE-2026-54770
creationtimestamp| type| source ---|---|--- 2026-08-27 23:33:29+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:01:48+00:00| seen| https://gist.github.com/alon710/3f2dc90a23f10e17e098821e66e18187 2026-08-28 00:35:03+00:00| published-proof-of-concept|...
GHSA-Q7M3-RHXG-7VXR
creationtimestamp| type| source ---|---|--- 2026-08-27 22:31:50+00:00| seen| https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8 2026-08-28 00:01:49+00:00| seen| https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8...
CVE-2026-54687
creationtimestamp| type| source ---|---|--- 2026-08-27 22:31:50+00:00| seen| https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8 2026-08-28 00:01:49+00:00| seen| https://gist.github.com/alon710/796cb46fa1a6e144f351d5ffd2b774d8...
GHSA-G7GW-M874-7RMF
creationtimestamp| type| source ---|---|--- 2026-08-27 21:32:59+00:00| seen| https://gist.github.com/alon710/14e4e76cd8061b293a52482e75942e6f...
GHSA-39MM-RWM3-29JP
creationtimestamp| type| source ---|---|--- 2026-08-27 20:32:16+00:00| seen| https://gist.github.com/alon710/bec19cdcf2926727440026551fd338c7...
CVE-2026-54718
creationtimestamp| type| source ---|---|--- 2026-08-27 20:32:16+00:00| seen| https://gist.github.com/alon710/bec19cdcf2926727440026551fd338c7...
CVE-2026-54732
creationtimestamp| type| source ---|---|--- 2026-08-27 19:31:53+00:00| seen| https://gist.github.com/alon710/795619632fe9ba16f51e5c93358e8801 2026-10-12 20:05:39+00:00| seen| https://gist.github.com/VanyaCherneha/66e906dcbfd15e8b9ada615a20f0e583...
GHSA-GMXC-R82Q-347R
creationtimestamp| type| source ---|---|--- 2026-08-27 19:31:53+00:00| seen| https://gist.github.com/alon710/795619632fe9ba16f51e5c93358e8801...
CVE-2026-54721
creationtimestamp| type| source ---|---|--- 2026-08-27 17:32:22+00:00| seen| https://gist.github.com/alon710/39b101902c398808f3c4258d20b82798...
pansyhebephrenic23.github.io
Questo repository non contiene un README...
CVE-2026-81100
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
CVE-2026-81100
tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...
EUVD-2026-67028
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
CVE-2026-81100
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...
CVE-2025-45528
creationtimestamp| type| source ---|---|--- 2026-08-27 12:35:24+00:00| seen| https://gist.github.com/momenbasel/66e33613a52f6f59e49ee8ca6ea91a61 2026-10-23 16:03:05+00:00| seen| https://infosec.exchange/users/cve/statuses/117491065442583671...