35883 matches found
CVE-2026-19349: Authentication Bypass by Primary Weakness
Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormIn...
PT-2026-73165
Lemonldap::NG::Portal versions from 2.0.0 before 2.16.9, from 2.17.0 before 2.21.5, from 2.22.0 before 2.23.3 for Perl allow authentication bypass via an OAuth2 state parameter stored as an SSO session in the GitHub and LinkedIn backends. Before redirecting to the identity provider, extractFormIn...
MAL-2026-14051 Malicious code in @velliajs/discord (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d The package presents itself as a discord.js clone repository field points at the real github.com/discordjs/discord.js.git, README instructs import...
ROOT-APP-PYPI-GHSA-X284-J5P8-9C5P GHSA-x284-j5p8-9c5p in pypdf - Patched by Root
Root has patched GHSA-x284-j5p8-9c5p in the pypdf package for Root:PyPI. Multiple fixed versions available...
CGA-5JV8-2R2W-W96F
Bulletin has no description...
CGA-4HQ2-XFH8-48P2
Bulletin has no description...
CGA-3WRW-J3V8-82P9
Bulletin has no description...
GO-2024-3310 vulnerabilities
Vulnerabilities for packages: gh...
GO-2026-4569 vulnerabilities
Vulnerabilities for packages: ferretdb, gptscript, datadog-agent, opencost, github-mcp-server, osv-scanner, jaeger...
GHSA-RM3M-9MVW-68FH
creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...
GHSA-MXCG-P696-RM94
creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...
GHSA-J8XF-5FW2-F99Q
creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...
GHSA-P28V-F755-9QRG
creationtimestamp| type| source ---|---|--- 2026-08-13 21:32:39+00:00| seen| https://gist.github.com/alon710/9ad8f19dc4256e5aad5d6b3105b603da...
CVE-2026-73561
creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:18+00:00| published-proof-of-concept| https://github.com/anephenix/hub/security/advisories/GHSA-g5vv-q72c-7j78...
GHSA-48P8-G2FX-3WWM
creationtimestamp| type| source ---|---|--- 2026-08-13 17:32:46+00:00| seen| https://gist.github.com/alon710/ee760ed8dd4e3944f68b62f514473cdc...
CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in DeleteCollaboration...
CVE-2026-58443
Public-only repository tokens can update private PR head branches...
CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-56443
Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...
CVE-2026-24059
The GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token...