35887 matches found
GHSA-55Q2-FJHQ-7XH7 vulnerabilities
Vulnerabilities for packages: awx, opensearch-dashboards, nextcloud-server, langfuse, gitlab-rails-ce, librechat, wazuh-dashboard-fips, kibana, langfuse-fips, wazuh-dashboard, jupyter-base-notebook, tensorflow-gpu-jupyter, opensearch-dashboards-fips, gitlab-rails-ce-fips...
Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...
CVE-2026-72871: Missing Authentication for Critical Function
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...
PT-2026-69912
Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description The unauthenticated '/api/providers/github/setup' endpoint trusts organizationId and userId values provided via the state parameter. This occurs when the createGithub function is called, allowing a...
Eopi-Hunt-Skill
Eopi-Hunt-Skill Authorized security research toolkit comb...
EUVD-2026-54932
A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high...
GHSA-FWG2-594C-JP42 vulnerabilities
Vulnerabilities for packages: open-webui, nemo, litellm...
GHSA-FP3F-MC75-235C vulnerabilities
Vulnerabilities for packages: open-webui, nemo, litellm...
GitHub PAT Repository Enumeration
Uses leaked GitHub tokens ghp, githubpat to identify the token owner, list accessible repositories including private, and enumerate organizations. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate GitHub repos and orgs using leaked personal access tokens.""" from kittysploit import from...
GitHub Actions Workflow Secrets Detection
Probes common /.github/workflows/.yml paths for exposed CI definitions and flags inline secrets, $ secrets. references, PATs, and private keys. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed GitHub Actions workflow files and CI secret references.""" from kittysploit import from...
Hacked-Machines
HTB Writeups A collection of Hack The Box machines, solve...
GHSA-29G2-3RMR-QM68
creationtimestamp| type| source ---|---|--- 2026-08-08 08:31:57+00:00| seen| https://gist.github.com/alon710/47ff7eb96677e04e1cb388be69ae9049...
GHSA-89VP-JRXV-24W8 vulnerabilities
Vulnerabilities for packages: tensorflow-cpu-jupyter...
CVE-2026-63220
creationtimestamp| type| source ---|---|--- 2026-08-08 06:36:21+00:00| seen| https://gist.github.com/alon710/8161c68753a945887582acb72752fba7...
CVE-2026-71557
creationtimestamp| type| source ---|---|--- 2026-08-08 03:02:14+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/97106 2026-08-08 10:39:06+00:00| seen| https://gist.github.com/alon710/71d0ff9c71dc1f5ee8e40bba3da46014 2026-08-09 00:29:23+00:00| published-proof-of-concept|...
malwoverview v8.1.0
Malwoverview !Alt...
CVE-2026-67422
creationtimestamp| type| source ---|---|--- 2026-08-07 21:05:02+00:00| published-proof-of-concept| https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw 2026-08-08 02:32:35+00:00| seen| https://gist.github.com/alon710/6f3e0768fc0386f4c965af62333fef78 2026-08-1...
GHSA-3F7W-8RR8-F37F vulnerabilities
Vulnerabilities for packages: awx, jupyter-all-spark-notebook, mlflow...
Insertion of Sensitive Information Into Sent Data
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the gh auth status process. An attacker can obtain partial authentication token values by accessing terminal or CI output where the process was executed. This is only exploitable if ...