30599 matches found
Imgproxy < 3.14.0 - Cross-site Scripting (XSS)
Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0. id: CVE-2023-1496 info: name: Imgproxy 3.14.0 - Cross-site Scripting XSS author: pdteam severity: medium description: Cross-site Scripting XSS - Reflected in GitHub repository imgproxy/imgproxy prior to...
CopyParty v1.8.6 - Cross Site Scripting
Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting XSS Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link...
Reposilite >= 3.3.0, < 3.5.12 - Arbitrary File Read
Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...
EUVD-2026-51855
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...
CVE-2026-67322 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...
EUVD-2026-51853
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...
CVE-2026-67322
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through Git.polishurl, which on non-Cygwin platforms calls os.path.expandvars on the URL before invoking git clone. An attacker who controls the clone URL can emb...
CVE-2026-67308
Concretely documented CVE-2026-67308 affects Wazuh workflows prior to 44bf114. A shell injection exists in GitHub Actions workflows via fork pull requests that submit crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated in...
CVE-2026-67308
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...
CVE-2026-67308 Wazuh GitHub Actions Shell Injection via Fork Pull Request
Wazuh workflows before 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly...
Mosparo < 1.0.2 - Open Redirect
Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. id: CVE-2023-5375 info: name: Mosparo 1.0.2 - Open Redirect author: shankaracharya severity: medium description: | Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. impact: | Unauthenticated attackers can exploit...
GHSA-3GFH-MQ5V-C264 vulnerabilities
Vulnerabilities for packages: linux-vmware...
GHSA-VVP7-H4FJ-M28W
creationtimestamp| type| source ---|---|--- 2026-07-31 23:31:28+00:00| seen| https://gist.github.com/alon710/9fa87dd82b0216d33fe7579c4687415f 2026-08-01 00:00:16+00:00| seen| https://gist.github.com/alon710/9fa87dd82b0216d33fe7579c4687415f...
GHSA-WQQC-JJCQ-VFXM
creationtimestamp| type| source ---|---|--- 2026-07-31 22:32:31+00:00| seen| https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb 2026-08-01 00:00:16+00:00| seen| https://gist.github.com/alon710/f7703eb7ff99ed9d3ada7f401de565eb...
CVE-2026-62324
creationtimestamp| type| source ---|---|--- 2026-07-31 20:35:20+00:00| published-proof-of-concept| https://github.com/xdan/jodit/security/advisories/GHSA-j839-gqq4-gf9j 2026-08-01 00:15:26+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-62324...
GHSA-VJC4-5QP5-M44J vulnerabilities
Vulnerabilities for packages: superset, mlflow...
GHSA-R5W3-XV2F-J59Q vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, apache-nifi-registry...
