CVE-2026-5845

An improper authorization vulnerability in scoped user-to-server ghu token authorization in GitHub Enterprise Server allows an authenticated attacker to access private repositories outside the intended installation scope, which can include write operations, via an authorization fallback that...

CVE-2026-45033

GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security vulnerability has been identified in GitHub Copilot CLI where a malicious bare git repository nested inside a project directory can achieve arbitrary code execution when the agent...

CVE-2026-45132

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow generate-schema.yaml exposes sensitive credentials Personal Access Token and SSH signing key to fork-controlled code due to unsafe checkout and credential handling practices. Th...

CVE-2026-45131

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit fcf9302, a GitHub Actions workflow pull-request.yaml executes attacker-controlled code from fork pull requests in a privileged context, exposing repository secrets including Docker Hub credentials and tokens...

GHSA-J4XQ-8GJF-26VV vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-RXXM-P26X-J53P vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-854V-W859-V99C vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-7H3X-G348-3QM8 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-QC83-G4W3-PXPQ vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-JMG2-VQR6-G8H5 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-J27F-XG68-8FVV vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-FJ5J-5VM7-Q87M vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-39VG-P77Q-35GX vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-3GGW-GM74-WQQP vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-Q69J-7XQC-6C6X vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-7V44-Q3V7-22WM vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-4821

An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands via shell metacharacter injection in proxy configuration fields such as httpproxy. Exploitation o...

Miasma Malware Hits 32 Red Hat Packages via Compromised GitHub Account

32 Red Hat npm packages compromised by Miasma malware expose cloud tokens, CI/CD secrets and developer credentials in supply chain attack...

CVE-2026-40903

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUBTOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6...

CVE-2026-40316

OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pullrequesttarget trigger to run wit...