PT-2026-68324

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.21 Description An unauthenticated attacker can cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containin...

CVE-2026-17556: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...

PT-2026-68302

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40 Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or...

osbuild-composer security update

175-1.0.1 - Track github upstream...

CVE-2026-15996: Uncontrolled Recursion

A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameter...

CVE-2026-48168: Missing Authorization

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Indicators of compromise IOC 4. Microsoft Defender XDR detections 5. Advanced hunting queries 6. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400...

GHSA-CHGM-3698-JM42

creationtimestamp| type| source ---|---|--- 2026-08-04 23:31:07+00:00| seen| https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a 2026-08-05 00:00:39+00:00| seen| https://gist.github.com/alon710/c4a761947b80459c983e02321c736c9a...

CVE-2026-70489

creationtimestamp| type| source ---|---|--- 2026-08-04 22:35:14+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-73cq-mcgh-379c...

CVE-2026-70492

creationtimestamp| type| source ---|---|--- 2026-08-04 21:55:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bzto3ybcv52fo 2026-08-04 22:35:08+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-pwxh-7358-jq2x 2026-08-05...

CVE-2026-70480

creationtimestamp| type| source ---|---|--- 2026-08-04 20:35:07+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-rffm-9q57-q649...

GHSA-8X5V-CPV7-8JJP

creationtimestamp| type| source ---|---|--- 2026-08-04 20:31:40+00:00| seen| https://gist.github.com/alon710/a07f9786cabb1f06c1eba431ddd448e4...

CVE-2026-70485

creationtimestamp| type| source ---|---|--- 2026-08-04 20:31:40+00:00| seen| https://gist.github.com/alon710/a07f9786cabb1f06c1eba431ddd448e4 2026-08-04 20:35:03+00:00| published-proof-of-concept| https://github.com/open-webui/open-webui/security/advisories/GHSA-8x5v-cpv7-8jjp...

GHSA-PM4M-PH32-GHV5 vulnerabilities

Vulnerabilities for packages: renovate, kubeflow-pipelines...

GHSA-V3R7-H72X-CJCM vulnerabilities

Vulnerabilities for packages: renovate, code-server, langfuse, saf, pulumi, npm, vitess, prism...

CVE-2026-69263

creationtimestamp| type| source ---|---|--- 2026-08-04 18:35:10+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-xc48-889x-5qmw 2026-08-06 20:45:14+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-flowise 2026-08-12 14:00:03+00:00|...

GHSA-RWRP-9823-P2XQ

creationtimestamp| type| source ---|---|--- 2026-08-04 18:31:34+00:00| seen| https://gist.github.com/alon710/f760ad982633274fcad75b35ba6ece57...

Malicious code in @umacloud/cli-linux-arm64 (npm)

npm/@umacloud/cli-linux-arm64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @umacloud/cli-linux-x64 (npm)

npm/@umacloud/cli-linux-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11551 Malicious code in @adminide-stack/clock-tik-browser (npm)

npm/@adminide-stack/clock-tik-browser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...