GHSA-QXWX-HR5V-H5Q4 vulnerabilities

Vulnerabilities for packages: eco-python-curl...

CVE-2026-54650

creationtimestamp| type| source ---|---|--- 2026-07-29 02:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqtdm6wwg23 2026-07-29 02:46:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqvvxefvd2s 2026-07-29 03:32:05+00:00| seen|...

CVE-2026-54659

creationtimestamp| type| source ---|---|--- 2026-07-29 00:31:42+00:00| seen| https://gist.github.com/alon710/3def853e2525c617d6890d62679fbc37 2026-07-29 00:35:03+00:00| published-proof-of-concept| https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc 2026-07-29 03:39:55+00:00|...

CVE-2026-64863

creationtimestamp| type| source ---|---|--- 2026-07-28 23:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrqm5e554m22 2026-07-29 00:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrqmmv237e2q 2026-07-29 00:35:05+00:00|...

CVE-2026-62325

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:41+00:00| published-proof-of-concept| https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm 2026-07-28 23:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrqm5cwt5q2y 2026-07-29...

CVE-2026-49447

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:39+00:00| published-proof-of-concept| https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-5fqm-cc34-fcf5...

CVE-2026-54690

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:16+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-954p-556p-r752 2026-07-28 23:19:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqkdikp762b 2026-07-29 14:31:27+00:00| seen|...

CVE-2026-54656

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:13+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-8m8r-38jm-f355 2026-07-29 13:32:26+00:00| seen| https://gist.github.com/alon710/9d9829ba6ab40face903027898206e80...

CVE-2026-54653

creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:08+00:00| published-proof-of-concept| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-386q-5hp3-95m9 2026-07-28 23:39:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqlhcj5h62q 2026-07-29...

CVE-2026-54719

creationtimestamp| type| source ---|---|--- 2026-07-28 22:30:56+00:00| seen| https://gist.github.com/alon710/9b8006195456ffdcd967a102fe0db5d4 2026-07-28 22:35:03+00:00| published-proof-of-concept| https://github.com/goshs-labs/goshs/security/advisories/GHSA-rmxw-pq4x-3fvh 2026-07-29 00:00:29+00:0...

Malicious Package

Overview @joyfill/components is a malicious package. This package contains a supply chain compromise that executes a malicious payload immediately upon import of the vulnerable versions. When loaded, the package uses decentralized blockchain resolvers Tron, Aptos, BNB Smart Chain to fetch and...

GHSA-496M-5CG2-HW82 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-24W5-CQC3-H379 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-85RG-P3FR-XC2F

creationtimestamp| type| source ---|---|--- 2026-07-28 19:31:15+00:00| seen| https://gist.github.com/alon710/543be0bac4447ae891730d56e63e4ffd...

CVE-2026-54332

creationtimestamp| type| source ---|---|--- 2026-07-28 18:35:11+00:00| published-proof-of-concept| https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563...

CVE-2026-54603

creationtimestamp| type| source ---|---|--- 2026-07-28 18:35:08+00:00| published-proof-of-concept| https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9 2026-07-28 20:31:48+00:00| seen| https://gist.github.com/alon710/76a4f64bf3e94be3974678cdc55c68d9...

CVE-2026-54635

creationtimestamp| type| source ---|---|--- 2026-07-28 18:31:38+00:00| seen| https://gist.github.com/alon710/49b30b9938ae88ab2f795a5eb6f5b0cc 2026-07-28 18:35:03+00:00| published-proof-of-concept| https://github.com/nessshon/tonapi/security/advisories/GHSA-3fcr-jvgp-7f58 2026-07-28 19:00:36+00:00...

CVE-2026-47427

creationtimestamp| type| source ---|---|--- 2026-07-28 16:35:07+00:00| published-proof-of-concept| https://github.com/github/github-mcp-server/security/advisories/GHSA-w4q6-qw23-4rg7 2026-07-28 23:12:18+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mrqjw7fxsn2l...

Disrupting supply chain attacks on npm and GitHub Actions

In the past year, there's been a pattern of supply chain attacks that target weaknesses in package repositories and CI/CD systems to quickly spread malware to hundreds of open source projects. This malware seeks to exfiltrate credentials both to broadly spread the attack, as well as for later...

CVE-2026-47427

GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...