31544 matches found
CVE-2026-41414 Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml
Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacker-controlled fork code and executes it via cargo run, with access to SKIMRSBOTPRIVATEKEY and GITHUBTOKEN contents:write. No gates prevent exploitation - any...
CVE-2026-41414
CVE-2026-41414 affects Skim. The vulnerability allows arbitrary code execution via the generate-files workflow in .github/workflows/pr.yml, where the workflow checks out code from an attacker-controlled fork and runs it with access to SKIM_RS_BOT_PRIVATE_KEY and GITHUB_TOKEN (contents:write). No ...
CVE-2026-41414 Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml
Skim is a fuzzy finder designed to through files, lines, and commands. The generate-files job in .github/workflows/pr.yml checks out attacker-controlled fork code and executes it via cargo run, with access to SKIMRSBOTPRIVATEKEY and GITHUBTOKEN contents:write. No gates prevent exploitation - any...
coordinated-disclosure
coordinated-disclosure A Claude Code skill + plugin marketpla...
CVE-2026-42856
creationtimestamp| type| source ---|---|--- 2026-04-24 14:05:57+00:00| published-proof-of-concept| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-fj4g-2p96-q6m3...
GHSA-WG36-WVJ6-R67P vulnerabilities
Vulnerabilities for packages: composer...
SecScan
SecScan Local-LLM-powered security scanner for GitHub repos...
Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2
Chinese-speaking individuals are the target of a new campaign that uses a trojanized version of SumatraPDF reader to deploy the AdaptixC2 Beacon post-exploitation agent and ultimately facilitate the abuse of Microsoft Visual Studio Code VS Code tunnels for remote access. Zscaler ThreatLabz, which...
GHSA-RP42-5VXX-QPWR
creationtimestamp| type| source ---|---|--- 2026-04-24 05:19:04+00:00| seen| Telegram/cyG2ZGhRnNebdsiXH3f8wG9rKkH4KFMg55z2RECZJhW1k7c...
GHSA-CVQ5-HHX3-F99P
creationtimestamp| type| source ---|---|--- 2026-04-24 05:18:58+00:00| seen| Telegram/kIuLSWSF-lSSH53f04z2OEjKv8ykvXtTNiYc9dOAOt4c...
Origin Validation Error
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Origin Validation Error via the Slack thread context. An attacker can inject unauthorized messages into the agent context by replying to allowlisted users in Slack threads, thereby...
GHSA-P49J-V9WC-WG57 vulnerabilities
Vulnerabilities for packages: openbao...
PT-2026-35057
Name of the Vulnerable Software and Affected Versions Skim affected versions not specified Description The generate-files job in the '.github/workflows/pr.yml' file checks out code from an attacker-controlled fork and executes it via the cargo run command. This process allows access to the SKIM R...
GHSA-3QPV-XF3V-MM45
creationtimestamp| type| source ---|---|--- 2026-04-23 23:27:16+00:00| seen| Telegram/IhrbuMncMOQ2aXKn55DBnsRKZnrdzyQXI4i7tcZ3JysOVtE...
CVE-2026-40161
A flaw was found in Tekton Pipelines. A tenant with permissions to create TaskRun or PipelineRun resources can exploit this vulnerability. By omitting the Git API token parameter and pointing the serverURL to an attacker-controlled endpoint, the system-configured Git API token such as a GitHub...
GHSA-F228-CHMX-V6J6
creationtimestamp| type| source ---|---|--- 2026-04-23 21:26:14+00:00| published-proof-of-concept| Telegram/LhBAsLXZuywUMfmIXbSwPnWzjb6RJaoGfmWe6gs8QchtB8o...
DNS Rebinding
Overview copilot-api is a Turn GitHub Copilot into OpenAI/Anthropic API compatible server. Usable with Claude Code! Affected versions of this package are vulnerable to DNS Rebinding in ericc-ch copilot-api up to 0.7.0. This impacts an unknown function of the file /token of the component Header...
GHSA-PG25-7CX5-CVCM vulnerabilities
Vulnerabilities for packages: python...
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
Bitwarden CLI, the command-line interface for the password manager Bitwarden, has reportedly been compromised as part of a newly discovered and ongoing Checkmarx supply chain campaign, according to findings from JFrog and Socket. "The affected package version appears to be @bitwarden/[email protected]...