CVE-2026-14967 Path traversal in github_workflows allows writing artifacts outside output directory

BBOT's githubworkflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODEREPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...

BIT-MLFLOW-2026-13484 MLflow Experiment-scoped Label Schema CRUD API authorization

A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...

GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

New research shows that a signed Git commit's hash is not the one-of-a-kind name that much of the software world assumes it to be. Given any signed commit, someone without the signing key can mint a second commit with the same files, author, and date, and a valid signature, GitHub still stamps...

GitHub Copilot Refuses Harmful Requests in Chat, Then Writes Them in Code

An AI coding assistant that refuses to answer a dangerous request in its chat box can answer it anyway if the same request is broken into small, ordinary-looking steps inside a code editor. That is the finding of a new study of GitHub Copilot by researchers Abhishek Kumar and Carsten Maple. The...

GHSA-RMMH-P597-PPVV vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, wazuh-dashboard, opensearch-dashboards, opensearch-dashboards-fips...

GHSA-CWX4-F9X9-PQHH vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure, linux-qemu-melange, linux-qemu, linux-vmware, linux-aws...

GHSA-JMF6-3V74-7X28 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure, linux-qemu-melange, linux-qemu, linux-vmware, linux-aws...

GHSA-WWC5-7R8X-52GG vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure, linux-qemu-melange, linux-qemu, linux-vmware, linux-aws...

GHSA-3J9Q-258H-4V38 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-azure, linux-qemu-melange, linux-qemu, linux-vmware, linux-aws...

CVE-2026-53530

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:13+00:00| published-proof-of-concept| https://github.com/erweixin/RaTeX/security/advisories/GHSA-4hgp-59h5-gvrj...

CVE-2026-53531

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:11+00:00| published-proof-of-concept| https://github.com/erweixin/RaTeX/security/advisories/GHSA-4w5h-hx6r-28q7...

CVE-2026-53487

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:09+00:00| published-proof-of-concept| https://github.com/kite-org/kite/security/advisories/GHSA-gvhc-wv3v-7pf8...

CVE-2026-53553

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:05+00:00| published-proof-of-concept| https://github.com/zhenorzz/goploy/security/advisories/GHSA-4g5x-hcwm-82jw...

Git Hash Chain Malleability

This whitepaper demonstrates that signed Git commits are not uniquely bound to their commit hashes, even when they display a valid "Verified" badge on GitHub. The authors show that attackers can transform the signature encoding of an existing signed commit—without possessing the private signing...

PT-2026-80686

BBOT's github workflows module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve .., so a crafted CODE REPOSITORY URL could traverse out of the intended folder. The write is bounded to two directory levels above the...

📄 OpenCATS 0.9.7.4 Time-Based Blind SQL Injection

This Python script targets a remote SQL injection vulnerability in OpenCATS version 0.9.7.4. ================================================================================================================================== | Title : OpenCATS 0.9.7.4 Time-Based Blind SQL Injection Exploit Data...

golang-github-openprinting-ipp-usb security update

0.9.27-6 - rebuilt to fix CVE-2026-27137, CVE-2026-25679 - fixed rebuild problem with redundant condition check in quirks.empty...

Malicious Package

Overview github.com/kaleidora/dnsub-scanning-tool is a malicious package. This package contains malicious code and while hile this package might be attempting to impersonate a legitimate DNS/subdomain scanning tool, there is no connection between that valid project and this package, which conceal...

GO-2026-5924 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps in github.com/coder/coder

Coder's session token leaked to arbitrary hosts via coder open app for external workspace apps in github.com/coder/coder...

GO-2026-5799 Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus

Incus has a restricted project bypass leading to arbitrary command execution in github.com/lxc/incus...