36515 matches found
CVE-2026-55448
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...
CVE-2026-48529
GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...
CVE-2026-55448 mise: Local credential_command executes untrusted config
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...
CVE-2026-55448
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...
EUVD-2026-39813
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...
CVE-2026-55448 mise: Local credential_command executes untrusted config
mise manages dev tools like node, python, cmake, and terraform. From 2026.3.15 until 2026.6.4, mise loads github.credentialcommand from local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a...
GHSA-PX7Q-GGQJ-HCF2
creationtimestamp| type| source ---|---|--- 2026-06-26 16:42:20+00:00| seen| https://gist.github.com/alon710/8649cee74b41dfbab6352036ad771ea3 2026-06-26 16:52:45+00:00| seen| https://gist.github.com/alon710/ab6fb045bc60bbc32d947423444fcf91...
CVE-2026-48529
GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...
CVE-2026-48529 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion
GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...
MAL-2026-6522 Malicious code in @epsteinlovekids483/crossmint-wallets-sdk-pentest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e43e5a418541bb3e485010eba536ecc9f1483dba866af53ff4a760684409213 Package's main entry dist/index.cjs unconditionally requires dist/shai-hulud.js at module load. On require, the code harvests installer secrets —...
Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack
Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family that has compromised a new set of npm packages, even as it has propagated to the Go ecosystem. "The latest activity includes malicious npm releas...
vuln-scanner-agent
vuln-scanner-agent A multi-agent vulnerability scanner for Gi...
CVE-2026-48529: Improper Access Control
GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...
CVE-2026-48529
creationtimestamp| type| source ---|---|--- 2026-06-25 22:35:05+00:00| published-proof-of-concept| https://github.com/github/github-mcp-server/security/advisories/GHSA-pjp5-fpmr-3349 2026-06-26 18:26:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7l26lvbx2l...
GO-2026-5767 Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function in github.com/free5gc/amf
Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function in github.com/free5gc/amf...
GO-2026-5772 Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon
Algernon: handler.lua discovery walks parent directories above the server root in github.com/xyproto/algernon...
GO-2026-5756 AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle in github.com/AdguardTeam/AdGuardHome...
GO-2026-5753 New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api
New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud in github.com/QuantumNous/new-api...
GO-2026-5755 Canonical MicroCeph: path traversal issue in the remote-import AP in github.com/canonical/microceph/microceph
Canonical MicroCeph: path traversal issue in the remote-import AP in github.com/canonical/microceph/microceph...
GO-2026-5635 nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh
nebula-mesh: Session and OIDC state cookies lack the Secure attribute in github.com/juev/nebula-mesh...