36519 matches found
CVE-2026-45482
Improper limitation of a pathname to a restricted directory 'path traversal' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
EUVD-2026-35547
Improper limitation of a pathname to a restricted directory 'path traversal' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-45482
CVE-2026-45482 affects GitHub Copilot and Visual Studio Code (Copilot Chat extension): improper limitation of a pathname to a restricted directory enables a local attacker to bypass a security feature. Root cause is a path traversal issue in handling file paths. Impact is described as high for co...
Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues
Microsoft on Monday confirmed that it temporarily removed some GitHub repositories in response to a recent security incident that led to 73 of its open-source projects being compromised to inject an information stealer into the code. "Our priority is to protect customers and the broader ecosystem...
MAL-2026-5402 Malicious code in screenpipe-mcp-http (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28109405008c1eaee3b3702337a3278723bb7e70e01929a4b76132b19c705790 [email protected] is a dependency-confusion lure that beacons installer-identifying data to an attacker-controlled domain on npm install...
Malicious code in multica (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d3e4277fb571072315c7f64c269029cd53c78b3ff27ec5536d748c659fd6a2 Package is published at version 9999.99.99 with a description referencing an npm 404 in multica-ai/multica and a main module that recursively require...
MAL-2026-5400 Malicious code in multica (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d3e4277fb571072315c7f64c269029cd53c78b3ff27ec5536d748c659fd6a2 Package is published at version 9999.99.99 with a description referencing an npm 404 in multica-ai/multica and a main module that recursively require...
MAL-2026-5397 Malicious code in create-docs-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4381fd77419441a2eefe6b22adef6c9f5adfe1b92be5d071abd5908fdf8647 Package is published at version 9999.99.99 — the canonical high-version override used in dependency-confusion attacks against private/internal packag...
Malicious code in t-invest-mcp-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46c186ac158f68845fc995a94d15d44c2b65a521d2619d2850232e58f4a61419 Package is a dependency-confusion squat: package.json sets version 9999.99.99 the canonical max-version trick used to win resolution against any...
MAL-2026-5403 Malicious code in t-invest-mcp-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46c186ac158f68845fc995a94d15d44c2b65a521d2619d2850232e58f4a61419 Package is a dependency-confusion squat: package.json sets version 9999.99.99 the canonical max-version trick used to win resolution against any...
Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability
Improper limitation of a pathname to a restricted directory 'path traversal' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
Exploit for Command Injection in Github Enterprise_Server
CVE-2026-3854 - GitHub Enterprise Server that allowed an Remot...
GHSA-C4WJ-P3M6-6483 vulnerabilities
Vulnerabilities for packages: binutils...
com.coherentlogic.coherent.data-model:data-model-core (>=1.0.15-release, <=1.0.16-release), com.coherentlogic.coherent:data-model (>=1.0.15-release, <=1.0.16-release) +155 more potentially affected by CVE-2026-41845 via org.springframework:spring-webmvc (4.0.5.release)
org.springframework:spring-webmvc MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.coherentlogic.coherent.data-model:data-model-core =1.0.15-release, =1.0.15-releas...
com.coherentlogic.coherent.data-model:data-model-core (>=1.0.15-release, <=1.0.16-release), com.coherentlogic.coherent:data-model (>=1.0.15-release, <=1.0.16-release) +155 more potentially affected by CVE-2026-41844 via org.springframework:spring-webmvc (4.0.5.release)
org.springframework:spring-webmvc MAVEN version 4.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - com.coherentlogic.coherent.data-model:data-model-core =1.0.15-release, =1.0.15-releas...
Malware in github-archiver
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
GHSA-22M2-HVR2-XQC8
creationtimestamp| type| source ---|---|--- 2026-06-09 02:27:39+00:00| seen| https://gist.github.com/lyuyun/60b1d6a8ad599cf3430761a4b380b17e 2026-07-06 14:20:05+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mpybw7ndmy2r...
Microsoft Visual Studio Code path traversal vulnerability
Microsoft GitHub Copilot and Visual Studio Code are a set of intelligent coding tools developed by the American company Microsoft. There is a path traversal vulnerability present in Microsoft GitHub Copilot and Visual Studio Code. Attackers can exploit this vulnerability to bypass certain feature...
CVE-2026-45482: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory 'path traversal' in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally...
PT-2026-47964
Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio Code affected versions not specified Description Improper limitation of a pathname to a restricted directory, known as path traversal, allows an unauthorized attacker to bypass...