Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the LFS object reuse process. An attacker can gain unauthorized access to private source objects by leveraging repository access without having the required Code-unit permissions...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the CODEOWNERS pattern matching process. An attacker can cause excessive resource consumption by submitting specially crafted patterns, potentially leading to service unavailability. Remediation Upgrade...

CVE-2026-57168

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:13+00:00| published-proof-of-concept| https://github.com/openremote/openremote/security/advisories/GHSA-h3m5-97jq-qjrf...

CVE-2026-52817

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:11+00:00| published-proof-of-concept| https://github.com/Linuxfabrik/monitoring-plugins/security/advisories/GHSA-8w6w-23mq-h8rg...

CVE-2026-52834

creationtimestamp| type| source ---|---|--- 2026-07-02 22:35:09+00:00| published-proof-of-concept| https://github.com/tirr-c/jxl-oxide/security/advisories/GHSA-5pmv-rx8r-wmv5...

CVE-2026-49852

creationtimestamp| type| source ---|---|--- 2026-07-02 20:35:04+00:00| published-proof-of-concept| https://github.com/authlib/joserfc/security/advisories/GHSA-gg9x-qcx2-xmrh 2026-07-17 22:08:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqur7v4av42e...

GHSA-9H3P-52VH-959W vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

CVE-2026-58578

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-58578

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-58578 LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service ReDoS vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craf...

CVE-2026-50181

creationtimestamp| type| source ---|---|--- 2026-07-02 18:35:09+00:00| published-proof-of-concept| https://github.com/langroid/langroid/security/advisories/GHSA-fg23-3346-88f5 2026-07-13 22:00:06+00:00| seen| https://t.me/GithubRedTeam/92599 2026-07-14 00:00:10+00:00| seen|...

GHSA-3P4H-7M6X-2HCM

creationtimestamp| type| source ---|---|--- 2026-07-02 16:42:57+00:00| seen| https://gist.github.com/konard/2d84a73c0ff6413bca5b0e79fa90d50e 2026-07-03 13:46:19+00:00| seen| https://gist.github.com/konard/21e8411dcc1ecc12ae0a937b657f93ae 2026-07-03 14:16:44+00:00| seen|...

GHSA-V9P9-HFJ2-HCW8

creationtimestamp| type| source ---|---|--- 2026-07-02 16:42:12+00:00| seen| https://gist.github.com/konard/7292d01fd27ee78b9adfcdd581745d9e...

GHSA-X7XJ-JVWP-97RV vulnerabilities

Vulnerabilities for packages: rke2-runtime, rke2-runtime-fips...

GHSA-7H4P-RFFG-7823 vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-13.0, py3-vllm-cuda-12.4, vllm-cuda-13.2...

GHSA-HGG8-FQQC-VFMW vulnerabilities

Vulnerabilities for packages: vllm-openai-cuda-13.0, vllm-cuda-13.2...

CVE-2026-50143

creationtimestamp| type| source ---|---|--- 2026-07-02 00:35:02+00:00| published-proof-of-concept| https://github.com/apify/apify-mcp-server/security/advisories/GHSA-6gr2-qh89-hxwm...

PT-2026-55290

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 2.2.10-canary.15 Description An authenticated attacker can cause a regular expression denial of service ReDoS by providing a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. This...

PT-2026-55450

Name of the Vulnerable Software and Affected Versions dragonfly versions prior to 2.4.4 Description The Dragonfly Manager fails to enforce authentication on specific API endpoints, allowing unauthenticated network-reachable attackers to retrieve sensitive OAuth client secrets. The issue occurs...

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

The Dragonfly Manager exposes GET /api/v1/oauth and GET /api/v1/oauth/:id to unauthenticated clients. The response body deserializes the entire manager/models.Oauth struct, which includes the clientsecret field. Any network-reachable attacker can read the OAuth client secrets configured for githu...