CVE-2026-57449

The Actual Sync Server (prior to version 26.7.0 ) is vulnerable to a CORS proxy allowlist bypass. When ACTUAL_GITHUB_TOKEN is configured, the server's CORS proxy uses a raw startsWith() prefix test to validate GitHub repositories against an official plugin allowlist. Because the check fails to re...

CVE-2026-57449

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When "ACTUALGITHUBTOKEN" is configured, the proxy automatically attaches the...

CVE-2026-57449 Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-85612

CVE-2026-85612 CVE-2026-85612 - OpenPanel Unauthenticated Server-Side Request Forgery SSRF Advisory For full technical details, PoC, affected versions, impact, and remediation: https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-2hff-m67f-2w2w Discoverer Abdul Wassay hotplugin0x01...

CVE-2026-56726

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

CVE-2026-56726 Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

EUVD-2026-87212

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

CVE-2026-56726 Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

CVE-2026-56726

The Zammad open source helpdesk system contains a vulnerability in versions prior to 7.0.2 where a missing authorization check in the GitHub and GitLab integrations breaks ticket isolation boundaries. Any authenticated agent, regardless of their assigned tickets, can view the titles, status, labe...

CVE-2026-56726 Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - actions-cool/issues-helper...

GitHub Engagement Signals for CVE Prioritization: The GitHub Popularity Metric (GPM)

Whitepaper called GitHub Engagement Signals For CVE Prioritization: The GitHub Popularity Metric GPM...

CVE-2026-57449: Exposure of Sensitive Information to an Unauthorized Actor

Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When ACTUALGITHUBTOKEN is configured, the proxy automatically attaches the server'...

CVE-2026-56726: Missing Authorization

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, this vulnerability breaks normal ticket isolation boundaries between agents. Any authenticated agent, even one with no active tickets assigned to them, can view the titles, status, labels, and URL links of...

PT-2026-98940

Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.2 Description An issue in the ticket isolation mechanism allows any authenticated agent to bypass boundaries and view sensitive data from GitHub or GitLab issues attached to any ticket in the system. By querying...

PT-2026-99134

Name of the Vulnerable Software and Affected Versions Actual Sync Server versions prior to 26.7.0 Description The CORS proxy in Actual Sync Server allows authenticated users to fetch resources from repositories on an official plugin allowlist. When the ACTUAL GITHUB TOKEN is configured, the proxy...

AI-powered fuzzing with the GitHub Security Lab Taskflow Agent

If you 're new to fuzzing and want to learn the fundamentals first, check out our Fuzzing 101 course at gh.io/fuzzing101. Continuous fuzzing is not a magic solution that solves all your problems . Even projects that have been enrolled in OSS-Fuzz for years can still hide critical bugs, and the...

Malicious Package

Overview cisco-github-simple is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MemoryOS 2.0.34 was published with a credential-stealing binary

An attacker with write access to the GitHub repository pushed maliciouscommits and tagged v2.0.34, and the project's own GitHub Actions releaseworkflow built and uploaded 2.0.34 to PyPI.Importing the package runs memos/stage0.py, which launchesa bundled sckit binary that collects...

PYSEC-2026-3987 MemoryOS 2.0.34 was published with a credential-stealing binary

An attacker with write access to the GitHub repository pushed malicious commits and tagged v2.0.34, and the project's own GitHub Actions release workflow built and uploaded 2.0.34 to PyPI. Importing the package runs memos/stage0.py, which launches a bundled sckit binary that collects credentials...