MAL-2026-16381 Malicious code in cisco-github-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205 The package declares a preinstall lifecycle hook node index.js that runs automatically on npm install. index.js collects host reconnaissance from the...

Malicious code in cisco-github-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205 The package declares a preinstall lifecycle hook node index.js that runs automatically on npm install. index.js collects host reconnaissance from the...

CVE-2026-88421

creationtimestamp| type| source ---|---|--- 2026-09-22 12:43:45+00:00| seen| https://gist.github.com/itsmohitnarayan/736225bd6cd79031a5dfbf56acdb14ae...

CVE-2026-88420

creationtimestamp| type| source ---|---|--- 2026-09-22 12:43:45+00:00| seen| https://gist.github.com/itsmohitnarayan/89de718efb225e840719478ed949bd51...

ROOT-APP-PYPI-GHSA-2F96-G7MH-G2HX GHSA-2f96-g7mh-g2hx in GitPython - Patched by Root

Root has patched GHSA-2f96-g7mh-g2hx in the GitPython package for Root:PyPI. Multiple fixed versions available...

CVE-2014-6345

creationtimestamp| type| source ---|---|--- 2026-09-22 09:22:01+00:00| seen| https://gist.github.com/INFOKOM-KI/b3d6c108fa85f8f8db8dfa6751a589cc...

CVE-2026-94570

creationtimestamp| type| source ---|---|--- 2026-09-22 04:48:30+00:00| seen| https://gist.github.com/yyymk/b5892625cb5efa2bffd36e0b05334ae8...

GHSA-JHJP-4C2Q-XMX4

creationtimestamp| type| source ---|---|--- 2026-09-22 01:31:26+00:00| seen| https://gist.github.com/alon710/f0da16101e0126a7387302a2b36a1565...

CVE-2026-94493

creationtimestamp| type| source ---|---|--- 2026-09-22 01:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/117312102443872796 2026-09-22 01:30:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mw33bvgb3k2x 2026-09-22 02:07:40+00:00| seen|...

CVE-2026-61630

creationtimestamp| type| source ---|---|--- 2026-09-22 00:31:44+00:00| seen| https://gist.github.com/alon710/9d98bc19a160c740db04b0c738bd9724 2026-09-22 10:16:30+00:00| seen| https://bsky.app/profile/suriq.io/post/3mw3yoj2ajx2b 2026-09-24 08:02:49+00:00| seen|...

GHSA-HF33-Q6CF-C66F

creationtimestamp| type| source ---|---|--- 2026-09-22 00:31:44+00:00| seen| https://gist.github.com/alon710/9d98bc19a160c740db04b0c738bd9724...

CVE-2026-77987: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port, allowing requests to be directed to internal services listening on other port...

CVE-2026-77912: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without...

ROS-20260922-73-0113

The vulnerability in golang-github-rancher-local-path-provisioner is related to errors in handling relative pathnames to the directory. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2026-97051

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.17 through 3.17.20 GitHub Enterprise Server versions 3.18 through 3.18.14 GitHub Enterprise Server versions 3.19 through 3.19.11 GitHub Enterprise Server versions 3.20 through 3.20.7 GitHub Enterprise Server...

PT-2026-97047

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.22 Description An authorization bypass allows authenticated users to read the raw diff or patch of pull requests in private repositories. This occurs because access tokens for these resources are...

CVE-2026-75101: Authorization Bypass Through User-Controlled Key

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull request diffs and patches were scoped to th...

PT-2026-97052

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.17 through 3.22 Description A server-side request forgery SSRF issue exists in the notebook viewer. While the system validates the scheme and host of a user-supplied URL, it fails to validate the port. This...

Cloud Foundry Build Infrastructure Exposed to Secret Exfiltration via pull_request_target Workflows | Cloud Foundry

Severity CVSSv3.1 | 9.8 – AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H ---|--- Vendor CloudFoundry Foundation Versions Affected The Cloud Foundry build infrastructure was affected. The Cloud Foundry product is not affected. Description GitHub Actions workflows were configured to trigger on pullrequesttarg...

OPENSUSE-SU-2026:11853-1 golang-github-v2fly-v2ray-core-5.54.2-1.1 on GA media

These are all security issues fixed in the golang-github-v2fly-v2ray-core-5.54.2-1.1 package on the GA media of openSUSE Tumbleweed...