GHSA-PWJX-QHCG-RVJ4

creationtimestamp| type| source ---|---|--- 2026-05-17 18:09:49+00:00| seen| https://gist.github.com/web3securityauditor/7d7d8acf63a2ec18ed25f500c878c123...

Grafana Says It Rejected Ransom Demand After Source Code Theft

Grafana says hackers stole its source code after accessing a GitHub token, but no customer data or systems were affected...

Grafana GitHub Token Breach Led to Codebase Download and Extortion Attempt

Grafana has disclosed that an "unauthorized party" obtained a token that granted them the ability to access the company's GitHub environment and download its codebase. "Our investigation has determined that no customer data or personal information was accessed during this incident, and we have...

CVE-2026-46717

creationtimestamp| type| source ---|---|--- 2026-05-17 02:58:21+00:00| published-proof-of-concept| https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532 2026-06-13 05:02:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo5hwpjwq22y...

CVE-2026-46716

creationtimestamp| type| source ---|---|--- 2026-05-17 02:58:20+00:00| published-proof-of-concept| https://github.com/nezhahq/nezha/security/advisories/GHSA-99gv-2m7h-3hh9 2026-05-30 03:00:04+00:00| seen| https://t.me/GithubRedTeam/86474 2026-05-30 07:00:13+00:00| seen|...

GHSA-VFVV-C25P-M7MM vulnerabilities

Vulnerabilities for packages: uv, pixi...

CVE-2026-8767: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in vercel ai up to 3.0.97. Impacted is the function run of the file .github/workflows/prettier-on-automerge.yml of the component PR Branch Name Interpolation. The manipulation leads to os command injection. The attack can be initiated remotely. The complexity of an...

CVE-2026-46701

creationtimestamp| type| source ---|---|--- 2026-05-16 15:11:55+00:00| published-proof-of-concept| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-j3vx-cx2r-pvg8 2026-06-17 22:38:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mojevvheah2c 2026-06-19...

CVE-2026-46695

creationtimestamp| type| source ---|---|--- 2026-05-16 09:54:51+00:00| published-proof-of-concept| https://github.com/boxlite-ai/boxlite/security/advisories/GHSA-g6ww-w5j2-r7x3 2026-06-11 00:00:39+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mnxwahnqhu2e 2026-06-11 01:00:59+00:0...

CVE-2026-46625

creationtimestamp| type| source ---|---|--- 2026-05-16 05:48:24+00:00| published-proof-of-concept| https://github.com/js-cookie/js-cookie/security/advisories/GHSA-qjx8-664m-686j 2026-06-10 23:09:53+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mnxtfp7clr23...

Arbitrary Code Execution

GitHub Copilot CLI is vulnerable to Arbitrary Code Execution. The vulnerability is due to unsafe handling of Git repository configuration during repository discovery, where a malicious nested bare Git repository can define executable configuration options that are automatically invoked during Git...

CVE-2026-46679

creationtimestamp| type| source ---|---|--- 2026-05-16 03:00:35+00:00| published-proof-of-concept| https://github.com/libp2p/js-libp2p/security/advisories/GHSA-4f8r-922h-2vgv 2026-06-11 03:00:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnyabxorjg2g 2026-06-11...

MSC-2025-8556

This package version was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-8557

This package version was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-8555

This package version was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-8558

This package version was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-8553

This package version was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-8552

This package version was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-8551

This package version was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-8554

This package version was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...