MSC-2025-7969

@ctrl/ngx-csv package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-7970

@ctrl/ngx-csv package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-7971

@ctrl/ngx-rightclick package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect...

MSC-2025-7967

@ctrl/tinycolor package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all t...

MSC-2025-7966

@ctrl/golang-template package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect...

MSC-2025-7965

@ctrl/ngx-codemirror package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect...

MSC-2025-7963

@ctrl/deluge package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-7964

angulartics2 package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-7962

@ctrl/golang-template package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect...

MSC-2025-7961

@ctrl/deluge package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-7960

@ctrl/magnet-link package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all...

MSC-2025-7959

angulartics2 package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all the...

MSC-2025-7958

@ctrl/magnet-link package was compromised to include malicious code that steals github secrets, using them to create malicious github actions workflows that help exfiltrate even more github secrets. Besides, the malicious code also uses a data collection endpoint using webhook.site to collect all...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via improper path resolution during extraction of OCI image layer tarballs. An attacker can write arbitrary files to locations outside the intended extraction root by crafting a layer with a symlink pointing to an absolut...

Linux Distros Unpatched Vulnerability : CVE-2026-45803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gh is GitHub's official command line tool. From 1.6.0 to before 2.92.0, a security vulnerability has been identified in GitHub CLI that could allow terminal...

GHSA-WXW3-Q3M9-C3JR

creationtimestamp| type| source ---|---|--- 2026-05-15 21:40:29+00:00| seen| https://gist.github.com/alon710/4cc7bcd5f1c1a36dc5ed49cf14f62cbd...

CVE-2026-46673

creationtimestamp| type| source ---|---|--- 2026-05-15 21:19:23+00:00| published-proof-of-concept| https://github.com/Eugeny/russh/security/advisories/GHSA-g9f8-wqj9-fjw5 2026-06-11 02:00:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mny4xjajhy2n...

GHSA-M55X-H47X-V3GX

creationtimestamp| type| source ---|---|--- 2026-05-15 20:01:09+00:00| seen| https://gist.github.com/ichintu/d777ea5b68bd57d9ca8afc2774b06bad...

GHSA-RC95-PCM8-65V9 vulnerabilities

Vulnerabilities for packages: apicurio-registry, keycloak...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization of escape sequences in log output from commands run with the --log and --log-failed options. An attacker can inject malicious content in workflow logs, which are then rendered unsanitized in some terminal...