31952 matches found
Researchers Expose GhostCall and GhostHire: BlueNoroff's New Malware Chains
Threat actors tied to North Korea have been observed targeting the Web3 and blockchain sectors as part of twin campaigns tracked as GhostCall and GhostHire. According to Kaspersky, the campaigns are part of a broader operation called SnatchCrypto that has been underway since at least 2017. The...
CVE-2019-11507
creationtimestamp| type| source ---|---|--- 2025-10-28 06:50:55+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2019/CVE-2019-11507.yaml 2025-10-29 21:02:29+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m4edtnyjnw2g...
Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs
Introduction Primarily focused on financial gain since its appearance, BlueNoroff aka. Sapphire Sleet, APT38, Alluring Pisces, Stardust Chollima, and TA444 has adopted new infiltration strategies and malware sets over time, but it still targets blockchain developers, C-level executives, and...
GitHub Workflow Updater 安全漏洞
GitHub Workflow Updater is a VS Code extension by Richard Tweed Personal Developer. A security vulnerability exists in GitHub Workflow Updater versions prior to 0.0.7, which stems from storing Github tokens in cleartext, which could lead to token disclosure...
Fedora: Security Advisory (FEDORA-2025-30bf3a7b1a)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2025-44215
Name of the Vulnerable Software and Affected Versions GitHub Workflow Updater versions prior to 0.0.7 Description The GitHub Workflow Updater VS Code extension had a security issue where GitHub tokens were stored in plaintext within the editor configuration as JSON on disk, instead of utilizing t...
GHSA-GV8H-7V7W-R22Q
creationtimestamp| type| source ---|---|--- 2025-10-27 21:12:50+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115448189437739687 2025-10-29 17:32:49+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/docker-security-advisory-av25-708...
CVE-2025-62524 PILOS Exposes PHP version
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. PILOS before 4.8.0 exposes the PHP version via the X-Powered-By header, enabling attackers to fingerprint the server and assess potential exploits. This information disclosure vulnerability originates from PHP’s...
CVE-2024-6690
creationtimestamp| type| source ---|---|--- 2025-10-27 01:52:34+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-6690.yaml 2025-10-27 21:02:34+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m47cvwti532k 2025-12-02...
Fedora: Security Advisory (FEDORA-2025-cf2e1f1604)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory (FEDORA-2025-a6cb455ca2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE CVE-2025-61926
Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar's Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary an...
MAL-2025-49377 Malicious code in github.com/boltdb-go/bolt (Git)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1cad7a46a80076eedc2c3c00be0d3215bdfed842f6cc04c238d3b2591b38e2ad This malicious git repository is a typosquat of the legitimate BoltDB Go package. It contains a backdoor that enables remote code executio...
GO-2025-4018 Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret in github.com/ossf/allstar...
GO-2025-3983 Rancher update on users can deny the service to the admin in github.com/rancher/rancher
Rancher update on users can deny the service to the admin in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
The Geomys Standard of Care
One of the most impactful effects of professionalizing open source maintenance is that as professionals we can invest into upholding a set of standards that make our projects safer and more reliable. The same commitments and overhead that are often objected to when required of volunteers should b...
VulnerabilityAgent
VulnerabilityAgent 🛡️ An autonomous agent built on the BeeAI...
CVE-2021-24220
creationtimestamp| type| source ---|---|--- 2025-10-22 18:12:25+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-24220.yaml 2025-10-23 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m3vb25a5lh23...
Top security researcher shares their bug bounty process
As we wrap Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to spotlight another top performing security researcher who participates in the GitHub Security Bug Bounty Program, Andr e Storfjord Kristiansen! GitHub is dedicated to maintaining the security and reliability of the...
