31957 matches found
GHSA-7P8X-8M3M-58J9
creationtimestamp| type| source ---|---|--- 2025-10-14 19:50:06+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115374254067224192...
EUVD-2025-34363
Improper verification of cryptographic signature in GitHub allows an unauthorized attacker to perform spoofing over an adjacent network...
CVE-2025-59288
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network...
Playwright Spoofing Vulnerability
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network...
CVE-2025-47856
creationtimestamp| type| source ---|---|--- 2025-10-14 13:52:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115372849741955983 2025-10-14 14:35:28+00:00| seen| https://gist.github.com/Darkcrai86/e8d027ff7b949f86db4477c5aa8e1c7e...
What AI Reveals About Web Applications— and Why It Matters
Before an attacker ever sends a payload, they've already done the work of understanding how your environment is built. They look at your login flows, your JavaScript files, your error messages, your API documentation, your GitHub repos. These are all clues that help them understand how your syste...
Astaroth Trojan Uses GitHub Images to Stay Active After Takedowns
Astaroth banking trojan has evolved to use GitHub and steganography for resilient C2, hiding its vital commands in images. Learn how this sophisticated malware employs fileless techniques to steal banking and crypto credentials from users across Latin America...
PT-2025-42148
Name of the Vulnerable Software and Affected Versions GitHub affected versions not specified Description An improper verification of a cryptographic signature allows an unauthorized attacker to perform spoofing over an adjacent network. Recommendations At the moment, there is no information about...
Spring Session Hazelcast: Now Led by Hazelcast Team
It gives me great pleasure to announce that the Spring Session Hazelcast project will now be led by the Hazelcast Team. NOTE: This announcement is in alignment with our announcement Spring Session MongoDB: Now Led by MongoDB Team. For ten years Spring Session has provided the infrastructure for...
Astaroth Banking Trojan Abuses GitHub to Remain Operational After Takedowns
Cybersecurity researchers are calling attention to a new campaign that delivers the Astaroth banking trojan that employs GitHub as a backbone for its operations to stay resilient in the face of infrastructure takedowns. "Instead of relying solely on traditional command-and-control C2 servers that...
CVE-2021-30118
creationtimestamp| type| source ---|---|--- 2025-10-11 05:03:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-30118.yaml 2025-10-12 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-10-12 2025-10-12...
EUVD-2025-33544
Allstar Reviewbot has Authentication Bypass via Hard-coded Webhook Secret...
CVE-2025-61912
creationtimestamp| type| source ---|---|--- 2025-10-10 20:48:19+00:00| published-proof-of-concept| https://github.com/python-ldap/python-ldap/security/advisories/GHSA-p34h-wq7j-h5v6...
Arbitrary Code Injection
Overview org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection due to default evaluation o...
CVE-2025-10281
BBOT's gitclone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL...
CVE-2021-38154
creationtimestamp| type| source ---|---|--- 2025-10-10 10:51:44+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-38154.yaml 2025-10-12 21:02:31+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3m2zlw2iwgd2n 2026-05-21...
BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver
Summary Due to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. Impact A user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...
GHSA-63WH-P5FX-H4VC BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver
Summary Due to unsafe URL handling, bbot's gitclone.py can be made to leak a user's github.com API key to an attacker-controlled webserver. Impact A user who has placed their github.com API key in the configuration for any of the following modules: githubcodesearch githubworkflows gitlab gitclone...