PT-2026-28215

Hi guys! Recently I got this email from [email protected]. I read through the email and spotted a few grammatical errors, as well as a share.google link, which I thought was unusual for Microsoft to do. Even though it was fully delivered and signed by GitHub.com, I realised that what the...

GHSA-8M2X-3M6Q-6W8J vulnerabilities

Vulnerabilities for packages: nats-top, nats, kine, telegraf, k3s...

GHSA-8M2X-3M6Q-6W8J vulnerabilities

Vulnerabilities for packages: kine, milvus, telegraf, prometheus-nats-exporter-fips, nats-top, nats, prometheus-nats-exporter, nats-top-fips, rke2-runtime, rke2-runtime-fips, nats-fips, k3s...

CVE-2026-20719

CVE-2026-20719 affects Mattermost server/components that render external SVGs in link embeds across Mattermost 10.11.x–11.4.x (including 11.2.x, 11.3.x, 11.4.x). The root cause is failure to prevent rendering of external SVGs in embeds, enabling unauthenticated users to crash the web/desktop apps...

Fake OpenClaw Token Giveaway Targets GitHub Devs with Wallet-Draining Scam

OX Security reveals a new phishing campaign targeting GitHub developers. Scammers use fake OpenClaw token giveaways to trick users into connecting and draining their crypto wallets...

CVE-2026-33868

creationtimestamp| type| source ---|---|--- 2026-03-25 11:02:39+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-33868.yaml 2026-03-26 21:03:02+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mhyiuuwxmq2l 2026-03-27...

GHSA-V55J-83PF-R9CQ vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, gitlab-rails-ce-fips, gitlab-rails-ce, ruby3.4-rails...

CVE-2025-58044

creationtimestamp| type| source ---|---|--- 2026-03-25 05:44:05+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-58044.yaml 2026-03-26 21:03:04+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mhyiuvbik22q...

Guidance for detecting, investigating, and defending against the Trivy supply chain compromise

In this article 1. Analyzing the Trivy supply chain compromise 2. Detection and investigation 3. Mitigation and protection guidance 4. Advanced hunting queries 5. References 6. Learn more On March 19, 2026, Trivy, Aqua Security’s widely used open-source vulnerability scanner, was reported to have...

CVE-2026-20719: Improper Check for Unusual or Exceptional Conditions

Mattermost versions 11.4.x = 11.4.0, 11.3.x = 11.3.1, 11.2.x = 11.2.3, 10.11.x = 10.11.11 fail to prevent rendering of external SVGs on link embeds which allows unauthenticated users to crash the Mattermost webapp and desktop app via creating an issue or PR on GitHub.. Mattermost Advisory ID:...

GHSA-394X-VWMW-CRM3 vulnerabilities

Vulnerabilities for packages: linkerd-extension-init, ztunnel, rustup, wasmcloud, parseable, deno, nushell, rustls-ffi, zed, cargo-audit, efs-utils, linkerd-network-validator, qdrant, lychee, pixi, buck2, linkerd2, zizmor, ntpd-rs, linkerd2-proxy, py3-xet-core...

CVE-2026-33635

creationtimestamp| type| source ---|---|--- 2026-03-24 19:13:41+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-pv9c-9mfh-hvxq...

Malicious code in @pansycareful/github-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b0fd8e716dd8a1f3d3d8e33d9dfec9cee22ca3b511d7ac05fb3b175da1d1842 The package @pansycareful/github-helper was found to contain malicious code...

MAL-2026-2333 Malicious code in @pansycareful/github-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b0fd8e716dd8a1f3d3d8e33d9dfec9cee22ca3b511d7ac05fb3b175da1d1842 The package @pansycareful/github-helper was found to contain malicious code...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Amendment This was deemed not a vulnerability. Overview langflow is an A Python package with a built-in web application Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via unsanitized interpolatio...

CVE-2026-33475

Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...

CVE-2026-33766

creationtimestamp| type| source ---|---|--- 2026-03-24 13:00:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf 2026-03-24 13:00:13+00:00| published-proof-of-concept| https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf...

EUVD-2026-14790

Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...

CVE-2026-33475 Langflow GitHub Actions Shell Injection

Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...

CVE-2026-33475 Langflow GitHub Actions Shell Injection

Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...