35856 matches found
GHSA-8G2F-G3GQ-5RJV
creationtimestamp| type| source ---|---|--- 2026-09-16 20:32:38+00:00| seen| https://gist.github.com/alon710/ef6456b2c611c3d15ec3538b07012ea5...
CVE-2026-61590
creationtimestamp| type| source ---|---|--- 2026-09-16 20:32:38+00:00| seen| https://gist.github.com/alon710/ef6456b2c611c3d15ec3538b07012ea5...
CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...
CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...
CVE-2026-92773 Trigger.dev before 4.6.0 GitHub App Installation Takeover
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...
CVE-2026-92773
Trigger.dev before 4.6.0 contains a GitHub App installation takeover vulnerability in its GitHub integration service (gitHub.server.ts). The root cause is a failure to verify that an authenticated user actually controls a GitHub App installation before binding it to their organization. An attacke...
EUVD-2026-81037
Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can claim another user's GitHub App installation by replaying state cookies and supplying sequential installation identifiers, gaining...
GHSA-3492-CVG7-9MR2
creationtimestamp| type| source ---|---|--- 2026-09-16 19:33:34+00:00| seen| https://gist.github.com/alon710/add36254cc8a2aecb663b59914ea2d7d...
GHSA-R2PF-9CW4-5J65
creationtimestamp| type| source ---|---|--- 2026-09-16 17:31:30+00:00| seen| https://gist.github.com/alon710/ca48de2f64cb21c4b6fdba639af7e2ac...
CVE-2026-68904
creationtimestamp| type| source ---|---|--- 2026-09-16 17:31:30+00:00| seen| https://gist.github.com/alon710/ca48de2f64cb21c4b6fdba639af7e2ac...
CVE-2026-54168
A flaw was found in Pipelines-as-Code. A GitHub App installation token, created during webhook processing, is not properly scoped when the App is installed across multiple repositories. This allows a user with push access to one repository to access private repositories within the same installati...
CVE-2026-54167
A flaw was found in Pipelines-as-Code. The GitHub App provider incorrectly processes webhook events by accepting an untrusted X-GitHub-Enterprise-Host header as the API host before validating the webhook signature. An unauthenticated attacker can exploit this by sending a specially crafted webhoo...
GO-2026-6448 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification in github.com/identrail/identrail
Identrail Cross-tenant IDOR: Client-supplied GitHub App installationid is bound to the caller's workspace without ownership verification in github.com/identrail/identrail...
GHSA-PG97-JVMF-QFVC
creationtimestamp| type| source ---|---|--- 2026-09-16 16:32:20+00:00| seen| https://gist.github.com/alon710/4438d7405fbc4cb7f575ade1c1585b2a...
CVE-2026-61593
creationtimestamp| type| source ---|---|--- 2026-09-16 16:32:19+00:00| seen| https://gist.github.com/alon710/4438d7405fbc4cb7f575ade1c1585b2a 2026-09-16 17:26:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/22eovhmpbg6st...
CVE-2026-81192
creationtimestamp| type| source ---|---|--- 2026-09-16 15:32:25+00:00| seen| https://gist.github.com/alon710/d0ed93c28f268e6b433624aa592c6856...
GHSA-V8PV-4842-X354
creationtimestamp| type| source ---|---|--- 2026-09-16 15:32:25+00:00| seen| https://gist.github.com/alon710/d0ed93c28f268e6b433624aa592c6856...
exploitarium
🧪 exploitarium - Your Gateway to Cybersecurity Research ⬇️ D...