35860 matches found
PT-2026-92173
githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUE TITLE before shell parsing. An issue title containing...
CVE-2026-58502: Improper Neutralization of Special Elements used in an OS Command
githubtoplanguages generates a user's top GitHub languages as an SVG. The .github/workflows/discord-issue.yml workflow runs when an issue is opened or closed and interpolates github.event.issue.title directly into the Bash assignment for ISSUETITLE before shell parsing. An issue title containing...
CVE-2026-54168: Improper Privilege Management
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
An Exploratory Study of Dependabot Cooldown Adoption in Open-Source GitHub Projects
Automated dependency updates can rapidly propagate malicious package releases before maintainers and the broader community have enough time to detect them. In July 2025, GitHub made Dependabot cooldown generally available as a defense against software supply chain attacks. However, the effects of...
GHSA-VRH8-C9CM-WH8V
creationtimestamp| type| source ---|---|--- 2026-09-14 23:32:13+00:00| seen| https://gist.github.com/alon710/5201f77ce91c5d1ec9edcecc53a2d050 2026-09-15 00:00:09+00:00| seen| https://gist.github.com/alon710/5201f77ce91c5d1ec9edcecc53a2d050...
CVE-2026-84567
creationtimestamp| type| source ---|---|--- 2026-09-14 22:42:31+00:00| seen| https://gist.github.com/ataberk-xyz/2c387bbc201a6ab0d6ed0c4cb610d86a 2026-09-15 00:00:09+00:00| seen| https://gist.github.com/ataberk-xyz/2c387bbc201a6ab0d6ed0c4cb610d86a 2026-09-15 04:50:49+00:00| seen|...
GHSA-V859-C572-QH5P
creationtimestamp| type| source ---|---|--- 2026-09-14 22:32:03+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3 2026-09-15 00:00:09+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3...
CVE-2026-76081
creationtimestamp| type| source ---|---|--- 2026-09-14 22:32:03+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3 2026-09-15 00:00:09+00:00| seen| https://gist.github.com/alon710/526da095cc70f5c9bf54550d012a3cd3...
GHSA-2XMM-M4WV-3FJH
creationtimestamp| type| source ---|---|--- 2026-09-14 21:31:27+00:00| seen| https://gist.github.com/alon710/baad95ed8a6cf5e02f207178d3a44686...
CVE-2026-90814
A Server-Side Request Forgery (SSRF) vulnerability exists in cosmicstack-labs mercury-agent up to version 1.1.13 . The flaw is in the githubRequest function within the GitHub API Handler component (file src/utils/github.ts), where manipulation of the path argument allows a remote, low-privilege a...
EUVD-2026-77775
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of...
CVE-2026-90814 cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of...
CVE-2026-90814 cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery
A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of...
GHSA-325J-MG25-8Q58
creationtimestamp| type| source ---|---|--- 2026-09-14 16:32:17+00:00| seen| https://gist.github.com/alon710/880dc77a6d2d63a35f137e7b084bf95b...
GHSA-4V52-7Q2X-V4XJ
creationtimestamp| type| source ---|---|--- 2026-09-14 15:45:28+00:00| seen| https://gist.github.com/Reilley64/5281c3e3797df1ef31d3e4100483a1a1...
Malicious code in concierge-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b The package's declared postinstall script executes exfilv2.js at npm install time. That script harvests the full process environment, current working...
Astra Linux – Vulnerability in Vim
Heap-based Buffer Overflow in the GitHub repository for Vim before version 8.2...
CVE-2023-50461
creationtimestamp| type| source ---|---|--- 2026-09-14 12:02:18+00:00| seen| https://gist.github.com/ichintu/6e4365e719efc73cff29fb6a2ec0065b...
Astra Linux – Vulnerability in Grunt
The file.copy operations in GruntJS are vulnerable to a TOCTOU race condition, which can lead to arbitrary file writes in the GitHub repository gruntjs/grunt before version 1.5.3. This vulnerability allows for arbitrary file writes that can lead to local privilege escalation to the GruntJS user...