Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft

CVE-2026-42826 — Azure DevOps Information Disclosure PoC O...

DeepZero deepzero-v0.4.0

Automated vulnerability research pipeline engine Define pipelines as YAML. DeepZero handles orchestration, parallelism, fault tolerance, and state. English | 简体中文 | Français 🔗 Pipeline-as-YAML - chain ingest, filter, transform, and LLM-assess stages declaratively ⚡ Parallel execution -...

CVE-2026-69151: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

PT-2026-67448

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust...

CVE-2026-67598: Improper Certificate Validation

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM providers by presenting arbitrary TLS certificates, as CURLOPTSSLVERIFYPEER and...

Veritensor v1.9.3

🛡️ Veritensor: AI Data & Artifact Security Veritensor is the Anti-Virus for AI Artifacts and the ultimate Firewall for RAG pipelines. It secures the entire AI Supply Chain by scanning the artifacts that traditional SAST tools miss: Models, Datasets, RAG Documents, and Notebooks. Veritensor shift...

Cross-site Scripting (XSS)

Overview @better-auth/sso is a SSO plugin for Better Auth Affected versions of this package are vulnerable to Cross-site Scripting XSS through the SAML login pipeline in packages/sso/src/routes/saml-pipeline.ts. An attacker can sign in as another user by sending a SAML response whose...

certgraveyard_yara v2026.07.31

CertGraveyard YARA Rules Generator Automated YARA rule generation from the CertGraveyard compromised certificate database. Features 🔄 Daily Updates : Automatically checks CertGraveyard for new compromised certificates 📝 YARA Rule Generation : Creates individual YARA rules for each certificate ✅...

@dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQL

Summary A DQL injection vulnerability in several read tools lets a caller bypass the tools' documented field-scope, time-window, and display caps by injecting DQL pipeline stages through parameters typed as identifiers. Details Several tools interpolate caller-supplied parameters directly into DQ...

The vulnerability of the API for reporting testing results of CI/CD pipelines is a problem with the Pipeline Test Report API software platform based on Git. This API allows attackers to compromise the confidentiality of protected information.

The vulnerability of the API reports for testing CI/CD pipelines is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to compromise the confidentiality of the protected information...

CVE-2026-14922: Improper Neutralization of Input During Web Page Generation

WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...

FreeBSD : Gitlab -- vulnerabilities (661d3db5-8bd9-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 661d3db5-8bd9-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass...

SUSE CVE-2026-29050

melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 and prior to version 0.43.4, an attacker who can influence a melange configuration file - for example through pull-request-driven CI or build-as-a-service scenarios - could set pipeline.uses to a...

MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.2.x < 8.2.12 / 8.3.x < 8.3.7 Multiple Vulnerabilities (SERVER-128433)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, 8.2.x prior to 8.2.12, or 8.3.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities: - An authenticated user with low privileges may be able to perform unauthorized reads and...

CVE-2026-12436

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

EUVD-2026-50482

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-12436

GitLab CE/EE is affected by CVE-2026-12436 in versions 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1. The issue arises from improper validation of user-supplied attributes when processing pipeline schedule inputs, potentially allowing an authenticated user to modify another user’...