414 matches found
CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values
JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...
CVE-2026-55378
JS Recon is a JavaScript enumeration and SAST tool. In versions 1.2.1-beta.1 through 1.3.1-beta.2 , the PR Branch Checker workflow in .github/workflows/pr_checker.yml interpolates untrusted values (github.head_ref and github.event.pull_request.head.repo.full_name) directly into a shell gh pr comm...
CVE-2026-80691
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...
PR-DNSd
PR-DNSd Daemon DNS passivo-ricorsivo. Cosa fa Avvio rapido root@kitploit: go get github.com/korc/PR-DNSd sudo setcap capnetbindservice,capsyschroot=ep go/bin/PR-DNSd go/bin/PR-DNSd -upstream 9.9.9.9:53 -listen 127.0.0.1:53 echo nameserver 127.0.0.1 | sudo tee /etc/resolv.conf dig google.com dig -...
CVE-2026-80691
In the Linux kernel, the following vulnerability has been resolved: s...
EUVD-2026-67426
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE In the iblockexecuteprout function, PROPREEMPT, PROPREEMPTANDABORT, and PRORELEASE all perform callback capability checks through ops-prclear. The error check...
appsec-agent
AppSec Agent وكلاء أمان مدعومون بالذكاء الاصطناعي لمراجعة الكود، وفحص طلبات السحب PR، ونمذجة التهديدات، وتوليد الإصلاحات، والمزيد. يمكنك استخدام AppSec Agent بثلاث طرق:...
geacon
Geacon Using Go to implement CobaltStrike's Beacon This project is for learning protocol analysis and reverse engineering only, if someone's rights have been violated, please contact me to remove the project, and the last DO NOT USE IT ILLEGALLY How to play 1. Setup the teamserver and start a htt...
heisenberg-ssc-gha
Heisenberg Dependency Health Check GitHub Action Un leggero guardrail per le PR per gli aggiornamenti delle dipendenze. Scansiona solo le dipendenze nuove o modificate dal tuo lock/manifest, recupera segnali di salute e rischio deps.dev + euristiche, segnala pubblicazioni fresche, commenta un...
react-CVE-2025-55182-fixer
Automação de PR de Segurança para React Server Components Este repositório fornece um script para bump automático e criação de pull requests PRs para repositórios afetados porCVE-2025-55182, que afeta versões vulneráveis de react-server-dom- e pacotes React relacionados. O que esta ferramenta faz...
Malicious code in openai-pr-reviewer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3553acd3c5abc3f71b55740c4b06b2eb278f81bb678c55211f2287a498b60b61 The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS servers, current working director...
CVE-2026-72084
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...
CVE-2026-72084
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...
UBUNTU-CVE-2026-72084
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...
CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...
CVE-2026-72084 scsi: target: Bound PR-OUT TransportID parsing to the received buffer
In the Linux kernel, the following vulnerability has been resolved: scsi: target: Bound PR-OUT TransportID parsing to the received buffer corescsi3decodespeciport and corescsi3emulateregisterandmove hand the raw PERSISTENT RESERVE OUT parameter buffer to targetparseprouttransportid without tellin...
CVE-2026-58416
Fork-PR Actions task can read a third private repository via the collaborative-owner branch missing fork-PR guard...
CVE-2026-58443 Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches...
CVE-2026-58443
CVE-2026-58443 (Gitea) : Public-only repository tokens can update private PR head branches via a public route. The root cause is that the update flow uses ordinary RBAC on the head repository (push/merge to the PR head) without reapplying the token’s public-only constraint to the private head rep...