nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

clusterfuzzlite

ClusterFuzzLite ClusterFuzzLite es una solución continua de fuzzing que se ejecuta como parte de flujos de trabajo de Integración Continua CI para encontrar vulnerabilidades más rápido que nunca. Con solo unas pocas líneas de código, los usuarios de GitHub pueden integrar ClusterFuzzLite en su...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start root@kitploit: Download the Repo = run npm i Afer Installing all dependency just run the application root@kitploit: node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4...

layne

Layne Layne is a self-hosted GitHub App that centralizes security scanning across our repositories. Since we don't use commercial SAST/secrets scanning tools, nor we have access to GitHub Enterprise, it can get hard to maintain different GitHub Actions workflow files across different repositories...

CVE-2026-88884

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

EUVD-2026-75434

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

PT-2026-89395

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2024-37051

CVE-2024-37051 Análisis Resumen CVE-2024-37051 es una vulnerabilidad encontrada en los IDEs basados en IntelliJ de JetBrains, que afecta al complemento de GitHub. Permite la exposición no autorizada de tokens de acceso de GitHub cuando se carga un pull request PR malicioso. Detalles Técnicos La...

CVE-2026-52806

Gogs RCE — Inyección de argumentos en git rebase CWE-88 Ejecución remota de código autenticada contra Gogs es interpretada por Git como el flag --exec en lugar de un argumento posicional, lo que provoca que sh -c se ejecute después de cada commit reproducido durante el rebase. Cómo funciona el...

CVE-2026-58443

A flaw was found in Gitea. This vulnerability allows an attacker to use tokens intended for public repositories to modify private pull request PR branches. This could lead to unauthorized changes in private code, compromising the integrity of the affected repositories. Mitigation Update to Gitea...

CVE-2026-53507

oasdiff-action , a GitHub Action that detects breaking changes in OpenAPI specs and posts reviews on pull requests, contained a flaw prior to version 0.0.51 where external $refs in the spec were resolved by default (allow-external-refs: true). On a fork pull request in a public repository, an att...

CVE-2026-55378

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2026-55378 JS Recon: Command injection in PR Branch Checker workflow via untrusted pull request context values

JS Recon is a JavaScript enumeration and SAST tool. From 1.2.1-beta.1 until 1.3.1-beta.2, the PR Branch Checker workflow in .github/workflows/prchecker.yml places github.headref and github.event.pullrequest.head.repo.fullname into BRANCHNAME and SOURCEREPO and interpolates those untrusted values...

CVE-2019-25766

A flaw was found in Renovate. During certain Go Modules update failure scenarios, temporary repository tokens are inadvertently leaked into pull request comments. A remote attacker able to view these comments could obtain the exposed tokens, leading to unauthorized access to repositories. This...

CVE-2026-71494

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

CVE-2026-58439

A flaw was found in Gitea. This vulnerability allows an attacker to bypass branch protection by retargeting a Pull Request PR that has a stale 'official' approval flag. This could lead to unauthorized code being merged into a protected branch, compromising code integrity. Mitigation Mitigation fo...

CVE-2026-63187

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

CVE-2026-63187

Logto (open-source auth infrastructure) versions 1.40.1 through 1.41.0 contain an OS command injection in the .github/workflows/commitlint.yml workflow. The github.event.pull_request.title value was directly interpolated into an inline echo command before being piped to npx commitlint. A pull req...