1283 matches found
CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...
CVE-2026-63187
Logto (open-source auth infrastructure) versions 1.40.1 through 1.41.0 contain an OS command injection in the .github/workflows/commitlint.yml workflow. The github.event.pull_request.title value was directly interpolated into an inline echo command before being piped to npx commitlint. A pull req...
CVE-2019-25766
Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...
CVE-2019-25766
Renovate (dependency update automation) versions >= 13.87.0 and
CVE-2019-25766 Renovate before 19.38.7 Credential Exposure via Go Modules
Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...
CVE-2019-25766 Renovate before 19.38.7 Credential Exposure via Go Modules
Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...
EUVD-2019-20202
Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...
CVE-2019-25766: Insertion of Sensitive Information into Log File
Renovate versions = 13.87.0 and = 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens...
PT-2026-78645
Name of the Vulnerable Software and Affected Versions Logto versions 1.40.1 through 1.40.9 Description In the .github/workflows/commitlint.yml file, the github.event.pull request.title variable is directly interpolated into an inline echo command. A pull request title containing a single quote ca...
PT-2026-78370
Name of the Vulnerable Software and Affected Versions Renovate versions 13.87.0 through 19.38.6 Description Temporary repository tokens are leaked into pull request comments when certain Go Modules update failure scenarios occur. This allows any user with permissions to view the affected pull...
CVE-2026-71365: Server-Side Request Forgery (SSRF)
A server-side request forgery SSRF vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL pullrequest.statusesurl from the incoming webhook payload without validating the target host against the expect...
PT-2026-76719
Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...
CVE-2026-58443
Public-only repository tokens can update private PR head branches...
CVE-2026-58439
Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...
CVE-2026-58443 Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches...
CVE-2026-58443 Public-only repository tokens can update private PR head branches
Public-only repository tokens can update private PR head branches...
EUVD-2026-58170
Public-only repository tokens can update private PR head branches...
CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL
SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...