gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

all-my-collection-repos

Todos los proyectos de recopilación de recursos: Todas las herramientas de seguridad de código abierto que recopilé: sec-tool-list: Más de 21K. Tanto en formato Markdown como Json. Repos de recopilación de recursos de seguridad de Github: más de 1000 repos de Github sobre recopilación de recursos...

git-alerts

GitAlerts 它解决了什么问题？ 组织下创建的 GitHub 仓库可由 GitHub 管理员控制。然而，在组织用户账户下创建的任何仓库是无法控制的，除非组织采用了 GitHub 企业托管用户（EMU）模型。 组织用户账户下意外创建或用于测试目的的任何公开仓库，都可能泄露机密、内部信息、代码等。GitAlerts 可帮助您检测和监控此类情况。 示例 可由管理员控制 https://github.com// 无法由管理员控制 https://github.com// GitAlerts 平台（Web UI + API） 寻找一个完整的平台？ GitAlerts API...

CVE-2022-36804-PoC-Exploit

CVE-2022-36804-PoC-Exploit Un exploit PoC algo confiable para CVE-2022-36804 inyección crítica de comandos en BitBucket. Este ataque generalmente requiere que los repositorios públicos estén habilitados; sin embargo, las cookies de sesión también son compatibles con este exploit. Nota: este explo...

CVE-2026-96594

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-97208

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-96594

The Gitea repository media API endpoint GET /api/v1/repos/{owner}/{repo}/media/{filepath} is vulnerable to stored Cross-Site Scripting (XSS) . The root cause is that the API fails to return appropriate content-type and disposition security headers when serving small files (up to 1 KiB) stored dir...

CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

CVE-2026-97208

The Gitea application contains a vulnerability in the push mirror creation API endpoint (POST /api/v1/repos/{owner}/{repo}/push_mirrors). The root cause is an incorrect authorization check where the API verifies if mirroring is enabled but fails to enforce the [mirror] DISABLE_NEW_PUSH setting re...

CVE-2026-97208 Gitea push mirror API bypass of DISABLE_NEW_PUSH policy

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

PT-2026-107290

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/push mirrors checked only whether mirroring was enabled and not the mirror DISABLE NEW PUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where...

GHSA-CP3J-M783-3PH5 Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's workspace without ownership verification

Summary identrail's GitHub App connection-completion endpoint binds a fully client-supplied installationid to the caller's workspace without verifying that the installation belongs to, or was installed by, the workspace that initiated the connect flow. identrail then mints a GitHub App installati...

git-alerts v1.8.0

GitAlerts What problem does it solve? GitHub repositories created under any organization can be controlled by the GitHub administrators. However any repository created under an organization's user account is not controllable unless the organisation has adopted the GitHub enterprise-managed user E...

CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

EUVD-2026-65543

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

CVE-2026-70548: Server-Side Request Forgery (SSRF)

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

PT-2026-81353

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

cockpit-repos-4.9-1.1 on GA media (moderate)

cockpit-repos-4.9-1.1 on GA media Announcement ID: openSUSE-SU-2026:11446-1 Rating: moderate Cross-References: CVE-2026-27904 CVSS scores: CVE-2026-27904 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-27904 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA...

Malicious code in eslint-plugin-folder-schema (npm)

npm/eslint-plugin-folder-schema is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...