gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

git-alerts

GitAlerts What problem does it solve? GitHub repositories created under any organization can be controlled by the GitHub administrators. However any repository created under an organization's user account is not controllable unless the organisation has adopted the GitHub enterprise-managed user E...

CVE-2026-118395

In Gitea 1.27.3 , a flaw allows personal access tokens restricted to public resources (public-only ) to bypass restrictions and create private resources. While the software blocked this via POST /api/v1/user/repos and POST /api/v1/repos/migrate, it remained vulnerable through POST /api/v1/org/{or...

CVE-2026-112887

In Gitea , Actions task tokens authenticate to the REST API as a shared system user with a negative ID . Because these tokens lack sufficient API scopes and filters are treated as having no owner restrictions, a user capable of running a workflow can use a job's token to perform a GET /api/v1/use...

CVE-2022-36804-PoC-Exploit

CVE-2022-36804-PoC-Exploit A somewhat reliable PoC exploit for CVE-2022-36804 BitBucket Critical Command Injection. This attack generally requires public repos to be enabled, however session cookies are also compatible with this exploit. Note: this exploit includes automatic repo detection which ...

all-my-collection-repos

All Resource Collection Projects: All open source security tools I collected: sec-tool-list: More than 21K. Both Markdown and Json format. Github Security Resource Collection Repos: 1000+ Github Repos about Security Resource Collection Reverse Engineering Resources For All Platforms: Windows:...

CVE-2026-63121

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, trusted-repos-policy compares an image's registry hostname against reject lists and allow lists case-sensitively even though...

CVE-2026-63121 Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, trusted-repos-policy compares an image's registry hostname against reject lists and allow lists case-sensitively even though...

EUVD-2026-114566

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, trusted-repos-policy compares an image's registry hostname against reject lists and allow lists case-sensitively even though...

CVE-2026-63121 Kubewarden trusted-repos-policy: uppercase registry host bypasses registry/image deny rules

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, trusted-repos-policy compares an image's registry hostname against reject lists and allow lists case-sensitively even though...

CVE-2026-63121

The Kubewarden policies component, specifically the trusted-repos-policy (versions before 2.1.2 ), is vulnerable to a case-sensitivity bypass. The policy compares an image's registry hostname against reject lists and allow lists using case-sensitive comparisons, despite DNS names being case-insen...

CVE-2026-63121: kubewarden policies: Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters

Kubewarden policies is a collection of WebAssembly policies for securing and governing Kubernetes clusters. For versions provisionally classified as affected before 2.1.2, trusted-repos-policy compares an image's registry hostname against reject lists and allow lists case-sensitively even though...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-113717 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-113717 Source advisory:...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-113718 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-113718 Source advisory:...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-113720 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-113720 Source advisory:...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-113724 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-113724 Source advisory:...

CVE-2026-73130

Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API. Repository initialization splits the field into template names, repeatedly reads the referenced templates, and buffers their contents in memory. An attacker who can create repositories can...

CVE-2026-70400

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that...

BIT-GITEA-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

CVE-2026-70396

"POST /api/v1/orgs/org/repos" allows a token scoped only to "write:organization" to create repositories in an organization, even though the deprecated sibling route and other repository-creation routes also require "write:repository". A PAT or OAuth app without "write:repository" can create...