Sources:
amazon_linux
archlinux
azure_linux
bitnami_vulndb
capec
capec_enrichment_dashboard
certeu
certfr
circl_kev
cisa_known_exploited
cna_scorecard
cnvd
csaf_abb
csaf_adstecindustrialitgmbh
csaf_amd
csaf_aumariestergmbhcokg
csaf_baadem2mproductsgmbh
csaf_beckhoffautomationgmbhcokg
csaf_bendergmbhcokg
csaf_bosch
csaf_bsi
csaf_bsi_aggregator
csaf_bsi_cvd_white
csaf_bsi_white
csaf_bsi_wid_white
csaf_carlogavazziautomation
csaf_certbund
csaf_certvde
csaf_cisa
csaf_cisa_it
csaf_cisa_ot
csaf_cisco
csaf_claaskgaa
csaf_codesysgmbh
csaf_dell
csaf_duraggmbh
csaf_endresshauserag
csaf_ericsson
csaf_euchnergmbhcokg
csaf_festosecokg
csaf_frauschersensortechnikgmbh
csaf_hancom
csaf_harmaninternational
csaf_helmholzgmbhcokg
csaf_himapaulhildebrandtgmbh
csaf_hitachi
csaf_hpe
csaf_huawei
csaf_hydacinternationalgmbh
csaf_ibm
csaf_ifmelectronicgmbh
csaf_janitzaelectronicsgmbh
csaf_jumogmbhcokg
csaf_juniper
csaf_kebautomationkg
csaf_kukaag
csaf_lenovo
csaf_lenzese
csaf_mbconnectlinegmbh
csaf_mettlertoledogmbh
csaf_metzconnectgmbh
csaf_microsoft
csaf_mieleciekg
csaf_moxa
csaf_murrelektronikgmbh
csaf_ncscnl
csaf_ndaal
csaf_netapp
csaf_nozomi
csaf_nozominetworks
csaf_nvidia
csaf_opcfoundation
csaf_openeuler
csaf_opensuse
csaf_oracle
csaf_ox
csaf_paloalto
csaf_panasonic
csaf_pentagrid
csaf_pepperlfuchsse
csaf_phoenix
csaf_pilzgmbhcokg
csaf_qnap
csaf_redhat
csaf_samsung
csaf_sauterag
csaf_schneider
csaf_sick
csaf_siemens
csaf_smasolartechnologyag
csaf_suse
csaf_swarcotrafficsystemsgmbh
csaf_synology
csaf_tibco
csaf_trend
csaf_trumpfsecokg
csaf_trustsource
csaf_tuxcare
csaf_ubiquiti
csaf_vartastoragegmbh
csaf_vegagrieshaberkg
csaf_vmware
csaf_wagogmbhcokg
csaf_weidmuellerinterfacegmbhcokg
csaf_welotecgmbh
csaf_wiesemanntheisgmbh
csaf_yaskawaeuropegmbh
csaf_yokogawa
csaf_zyxel
cve_forecast
cve_icu
cve_vs_github_dashboard
cvelistv5
cwe_dashboard
cwe_enrichment
cwec
debian_security_tracker
drupal
emb3d
emb3d_dashboard
epss_dashboard
epss_history
epss_kev_enrichment
euvd_kev
fedora
fkie_nvd
freebsd
gcve
gcve_enriched
gcve_enrichment
gcve_enrichment_dashboard
gentoo
github
gsd
jvn
kev_ransomware
mitre_attack
moksha
ndaal_kev
netbsd
nuclei_dashboard
nuclei_enrichment
nvd
nvd_cpe_dictionary
openbsd
opencve
oracle_linux
ossf_malicious_packages
osv_almalinux
osv_alpine
osv_bellsoft
osv_chainguard
osv_cran
osv_github_actions
osv_golang
osv_haskell
osv_hex
osv_maven
osv_npm
osv_nuget
osv_ocaml
osv_ossfuzz
osv_packagist
osv_pub
osv_rocky
osv_rubygems
osv_rustsec
osv_swift
osv_ubuntu
osv_wolfi
publish_stats
pysec
sadp_pilot
ssvc
ssvc_dashboard
tailscale
tsunami_enrichment
variot
vulnrichment
Clear
| ID | Title | Severity | CVSS | Source | Updated |
|---|---|---|---|---|---|
| ghsa-c3xh-98xp-6qhf | githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow | UNKNOWN | 7.1 | ghsa | unknown |
| ghsa-8q5r-mmjf-575q | Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration | UNKNOWN | 5.3 | ghsa | unknown |
| ghsa-wpqr-6v78-jr5g | Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses | UNKNOWN | 10.0 | ghsa | unknown |
| ghsa-wpqr-6v78-jr5g | Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses | UNKNOWN | 10.0 | ghsa | unknown |
| ghsa-69fq-xp46-6x23 | Trivy ecosystem supply chain was briefly compromised | UNKNOWN | 9.4 | ghsa | unknown |
| ghsa-m32f-fjw2-37v3 | Bullfrog's DNS over TCP bypasses domain filtering | UNKNOWN | 6.2 | ghsa | unknown |
| ghsa-gq52-6phf-x2r6 | tj-actions/branch-names has a Command Injection Vulnerability | UNKNOWN | 9.1 | ghsa | unknown |
| ghsa-mcph-m25j-8j63 | tj-actions/changed-files has Potential Actions command injection in output filenames (GHSL-2023-271) | UNKNOWN | 7.3 | ghsa | unknown |
| ghsa-rg3q-prf8-qxmp | Arbitrary command injection in embano1/wip | UNKNOWN | 8.8 | ghsa | unknown |
| ghsa-p756-rfxh-x63h | Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower | UNKNOWN | 3.0 | ghsa | unknown |
| ghsa-6q4m-7476-932w | github-slug-action vulnerable to arbitrary code execution | UNKNOWN | 8.8 | ghsa | unknown |
| ghsa-4xqx-pqpj-9fqw | gajira-create GitHub action vulnerable to arbitrary code execution | UNKNOWN | 9.8 | ghsa | unknown |
| ghsa-8q5r-mmjf-575q | Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration | UNKNOWN | 5.3 | ghsa | unknown |
| ghsa-2qvg-qr73-mqxp | conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target | UNKNOWN | 9.1 | ghsa | unknown |
| ghsa-2qvg-qr73-mqxp | conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target | UNKNOWN | 9.1 | ghsa | unknown |
| ghsa-v53h-f6m7-xcgm | Black's vulnerable version parsing leads to RCE in GitHub Action | UNKNOWN | 8.7 | ghsa | unknown |
| ghsa-wpqr-6v78-jr5g | Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses | UNKNOWN | 10.0 | ghsa | unknown |
| ghsa-g86g-chm8-7r2p | check-spelling workflow vulnerable to token leakage via symlink attack | UNKNOWN | 9.6 | ghsa | unknown |
| ghsa-c3xh-98xp-6qhf | githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow | UNKNOWN | 7.1 | ghsa | unknown |
| ghsa-69fq-xp46-6x23 | Trivy ecosystem supply chain was briefly compromised | UNKNOWN | 9.4 | ghsa | unknown |
| ghsa-pqwm-q9pv-ph8r | Setup PHP: Command Injection in Repository-Derived PHP Version Resolution | UNKNOWN | 5.6 | ghsa | unknown |
| ghsa-5wxr-w449-57cm | Setup PHP: GitHub tokens configured by setup-php may be exposed through pinned affected Composer versions | UNKNOWN | 5.9 | ghsa | unknown |
| ghsa-pqwm-q9pv-ph8r | Setup PHP: Command Injection in Repository-Derived PHP Version Resolution | UNKNOWN | 5.6 | ghsa | unknown |
| ghsa-6p2j-742g-835f | actions-mkdocs: Command Injection via issue title in internal GitHub Actions workflow | UNKNOWN | 6.5 | ghsa | unknown |
| ghsa-vqf5-2xx6-9wfm | GitHub PAT written to debug artifacts | UNKNOWN | 7.1 | ghsa | unknown |
| ghsa-vqf5-2xx6-9wfm | GitHub PAT written to debug artifacts | UNKNOWN | 7.1 | ghsa | unknown |
| ghsa-r4fj-r33x-8v88 | wenxian: Command Injection in GitHub Actions Workflow via `issue_comment.body` | UNKNOWN | 9.8 | ghsa | unknown |
| ghsa-f67f-hcr6-94mf | Zen-AI-Pentest has Shell Injection via untrusted issue title in ZenClaw Discord Integration workflow | UNKNOWN | 10.0 | ghsa | unknown |
| ghsa-46g3-37rh-v698 | Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier) | UNKNOWN | 4.6 | ghsa | unknown |
| ghsa-g699-3x6g-wm3g | Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier) | UNKNOWN | 4.6 | ghsa | unknown |