Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,993 results · page 5 of 40
Dec 4, 2025A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline cCVE-2025-65637 · Other software · Turbopuffer · reported by MITREHigh 7.5
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
- Product
- Logrus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025AIS-catcher is a multi-platform AIS receiver.CVE-2025-66217 · Other software · jvde-github · reported by GitHubHigh 8.8
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This vulnerability allows an attacker to trigger a massive Heap Buffer Overflow by sending a malformed MQTT packet with a manipulated Topic Length field. This leads to an immediate Denial of Service (DoS) and, when used as a library, severe Memory Corruption that can be leveraged for Remote Code Execution (RCE). This issue has been patched in version 0.64.
- Product
- AIS-catcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 28, 2025AIS-catcher is a multi-platform AIS receiver.CVE-2025-66216 · Other software · jvde-github · reported by GitHubCritical 9.3
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-catcher. This vulnerability allows an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer. This issue has been patched in version 0.64.
- Product
- AIS-catcher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2025An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919decaCVE-2025-65276 · Other software · Henzljw · reported by MITRECritical 9.8
An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919decaff2681dc250e934814fc3a35f6093ee5 (2021-07-02). Due to missing authentication checks on /admin_index.php, an attacker can directly access the admin dashboard without valid credentials. This allows full administrative control including viewing/modifying user accounts, managing orders, changing payments, and editing product listings. Successful exploitation can lead to information disclosure, data manipulation, and privilege escalation.
- Product
- Hashtech
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 20, 2025Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.CVE-2025-64660 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.CVE-2025-63878 · Other software · Hackerwhale · reported by MITREMedium 6.5
Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.
- Product
- Restaurant Website Restoran
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlinkedin.com
Nov 11, 2025Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.CVE-2025-62453 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2025GitHub Gist Shortcode: Stored Cross-Site ScriptingCVE-2025-12667 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The GitHub Gist Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'gist' shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- GitHub Gist Shortcode
- Affected
- up to 0.2
- What to do
- Affects up to 0.2. Update GitHub Gist Shortcode to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Nov 10, 2025An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label CVE-2025-11892 · Other software · GitHub · reported by product-cna@github.comHigh 8.6
An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a user, while operating in sudo mode, to click on a crafted malicious link to perform actions that require elevated privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.1, 3.17.7, 3.16.10, 3.15.14, 3.14.19.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Nov 10, 2025A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the apCVE-2025-11578 · Other software · GitHub · reported by product-cna@github.comHigh 7.5
A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise admin to gain root SSH access to the appliance by exploiting a symlink escape in pre-receive hook environments. By crafting a malicious repository and environment, an attacker could replace system binaries during hook cleanup and execute a payload that adds their own SSH key to the root user’s authorized keys—thereby granting themselves root SSH access to the server. To exploit this vulnerability, the attacker needed to have enterprise admin privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.19, and was fixed in versions 3.14.20, 3.15.15, 3.16.11, 3.17.8, 3.18.2. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Oct 28, 2025GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security.CVE-2025-62794 · Other software · RichardoC · reported by GitHubLow 3.8
GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" api. An attacker with read only access to your home directory could have read this token and used it to perform actions with that token. Update to 0.0.7.
- Product
- github-workflow-updater-extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2025Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.CVE-2025-59288 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.3
Improper verification of cryptographic signature in Github: Playwright allows an unauthorized attacker to perform spoofing over an adjacent network.
- Product
- microsoft/playwright
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide CVE-2025-11579 · Other software · nwaples · reported by responsibledisclosure@mattermost.comMedium 5.3
github.com/nwaples/rardecode versions <=2.1.1 fail to restrict the dictionary size when reading large RAR dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.
- Product
- rardecode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025Allstar is a GitHub App to set and enforce security policies.CVE-2025-61926 · Other software · ossf · reported by GitHubMedium 4.6
Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Reviewbot component caused inbound webhook requests to be validated against a hard-coded, shared secret. The value used for the secret token was compiled into the Allstar binary and could not be configured at runtime. In practice, this meant that every deployment using Reviewbot would validate requests with the same secret unless the operator modified source code and rebuilt the component - an expectation that is not documented and is easy to miss. All Allstar releases prior to v4.5 that include the Reviewbot code path are affected. Deployments on v4.5 and later are not affected. Those who have not enabled or exposed the Reviewbot endpoint are not exposed to this issue.
- Product
- allstar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.CVE-2025-10281 · Other software · BLSOPS, LLC · reported by cves@blacklanternsecurity.comMedium 4.7
BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
- Product
- bbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.blacklanternsecurity.com
Sep 27, 2025Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbersCVE-2025-10954 · Other software · Textit · reported by report@snyk.ioMedium 5.5
Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range".
- Product
- Phonenumbers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.CVE-2025-55322 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.
- Product
- OmniParser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025WP Github Gist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58875 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu WP Github Gist wp-github-gist allows Stored XSS.This issue affects WP Github Gist: from n/a through <= 0.5.
- Product
- WP Github Gist
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update WP Github Gist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 5, 2025Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form.CVE-2025-58401 · Other software · Pierre-Adrien Vasseur · reported by vultures@jpcert.or.jpMedium 5.1
Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations on the linked Github account.
- Product
- Obsidian GitHub Copilot Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2025Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks.CVE-2025-47909 · Other software · github.com/gorilla/csrf · reported by security@golang.orgHigh 7.3
Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin header is checked with sameOrigin against a synthetic URL. However, if a host is added to TrustedOrigins, both its HTTP and HTTPS origins will be allowed, because the schema of the synthetic URL is ignored and only the host is checked. For example, if an application is hosted on https://example.com and adds example.net to TrustedOrigins, a network attacker can serve a form at http://example.net to perform the attack. Applications should migrate to net/http.CrossOriginProtection, introduced in Go 1.25. If that is not an option, a backport is available as a module at filippo.io/csrf, and a drop-in replacement for the github.com/gorilla/csrf API is available at filippo.io/csrf/gorilla.
- Product
- github.com/gorilla/csrf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code coCVE-2025-8447 · Other software · GitHub · reported by product-cna@github.comHigh 7
An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. To exploit this vulnerability, an attacker needed to know the name of a private repository along with its branches, tags, or commit SHAs that they could use to trigger compare/diff functionality and retrieve limited code without proper authorization. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18, and was fixed in versions 3.14.17, 3.15.12, 3.16.8 and 3.17.5. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Aug 25, 2025The Scratch Channel is a news website.CVE-2025-55301 · Other software · The-Scratch-Channel · reported by GitHubMedium 6.7
The Scratch Channel is a news website. In version 1, it is possible to go to application in devtools and click local storage to edit the account's username locally. This issue has been patched in version 1.1.
- Product
- the-scratch-channel.github.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execuCVE-2025-53773 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
- Product
- Microsoft Visual Studio 2022 version 17.14
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comembracethered.com
Aug 6, 2025Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) heaCVE-2025-47908 · Other software · github.com/rs/cors · reported by security@golang.orgHigh 7.5
Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.
- Product
- github.com/rs/cors
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear textCVE-2025-7738 · Other software · Ansible · reported by Red HatMedium 4.4
A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.
- Product
- django-ansible-base
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jul 30, 2025GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com).CVE-2025-54584 · Other software · finos · reported by GitHubHigh 7
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). In versions 1.19.1 and below, an attacker can craft a malicious Git packfile to exploit the PACK signature detection in the parsePush.ts file. By embedding a misleading PACK signature within commit content and carefully constructing the packet structure, the attacker can trick the parser into treating invalid or unintended data as the packfile. Potentially, this would allow bypassing approval or hiding commits. This issue is fixed in version 1.19.2.
- Product
- git-proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 30, 2025GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com).CVE-2025-54583 · Other software · finos · reported by GitHubHigh 8.3
GitProxy is an application that stands between developers and a Git remote endpoint (e.g., github.com). Versions 1.19.1 and below allow users to push to remote repositories while bypassing policies and explicit approvals. Since checks and plugins are skipped, code containing secrets or unwanted changes could be pushed into a repository. This is fixed in version 1.19.2.
- Product
- git-proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2025In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flowCVE-2025-54528 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.4
In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2025tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events.CVE-2025-54416 · Other software · tj-actions · reported by GitHubCritical 9.1
tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 and below, a critical vulnerability has been identified in the tj-actions/branch-names' GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0
- Product
- branch-names
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 16, 2025The Scratch Channel is a news website that is under development as of time of this writing.CVE-2025-53904 · Other software · The-Scratch-Channel · reported by GitHubLow 1.3
The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that could make the website vulnerable to cross-site scripting. No known patches exist as of time of publication.
- Product
- the-scratch-channel.github.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2025An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors CVE-2025-6981 · Other software · GitHub · reported by product-cna@github.comMedium 5.3
An incorrect authorization vulnerability allowed unauthorized read access to the contents of internal repositories for contractor accounts when the Contractors API feature was enabled. The Contractors API is a rarely-enabled feature in private preview. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18 and was fixed in versions 3.14.15, 3.15.10, 3.16.6 and 3.17.3
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
Jul 15, 2025The Scratch Channel is a news website that is under development as of time of this writing.CVE-2025-53903 · Other software · The-Scratch-Channel · reported by GitHubLow 1.3
The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/users.js` doesn't properly sanitize text box inputs, leading to a potential vulnerability to cross-site scripting attacks. Commit 90b39eb56b27b2bac29001abb1a3cac0964b8ddb addresses this issue.
- Product
- the-scratch-channel.github.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2025GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management.CVE-2025-53818 · Other software · Sunwood-ai-labs · reported by GitHubHigh 8.9
GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and streamlining LLM task management. Version 0.3.0 of the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. The MCP Server exposes the tool `add_comment` which relies on Node.js child process API `exec` to execute the GitHub (`gh`) command, is an unsafe and vulnerable API if concatenated with untrusted user input. As of time of publication, no known patches are available.
- Product
- github-kanban-mcp-server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2025The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user.CVE-2025-53624 · Other software · webbertakken · reported by GitHubCritical 10
The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions prior to 4.0.0 are vulnerable to exposing GitHub Personal Access Tokens in production build artifacts when passed through plugin configuration options. The token, intended for build-time API access only, is inadvertently included in client-side JavaScript bundles, making it accessible to anyone who can view the website's source code. This vulnerability is fixed in 4.0.0.
- Product
- docusaurus-plugin-content-gists
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025giscus is a commenting system powered by GitHub Discussions.CVE-2025-53532 · Other software · giscus · reported by GitHubMedium 5.3
giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on any repository where giscus is installed. This affects the server-side part of giscus, which is provided via http://giscus.app or your own self-hosted service. This vulnerability is fixed by the c43af7806e65adfcf4d0feeebef76dc36c95cb9a and 4b9745fe1a326ce08d69f8a388331bc993d19389 commits.
- Product
- giscus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2025An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private repoCVE-2025-6600 · Other software · GitHub · reported by product-cna@github.comMedium 6.3
An exposure of sensitive information vulnerability was identified in GitHub Enterprise Server that could allow an attacker to disclose the names of private repositories within an organization. This issue could be exploited by leveraging a user-to-server token with no scopes via the Search API endpoint. Successful exploitation required an organization administrator to install a malicious GitHub App in the organization’s repositories. This vulnerability impacted only GitHub Enterprise Server version 3.17 and was addressed in version 3.17.2. The vulnerability was reported through the GitHub Bug Bounty program.
- Product
- GitHub Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API.CVE-2025-52477 · Other software · octo-sts · reported by GitHubHigh 8.6
Octo-STS is a GitHub App that acts like a Security Token Service (STS) for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error logs with sensitive information. Upgrade to v0.5.3 to resolve this issue. This version includes patch sets to sanitize input and redact logging.
- Product
- app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided valuesCVE-2025-52569 · Other software · JuliaWeb · reported by GitHubMedium 6.6
GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the `GitHub.repo()` function, the user can provide any string for the `repo_name` field. These inputs are not validated or safely encoded and are sent directly to the server. This means a user can add path traversal patterns like `../` in the input to access any other endpoints on `api.github.com` that were not intended. Users should upgrade immediately to v5.9.1 or later to receive a patch. All prior versions are vulnerable. No known workarounds are available.
- Product
- GitHub.jl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry.CVE-2025-52483 · Other software · JuliaRegistries · reported by GitHubHigh 8.1
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities) a shell script injection can occur within the `withpasswd` function. Alternatively, an argument injection is possible in the `gettreesha `function. either of these can then lead to a potential RCE. Users should upgrade immediately to v1.9.5 to receive a fix. All prior versions are vulnerable. No known workarounds are available.
- Product
- Registrator.jl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry.CVE-2025-52480 · Other software · JuliaRegistries · reported by GitHubHigh 8.1
Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the clone URL returned by GitHub is malicious (or can be injected using upstream vulnerabilities), an argument injection is possible in the `gettreesha()` function. This can then lead to a potential remote code execution. Users should upgrade immediately to v1.9.5 to receive a patch. All prior versions are vulnerable. No known workarounds are available.
- Product
- Registrator.jl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4.CVE-2025-46806 · Other software · https://github.com/yrutschle/sslh/releases/tag/v2.2.4 · reported by meissner@suse.deMedium 6.9
A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4.
- Product
- sslh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Jun 2, 2025A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimateCVE-2025-46807 · Other software · https://github.com/yrutschle/sslh/releases/tag/v2.2.4 · reported by meissner@suse.deHigh 8.7
A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimate users service.This issue affects sslh before 2.2.4.
- Product
- sslh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
May 30, 2025go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier.CVE-2025-48938 · Other software · cli · reported by GitHubLow 2.6
go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could result in executing arbitrary commands on a user's machine by replacing HTTP URLs provided by GitHub with local file paths for browsing. In `2.12.1`, `Browser.Browse()` has been enhanced to allow and disallow a variety of scenarios to avoid opening or executing files on the filesystem without unduly impacting HTTP URLs. No known workarounds are available other than upgrading.
- Product
- go-gh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2025GitHub Desktop is an open-source, Electron-based GitHub app designed for git development.CVE-2025-48064 · Other software · desktop · reported by GitHubLow 3.3
GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network share. This affects GitHub Desktop users on Windows that view malicious commits in the history view. macOS users are not affected. When viewing a file diff in the history view GitHub Desktop will call `git log` or `git diff` with the object id (SHA) of the commit, the name of the file, and the old name of the file if the file has been renamed. As a security precaution Git will attempt to fully resolve the old and new path via `realpath`, traversing symlinks, to ensure that the resolved paths reside within the repository working directory. This can lead to Git attempting to access a path that resides on a network share (UNC path) and in doing so Windows will attempt to perform NTLM authentication which passes information such as the computer name, the currently signed in (Windows) user name, and an NTLM hash. GitHub Desktop 3.4.20 and later fix this vulnerability. The beta channel includes the
- Product
- desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2025In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possibleCVE-2025-47851 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.8
In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows.CVE-2025-47775 · Other software · bullfrogsec · reported by GitHubMedium 6.2
Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.
- Product
- bullfrog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2025The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release.CVE-2025-47271 · Other software · OZI-Project · reported by GitHubMedium 6.3
The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13.2 through 1.13.5, potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code. This is patched in 1.13.6. As a workaround, one may downgrade to a version prior to 1.13.2.
- Product
- publish
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025The Discourse Code Review Plugin allows users to review GitHub commits on Discourse.CVE-2025-46824 · Other software · discourse · reported by GitHubLow 3.1
The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin. As a workaround, one may disable the plugin.
- Product
- discourse-code-review
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp .CVE-2025-4144 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 5.3
PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27 Impact: PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection.
- Product
- Workers-oauth-provider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2025The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that reCVE-2025-4143 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 6
The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the allowed list of redirect URIs for the given client registration. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/26 https://github.com/cloudflare/workers-oauth-provider/pull/26 Impact: Under certain circumstances (see below), if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visiting a malicious web site, then attacker could potentially steal the victim's credentials to the same OAuth server and subsequently impersonate them. In order for the attack to be possible, the OAuth server's authorized callback must be designed to auto-approve authorizations that appear to come from an OAuth client that the victim has authorized previously. The authorization flow is not implemented by workers-oauth-provider; it is up to the application built on top to decide whether to implement such automatic re-authorization. However, many applications do implement such logic. Note: It is a basic, well-known requi
- Product
- Workers-oauth-provider
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.