Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- Medium6.3KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization.EPSS 38.0%Apr 29, 2025
- Medium6.0Harden-Runner is a CI/CD security agent that works like an EDR for GitHub Actions runners.EPSS 23.0%Apr 21, 2025
- Critical9.8Adept is a language for general purpose programming.EPSS 58.0%Apr 21, 2025
- High8.7z80pack is a mature emulator of multiple platforms with 8080 and Z80 CPU.EPSS 53.0%Apr 18, 2025
- High8.6An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used math blocks.EPSS 30.0%Apr 17, 2025
- High7.1A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionaEPSS 129.0%Apr 17, 2025
- Medium5.3A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn't otherwise have acceEPSS 42.0%Apr 17, 2025
- Low2.2Weblate is a web based localization tool.EPSS 38.0%Apr 15, 2025
- High8.6reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityKEVEPSS 2.5%Mar 19, 2025
- High8.6tj-actions/changed-files GitHub Action Embedded Malicious Code VulnerabilityKEVEPSS 72.1%Mar 14, 2025
- None0.0Agent Dart is missing certificate verification checksEPSS 0.4%Oct 15, 2024
- UnknownJenkins github Exposure of Sensitive Information to an Unauthorized ActorKEVSep 19, 2024
- Unknowncamptocamp terraboard Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')KEVMay 15, 2024
- Unknownunsafe-libyaml is unmaintainedMar 25, 2024
- Unknownpyload pyload Improper Control of Generation of Code ('Code Injection')KEVJan 22, 2024
- High7.3tj-actions/changed-files has Potential Actions command injection in output filenames (GHSL-2023-271)EPSS 3.4%Jan 2, 2024
- Unknownmicroweber microweber Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')KEVDec 20, 2023
- Medium5.9pubnub Insufficient Entropy vulnerabilityEPSS 1.0%Dec 6, 2023
- Unknownlfprojects mlflow Path Traversal: '\..\filename'KEVDec 1, 2023
- Unknowneasyappointments easyappointments Exposure of Private Personal Information to an Unauthorized ActorKEVNov 17, 2023
- UnknownDenial of Service (DoS) vulnerabilitiesOct 6, 2023
- UnknownDenial of Service (DoS) and Arbitrary Code Execution (ACE) vulnerabilitiesOct 6, 2023
- UnknownDenial of Service (DoS) vulnerabilityOct 6, 2023
- High7.5Ignite Realtime Openfire Path Traversal VulnerabilityKEVEPSS 100.0%May 26, 2023
- Medium6.1[IMP] web: StaticList: support CLEAR (5) orm command Before this commit, the StaticList didn't expose a way to apply a CLEAR command (command 5), i.e.EPSS 1.4%Apr 25, 2023