Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
MAL-2026-14245
  • npm/github-policy-bot
 Malicious code in github-policy-bot (npm) 19 Aug
  • No fix available
MAL-2026-12389
  • npm/github-app-sts-action
 Malicious code in github-app-sts-action (npm) 05 Aug
  • No fix available
GHSA-464c-974j-9xm6
  • Go/github.com/aws/aws-cdk-go/awscdk
  • Go/github.com/aws/aws-cdk-go/awscdk/v2
  • Maven/software.amazon.awscdk:aws-cdk-lib
  • Maven/software.amazon.awscdk:codebuild
  • NuGet/Amazon.CDK.AWS.CodeBuild
  • ... 5 more
 AWS CDK CodeBuild S3 Log Encryption Boolean Inversion 24 Jul
  • Fix available
  • Severity - 3.3 (Low)
MAL-2026-6052
  • npm/@mastra/github-signals
 Malicious code in @mastra/github-signals (npm) 17 Jun
  • No fix available
MAL-2026-5479
  • npm/mcp-server-github
 Malicious code in mcp-server-github (npm) 09 Jun
  • No fix available
MAL-2026-5259
  • npm/github-archiver
 Malicious code in github-archiver (npm) 05 Jun
  • No fix available
MAL-2026-5107
  • npm/cms-github
 Malicious code in cms-github (npm) 01 Jun
  • No fix available
GHSA-f396-4rp4-7v2j
  • Go/github.com/boxlite-ai/boxlite/sdks/go
  • PyPI/boxlite
  • crates.io/boxlite
  • crates.io/boxlite-cli
  • npm/@boxlite-ai/boxlite
 Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host 21 May
  • Fix available
  • Severity - 9.6 (Critical)
GHSA-g6ww-w5j2-r7x3
  • Go/github.com/boxlite-ai/boxlite/sdks/go
  • PyPI/boxlite
  • crates.io/boxlite
  • crates.io/boxlite-cli
  • npm/@boxlite-ai/boxlite
 BoxLite: Permission Bypass Allows Modification of Read-Only Files 21 May
  • Fix available
  • Severity - 10.0 (Critical)
MAL-2026-4018
  • npm/@antv/github-config-cli
 Malicious code in @antv/github-config-cli (npm) 19 May
  • No fix available
GHSA-x3r2-fj3r-g5mv
  • Maven/io.github.davidalmeidac:sealed-env-core
  • npm/sealed-env
 sealed-env: TOTP secret embedded in unseal token payload (enterprise mode) 12 May
  • Fix available
  • Severity - 9.1 (Critical)
GHSA-9ccr-r5hg-74gf
  • npm/@github/copilot
 GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor 11 May
  • Fix available
  • Severity - 8.5 (High)
GHSA-7j59-v9qr-6fq9
  • Go/github.com/microsoft/kiota-http-go
  • Maven/com.microsoft.kiota:microsoft-kiota-abstractions
  • NuGet/Microsoft.Kiota.Abstractions
  • PyPI/microsoft-kiota-http
  • npm/kiota-typescript
 Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect 07 May
  • Fix available
  • Severity - 7.0 (High)
GHSA-g485-8j3v-p6x8
  • npm/@tdurieux/anonymous_github
 @tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin 05 May
  • Fix available
  • Severity - 8.1 (High)
GHSA-wpqr-6v78-jr5g
  • GitHub Actions/google-github-actions/run-gemini-cli
  • npm/@google/gemini-cli
 Gemini CLI: Remote Code Execution via workspace trust and tool allowlisting bypasses 24 Apr
  • Fix available
  • Severity - 10.0 (Critical)
MAL-2026-2729
  • npm/apl-github-test
 Malicious code in apl-github-test (npm) 16 Apr
  • No fix available
Load more...