Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-11892 | 8.6 high | 1.0% | github, enterprise_server | An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross-site scripting via Issues search label filter that could lead to privilege escalation and unauthorized workflow triggers. Successful exploitation requires an attacker to have access to the target GitHub Enterprise Server instance and to entice a user, while operating in sudo mode, to click on a crafted malicious link to perform actions that require elevated privileges. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.18.1, 3.17.7, 3.16.10, 3.15.14, 3.14.19. | 18 Oct |
| CVE-2024-3727 | 8.3 high | 1.0% | no CPE yet | A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks. | 22 Oct |
| CVE-2026-63040 | 8.1 high | 1.0% | apache, inlong | Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12145 . | 18 Oct |
| CVE-2026-63042 | 8.1 high | 1.0% | apache, inlong | Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12161 . | 18 Oct |
| CVE-2026-76139 | 8.0 high | 1.0% | no CPE yet | A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build environment. A remote attacker could exploit this vulnerability to inject malicious code, leading to unauthorized access to build resources and potential compromise of the resulting operator bundle. | Mon 26 Oct |
| CVE-2025-64660 | 8.0 high | 1.0% | microsoft, visual_studio_code | Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a network. | 18 Oct |
| CVE-2026-8034 | 7.9 high | 1.0% | github, enterprise_server | A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library. The hostname validation used a different URL parser than the request library, enabling a crafted URL to pass validation while directing the request to an unintended host. Exploitation required network access to the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.16.18, 3.17.15, 3.18.9, 3.19.6, and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program. | Mon 26 Oct |
| CVE-2022-2946 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | Use After Free in GitHub repository vim/vim prior to 9.0.0246. | 9 Oct |
| CVE-2022-2845 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218. | 9 Oct |
| CVE-2022-2304 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2257 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2042 | 7.8 high | 1.0% | vim, apple, macos | Use After Free in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2021-29428 | 7.8 high | 1.0% | gradle, quarkus | In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and delete files within it. Gradle builds could be vulnerable to a local privilege escalation from an attacker quickly deleting and recreating files in the system temporary directory. This vulnerability impacted builds using precompiled script plugins written in Kotlin DSL and tests for Gradle plugins written using ProjectBuilder or TestKit. If you are on Windows or modern versions of macOS, you are not vulnerable. If you are on a Unix-like operating system with the "sticky" bit set on your system temporary directory, you are not vulnerable. The problem has been patched and released with Gradle 7.0. As a workaround, on Unix-like operating systems, ensure that the "sticky" bit is set. This only allows the original user (or root) to delete a file. If you are unable to change the permissions of the system temporary directory, you can move the Java temporary directory by setting the System Property `java.io.tmpdir`. The new path needs to limit permissions to the build user only. For additional details refer to the referenced GitHub Security Advisory. | 8 Oct |
| CVE-2022-2522 | 7.8 high | 1.0% | vim | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. | 8 Oct |
| CVE-2022-2345 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Use After Free in GitHub repository vim/vim prior to 9.0.0046. | 8 Oct |
| CVE-2022-2344 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0045. | 8 Oct |
| CVE-2022-2343 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0044. | 8 Oct |
| CVE-2022-2286 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2285 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2284 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2022-2210 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2207 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2206 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2175 | 7.8 high | 1.0% | vim, fedoraproject, fedora | Buffer Over-read in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-2129 | 7.8 high | 1.0% | vim, fedoraproject, fedora, debian_linux | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2022-0351 | 7.8 high | 1.0% | vim, debian, debian_linux, macos | Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2. | 8 Oct |
| CVE-2025-59844 | 7.7 high | 1.0% | no CPE yet | SonarQube Server and Cloud is a static analysis solution for continuous code quality and security inspection. A command injection vulnerability exists in SonarQube GitHub Action in version 4.0.0 to before version 6.0.0 when workflows pass user-controlled input to the args parameter on Windows runners without proper validation. This vulnerability bypasses a previous security fix and allows arbitrary command execution, potentially leading to exposure of sensitive environment variables and compromise of the runner environment. The vulnerability has been fixed in version 6.0.0. Users should upgrade to this version or later. | 9 Oct |
| CVE-2026-100169 | 7.6 high | 1.0% | no CPE yet | Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because ProwlerSocialAccountAdapter.pre_social_login() in api/src/backend/api/adapters.py links a Google or GitHub login to any existing local account that has the same email address as the one returned by the provider, without requiring that the address has been verified by the provider or on the existing account, and without any other check that both accounts belong to the same person. Self registration is open and the new account is usable at once, because UserViewSet.get_permissions() in api/src/backend/api/v1/views.py grants AllowAny to the create action, ACCOUNT_EMAIL_VERIFICATION is set to none in api/src/backend/config/settings/social_login.py, and the Django ModelBackend checks only the password and is_active, not the django-allauth EmailAddress record. An attacker who registers an email address before its owner keeps the password set at registration after the link is made, because sociallogin.connect() does not reset the password and does not disable the existing account, and the owner who later signs in with Google or GitHub is logged into the attacker's account. django-allauth makes the same email based link on its own, because SOCIALACCOUNT_EMAIL_AUTHENTICATION and SOCIALACCOUNT_EMAIL_AUTHENTICATION_AUTO_CONNECT are both set to True in the same settings module. This gives the attacker the cloud provider credentials, scan findings and tenant memberships held in the account. | 16 Oct |
| CVE-2026-82230 | 7.5 high | 1.0% | no CPE yet | Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash via sending deeply nested mcpack data. Root Cause: The bRPC mcpack2pb parser (used to serve nshead_mcpack / ubrpc / public_pbrpc requests) recursively parses nested objects and arrays without any depth limit. For a protobuf message that references itself (e.g. a repeated message field), the generated parser recurses once per nesting level of the incoming mcpack object. A deeply nested request makes the recursion grow unbounded, overflow the stack and crash the process. Affected Scenarios: Use bRPC server with a recursive-schema protobuf message to serve nshead_mcpack / ubrpc / public_pbrpc requests from untrusted network. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3499 Note: No matter which option you choose, you should know that the fix enforces the documented parsing depth limit MAX_DEPTH (128) on the parse path, the same limit the serializer already applies. If your requests contain mcpack messages nested deeper than 128 levels, the request will be failed after applying the fix. | Mon 26 Oct |
| CVE-2026-56386 | 7.5 high | 1.0% | no CPE yet | Integer underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause denial of service by sending a malformed DATA frame with the PADDED flag set and a zero-length payload. Root Cause: The HTTP/2 DATA frame handler computed the fragment size from the attacker-controlled payload length and, when the PADDED flag was present, decremented the fragment size before ensuring that the frame contained the mandatory pad length byte. A zero-length padded DATA frame could therefore underflow the unsigned fragment size and read the pad length byte past the end of the frame buffer. Affected Scenarios: Apache bRPC servers that accept HTTP/2 traffic are affected when a remote client can send crafted HTTP/2 frames to the server. HTTP/2 may be reached through cleartext h2c detection on an HTTP port or through TLS ALPN negotiation. How to Fix: (Choose one of the following options) 1. Upgrade Apache bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3325 Note: The fix validates that a padded DATA frame has enough payload bytes for the pad length field before decrementing the fragment size or reading the pad length byte. Malformed zero-length padded DATA frames are rejected with HTTP/2 FRAME_SIZE_ERROR. | Mon 26 Oct |
| CVE-2026-74757 | 7.5 high | 1.0% | no CPE yet | Uncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server allocate a large amount of memory via sending a crafted mcpack request with a huge array item count. Root Cause: The bRPC mcpack2pb parser trusts the item count stored in the mcpack array header without validating it against the actual payload size. The code generated by the mcpack2pb protoc plugin uses this count to preallocate memory for repeated protobuf fields via Reserve(). A malformed request declaring item_count = 0x7fffffff can force the server to preallocate about 16GB of virtual memory, which may abort the process (SIGABRT) on memory-constrained hosts. Affected Scenarios: Use a bRPC server that wires a NsheadService to UbrpcMcpack2Adaptor (the Baidu ubrpc deployment pattern) and parses requests with code generated by the mcpack2pb protoc plugin. The request body is parsed before authentication. How to Fix: (Choose one of the following options) 1. Upgrade bRPC to version 1.18.0, which fixes this issue. 2. Apply this patch: https://github.com/apache/brpc/pull/3451 Note: No matter which option you choose, you should know that the fix caps the array item count to the remaining bytes of the array payload. | Mon 26 Oct |
| CVE-2026-50519 | 7.5 high | 1.0% | microsoft, github_copilot_chat | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | Sun 25 Oct |
| CVE-2026-54063 | 7.5 high | 1.0% | excelize | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled <row r="N"> XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows = 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r=2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r=-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0. | Sun 25 Oct |
| CVE-2026-47690 | 7.5 high | 1.0% | no CPE yet | MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of `GITHUB_TOKEN` with write permissions to the repository. The vulnerable workflow used pull_request_target, which runs in the context of the base repository with access to secrets. Commit 923820de8f64d753951fbbd54f7282a3d5f75173 fixes the issue. No known workarounds are available. | Sat 24 Oct |
| CVE-2026-61483 | 7.5 high | 1.0% | apache, lucy | ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the ASF. Lucy is now maintained outside of the ASF at https://github.com/lucysearch | Sat 24 Oct |
| CVE-2026-47427 | 7.5 high | 1.0% | github, mcp_server | GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go runtime panic; because the crash occurs before any authentication or token validation, any unauthenticated client able to send JSON-RPC messages can crash the server, resulting in a complete denial of service. This issue is fixed in version 1.1.0. | Sat 24 Oct |
| CVE-2026-63490 | 7.5 high | 1.0% | no CPE yet | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3. | 18 Oct |
| CVE-2026-63043 | 7.5 high | 1.0% | apache, inlong | Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12146 . | 18 Oct |
| CVE-2025-66389 | 7.5 high | 1.0% | microsoft, github_copilot | GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection. | 12 Oct |
| CVE-2022-2287 | 7.1 high | 1.0% | vim, fedoraproject, fedora | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. | 8 Oct |
| CVE-2026-34480 | 6.9 medium | 1.0% | apache, log4j | Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters. The impact depends on the StAX implementation in use: * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records. * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output. | Mon 26 Oct |
| CVE-2026-78178 | 6.9 medium | 1.0% | no CPE yet | A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely. The reported GitHub issue was closed with the label "not planned". | 14 Oct |
| CVE-2026-78147 | 6.9 medium | 1.0% | no CPE yet | A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The attack may be initiated remotely. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity. | 12 Oct |
| CVE-2026-78180 | 6.9 medium | 1.0% | no CPE yet | A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider.getContextProps of the file components/dialog/index.tsx of the component deepMerge. Performing a manipulation of the argument locale results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The reported GitHub issue was closed automatically due to inactivity. | 12 Oct |
| CVE-2026-15996 | 6.6 medium | 1.0% | github, enterprise_server | A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request containing deeply nested parameters. Because request parameters were parsed before routing and authentication, any POST endpoint could be used to trigger the condition, which could render the instance unresponsive. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16. | 23 Oct |
| CVE-2023-31101 | 6.5 medium | 1.0% | apache, inlong | Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6.0. Users registered in InLong who joined later can see deleted users' data. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 https://github.com/apache/inlong/pull/7836 to solve it. | Wed 28 Oct |
| CVE-2026-23653 | 6.5 medium | 1.0% | microsoft, github_copilot_chat | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to disclose information over a network. | Mon 26 Oct |
| CVE-2026-47282 | 6.5 medium | 1.0% | microsoft, visual_studio_code | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | Sat 24 Oct |
| CVE-2026-65675 | 6.5 medium | 1.0% | microsoft, github_copilot_chat | No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network. | Sat 24 Oct |
| CVE-2026-116123 | 6.3 medium | 1.0% | no CPE yet | A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signup. Executing a manipulation can lead to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The vendor documents this as intentional. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way. | Mon 26 Oct |
Download these 342 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.