CVE-2026-64654 GitHub CLI: Terminal escape sequence injection in multiple `gh` commands
Information published.
EPSS 0.01 CVE-2026-64654 GitHub US
Výsledky hledání
3
CVE-2026-64652 GitHub CLI: Partial token disclosure in `gh auth status` output
Information published.
EPSS 0.00 CVE-2026-64652 GitHub US
CVE-2026-64653 GitHub CLI: Unescaped variable components in request URLs could allow path traversal
Information published.
EPSS 0.01 CVE-2026-64653 GitHub US
1
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
In this article Attack chain overviewMitigation and protection guidanceIndicators of compromise (IOC)Microsoft Defender XDR detectionsAdvanced hunting queriesLearn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major enterprise software ecosystems such as keyv, flat-cache, cache-manager, and others. The malicious releases contain a Mini Shai-Hulud…
Microsoft npm GitHub Amazon Web Services výroba a průmysl US
1
How legitimate cloud platforms enable phishers to bypass MFA
Threat actors are increasingly exploiting legitimate cloud services to evade detection and streamline the deployment of their scam infrastructure. Cloud hosting services and decentralized networks have become primary platforms for hosting phishing pages and sites. Throughout 2025 and 2026, we have observed phishing operators steadily migrate toward platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This post analyzes the mechanics of a real-life adversary-in-the-middle …
1
CVE-2026-59831 GitHub CLI `gh codespace jupyter` could allow remote code execution when connecting to a malicious Codespace
Information published.
EPSS 0.00 CVE-2026-59831 GitHub US
1
CVE-2026-41109 GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-41109 GitHub US