Datadog Security Labs is warning of “several overlapping campaigns” that are systematically enumerating corporate GitHub organizations, repositories, and user accounts through the GitHub API. “Operators rely on automated scraping tooling with custom or legitimate-sounding user agents, leveraging GitHub ‘ghost’ accounts that…
CVE ID :CVE-2026-61343 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :LibreBooking’s email template editor save action passes the submitted template name directly into the destination file path, allowing a remote attacker with administrator credentials to write…
CVE ID :CVE-2026-59726 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Ruflo is an agent meta-harness for Claude Code and Codex. Prior to 3.16.3, ruflo’s default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group…
CVE ID :CVE-2026-59734 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify’s app generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and…
CVE ID :CVE-2026-59826 Published : July 9, 2026, 6:16 p.m. | 56 minutes ago Description :Metabase is an open-source business intelligence and embedded analytics tool. From 1.55.0 until 1.58.15.1, 1.59.12, 1.60.6.3, and 1.61.2, Metabase did not validate unsafe H2 connection properties…
CVE ID :CVE-2026-60102 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize…
CVE ID :CVE-2026-59879 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an…
CVE ID :CVE-2026-59261 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can…
CVE ID :CVE-2026-59731 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit,…
CVE ID :CVE-2026-29008 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net) that allows a network-adjacent attacker to crash the bootloader by sending a…