BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Github.com

Github.com Security Releases - October 2026

github-com-2026-10 Oct 1, 2026 Source: Vendor
Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://github.com/advisories/GHSA-pw5q-rjx4-7f7p
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

63 lines
All 63 CVEs 63 Additional recognition 0 Unclaimed only
Showing 1–50 of 63 , page 1 of 2
CVE-2026-96627 BR2026-0000-024919 github.com/getarcaneapp/arcane/backend/v2 unclaimed
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
Credited as @manus-use
CVE-2026-96628 BR2026-0000-024920 github.com/getarcaneapp/arcane/backend/v2 unclaimed
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
Credited as @gehan-psbc
CVE-2026-100349 BR2026-0000-024921 github.com/getkin/kin-openapi unclaimed
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
Credited as @vnykmshr
CVE-2026-62994 BR2026-0000-024924 github.com/coredns/coredns unclaimed
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
Credited as @sondt99
CVE-2026-102941 BR2026-0000-024930 github.com/gomarkdown/markdown unclaimed
gomarkdown/markdown IsSafeURL panics on short URLs
Credited as @arpitjain099
CVE-2026-103028 BR2026-0000-024937 github.com/drakkan/sftpgo/v2 unclaimed
SFTPGo source-side file-pattern filter bypass during copy operations
Credited as @arpitjain099
CVE-2026-95838 BR2026-0000-024938 github.com/containerd/containerd/v2, github.com/containerd/containerd unclaimed
containerd: Unpack DoS via repeated opaque whiteouts
Credited as @jake-ciolek
CVE-2026-85747 BR2026-0000-024939 github.com/docker/distribution, github.com/distribution/distribution/v3 unclaimed
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Credited as @KrisKennawayDD
CVE-2026-95837 BR2026-0000-024941 github.com/containerd/containerd/v2 unclaimed
containerd CRI plugin: Checkpoint restore bypasses destination security context
Credited as @l2yyd5
CVE-2026-100353 BR2026-0000-024942 github.com/getkin/kin-openapi unclaimed
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
Credited as @eros938
CVE-2026-100353 BR2026-0000-024943 github.com/getkin/kin-openapi unclaimed
kin-openapi: Incomplete Fix for GHSA-p6wj-qrr4-pgh5: Three Unpatched nil-Items Panic Paths in openapi3filter
Credited as @hash3liZer
CVE-2026-100354 BR2026-0000-024944 github.com/getkin/kin-openapi unclaimed
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
Credited as @eros938
CVE-2026-100354 BR2026-0000-024945 github.com/getkin/kin-openapi unclaimed
kin-openapi: Uncontrolled Recursion on Circular allOf/anyOf/oneOf Schemas Causes Fatal Process Crash
Credited as @hash3liZer
CVE-2026-100352 BR2026-0000-024946 github.com/getkin/kin-openapi unclaimed
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
Credited as @eros938
CVE-2026-100352 BR2026-0000-024947 github.com/getkin/kin-openapi unclaimed
kin-openapi: YAML NaN/Inf Values Bypass Built-in Guards and Panic via OAS 3.1 Validation Path
Credited as @hash3liZer
CVE-2026-77564 BR2026-0000-024948 github.com/talos-systems/talos unclaimed
Talos Linux: Support bundle does not redact registry credentials
Credited as @Thanzex
CVE-2026-77524 BR2026-0000-024949 github.com/kedacore/keda, github.com/kedacore/keda/v2 unclaimed
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Credited as @cherez0ff
CVE-2026-77524 BR2026-0000-024950 github.com/kedacore/keda, github.com/kedacore/keda/v2 unclaimed
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Credited as @the-vibe-dev
CVE-2026-77524 BR2026-0000-024951 github.com/kedacore/keda, github.com/kedacore/keda/v2 unclaimed
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Credited as @everping
CVE-2026-77524 BR2026-0000-024952 github.com/kedacore/keda, github.com/kedacore/keda/v2 unclaimed
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Credited as @zwindler
CVE-2026-77524 BR2026-0000-024953 github.com/kedacore/keda, github.com/kedacore/keda/v2 unclaimed
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Credited as @b0b0haha
CVE-2026-77524 BR2026-0000-024954 github.com/kedacore/keda, github.com/kedacore/keda/v2 unclaimed
KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication
Credited as @j311yl0v3u
CVE-2026-77459 BR2026-0000-024955 github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3 unclaimed
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Credited as @RealFakeAccount
CVE-2026-77459 BR2026-0000-024956 github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3 unclaimed
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Credited as @AdamKorcz
CVE-2026-77459 BR2026-0000-024957 github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3 unclaimed
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Credited as @0xshylines
CVE-2026-77459 BR2026-0000-024958 github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3 unclaimed
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Credited as @thevilledev
CVE-2026-77459 BR2026-0000-024959 github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3 unclaimed
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Credited as @HenriWilliams
CVE-2026-77459 BR2026-0000-024960 github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3 unclaimed
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Credited as @cherez0ff
CVE-2026-77459 BR2026-0000-024961 github.com/argoproj/argo-cd/v2, github.com/argoproj/argo-cd/v3 unclaimed
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
Credited as @zwindler
CVE-2026-100351 BR2026-0000-024962 github.com/getkin/kin-openapi unclaimed
kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion
Credited as @satokan
CVE-2026-100350 BR2026-0000-024966 github.com/getkin/kin-openapi unclaimed
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
Credited as @matiasinsaurralde
CVE-2026-102748 BR2026-0000-024967 github.com/dgraph-io/dgraph/v25 unclaimed
Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service
Credited as @0d000721999
CVE-2026-100348 BR2026-0000-024973 github.com/getkin/kin-openapi unclaimed
kin-openapi spec loader panics on a self-referential additionalProperties $ref (nil-pointer DoS)
Credited as @arpitjain099
CVE-2026-100347 BR2026-0000-024974 github.com/getkin/kin-openapi unclaimed
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
Credited as @manus-use
CVE-2026-102603 BR2026-0000-024975 github.com/gotify/server/v2, github.com/gotify/server/v3 unclaimed
Gotify: Insufficiently Protected Password Change endpoint
Credited as @scumfrog
CVE-2026-100394 BR2026-0000-024976 github.com/nezhahq/nezha unclaimed
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
Credited as @thesmartshadow
CVE-2026-97394 BR2026-0000-024977 github.com/getkin/kin-openapi unclaimed
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
Credited as @matiasinsaurralde
CVE-2026-82416 BR2026-0000-024979 github.com/dunglas/frankenphp unclaimed
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
Credited as @dunglas
CVE-2026-77375 BR2026-0000-024980 github.com/drakkan/sftpgo/v2 unclaimed
SFTPGo: Denial of service via malformed SSH channel request
Credited as @arnimar
CVE-2026-84360 BR2026-0000-024981 github.com/0xJacky/Nginx-UI unclaimed
Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools
Credited as @Vincent550102
CVE-2026-84321 BR2026-0000-024982 github.com/0xJacky/Nginx-UI unclaimed
Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable
Credited as @Vincent550102
CVE-2026-84316 BR2026-0000-024983 github.com/0xJacky/Nginx-UI unclaimed
Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)
Credited as @novice-22
CVE-2026-84315 BR2026-0000-024994 github.com/0xJacky/Nginx-UI unclaimed
Nginx UI OTP secure-session step-up is missing on sensitive mutation routes
Credited as @jagstack
CVE-2026-84318 BR2026-0000-024996 github.com/0xJacky/Nginx-UI unclaimed
Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE
Credited as @thekogo
CVE-2026-84317 BR2026-0000-024997 github.com/0xJacky/Nginx-UI unclaimed
Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)
Credited as @novice-22
CVE-2026-84320 BR2026-0000-024998 github.com/0xJacky/Nginx-UI unclaimed
Nginx UI: Auto backup name allows path traversal outside validated storage path
Credited as @jagstack
CVE-2026-84319 BR2026-0000-024999 github.com/0xJacky/Nginx-UI unclaimed
Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker context
Credited as @aleff-github
CVE-2026-77622 BR2026-0000-025006 github.com/BishopFox/sliver unclaimed
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Credited as @CalebKingan
CVE-2026-77622 BR2026-0000-025007 github.com/BishopFox/sliver unclaimed
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
Credited as @Squ1shification
CVE-2026-64672 BR2026-0000-025013 github.com/gruntwork-io/terragrunt unclaimed
Terragrunt catalog predictable temp symlink clobber
Credited as @br0x2