BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Github.com

Github.com Security Releases - October 2026

github-com-2026-10 Oct 1, 2026 Source: Vendor
Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://github.com/advisories/GHSA-pw5q-rjx4-7f7p
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

63 lines
All 63 CVEs 63 Additional recognition 0 Unclaimed only
Showing 51–63 of 63 matching , page 2 of 2 , clear filters
CVE-2026-64655 BR2026-0000-025014 github.com/cli/cli/v2 unclaimed
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
Credited as @babakks
CVE-2026-64655 BR2026-0000-025015 github.com/cli/cli/v2 unclaimed
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
Credited as @BagToad
CVE-2026-64655 BR2026-0000-025016 github.com/cli/cli/v2 unclaimed
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
Credited as @helixplant
CVE-2026-64655 BR2026-0000-025017 github.com/cli/cli/v2 unclaimed
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
Credited as @ajbeattie
CVE-2026-64655 BR2026-0000-025018 github.com/cli/cli/v2 unclaimed
GitHub CLI allows attestation verification bypass through unescaped regex metacharacters
Credited as @bdehamer
CVE-2026-64653 BR2026-0000-025019 github.com/cli/cli/v2 unclaimed
GitHub CLI allows path traversal through unescaped request URL components
Credited as @babakks
CVE-2026-64653 BR2026-0000-025020 github.com/cli/cli/v2 unclaimed
GitHub CLI allows path traversal through unescaped request URL components
Credited as @BagToad
CVE-2026-64653 BR2026-0000-025021 github.com/cli/cli/v2 unclaimed
GitHub CLI allows path traversal through unescaped request URL components
Credited as @helixplant
CVE-2026-64653 BR2026-0000-025022 github.com/cli/cli/v2 unclaimed
GitHub CLI allows path traversal through unescaped request URL components
Credited as @sam-kossey
CVE-2026-64652 BR2026-0000-025023 github.com/cli/cli/v2 unclaimed
GitHub CLI partially discloses authentication tokens in `gh auth status` output
Credited as @babakks
CVE-2026-64652 BR2026-0000-025024 github.com/cli/cli/v2 unclaimed
GitHub CLI partially discloses authentication tokens in `gh auth status` output
Credited as @BagToad
CVE-2026-64652 BR2026-0000-025025 github.com/cli/cli/v2 unclaimed
GitHub CLI partially discloses authentication tokens in `gh auth status` output
Credited as @weshaggard
CVE-2026-64652 BR2026-0000-025026 github.com/cli/cli/v2 unclaimed
GitHub CLI partially discloses authentication tokens in `gh auth status` output
Credited as @shelbyc