https://vulnpocalypse.dev/feeds/Build pipeline advisories: GitLab and GitHub CI flaws, runner compromise, and secrets exposed through automation.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/Thu, 12 Nov 2026 12:00:00 +0000Hidden shell commands in GitHub issues, PRs and comments hit 61 repos, including Trivy and MLflow. Find workflows that put issue text into run steps.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/https://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/Thu, 12 Nov 2026 12:00:00 +0000BufferZoneCorp Go modules and knot-* gems stole SSH, cloud, npm, gh and kube credentials and tampered with GitHub Actions. Check go.mod and Gemfile.lock.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/armadin-report-claims-88-of-severe-flaws-fall-outside-vendor-advisories/https://vulnpocalypse.dev/advisories/armadin-report-claims-88-of-severe-flaws-fall-outside-vendor-advisories/Wed, 11 Nov 2026 12:00:00 +0000Armadin reports most severe flaws in its tests sat outside vendor advisories, so check your own code, exposed consoles and stored secrets.exploitedenterpriseci-cdhttps://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/https://vulnpocalypse.dev/advisories/binance-hot-wallet-theft-2026/Wed, 11 Nov 2026 12:00:00 +0000On 29 Oct 2026 attackers got Binance's hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.breachcryptocloudci-cdhttps://vulnpocalypse.dev/advisories/railway-breach-rotate-all-environment-variables-and-secrets/https://vulnpocalypse.dev/advisories/railway-breach-rotate-all-environment-variables-and-secrets/Wed, 11 Nov 2026 12:00:00 +0000Railway confirmed attackers may have decrypted customer environment variables; rotate every secret stored there and review provider logs.ai-toolscloudci-cdai-toolshttps://vulnpocalypse.dev/advisories/litellm-pypi-docker-compromise/https://vulnpocalypse.dev/advisories/litellm-pypi-docker-compromise/Wed, 11 Nov 2026 12:00:00 +0000Attackers with stolen gh CLI tokens shipped malware as LiteLLM 1.107.0 on PyPI, Docker Hub and GHCR. Check before running Python, then rebuild and rotate.supply-chainpypiai-toolsci-cdhttps://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/Wed, 11 Nov 2026 12:00:00 +0000LiteLLM 1.107.0 on PyPI and official Docker images ran a credential stealer on every Python start; roll back to 1.106.2 and rotate all reachable secrets.supply-chainpypiai-toolsopen-sourceci-cdcloudhttps://vulnpocalypse.dev/advisories/atlassian-data-center-cve-2026-21589-file-read/https://vulnpocalypse.dev/advisories/atlassian-data-center-cve-2026-21589-file-read/Wed, 11 Nov 2026 12:00:00 +0000A pre-auth file read hits every Atlassian Data Center product and can leak Crowd credentials; exploited. Patch, or apply Atlassian's block rule.exploitedenterpriseci-cdhttps://vulnpocalypse.dev/advisories/actions-cool-issues-helper-reenabled-malware/https://vulnpocalypse.dev/advisories/actions-cool-issues-helper-reenabled-malware/Wed, 11 Nov 2026 12:00:00 +0000Hijacked actions-cool/issues-helper and maintain-one-comment were re-enabled on 16 Sep 2026 with every tag still malicious. Remove them and rotate CI secrets.supply-chaingithub-actionsci-cdai-toolshttps://vulnpocalypse.dev/advisories/ai-coding-agents-ci-prompt-injection/https://vulnpocalypse.dev/advisories/ai-coding-agents-ci-prompt-injection/Wed, 11 Nov 2026 12:00:00 +0000Prompt injection in GitHub issues let attackers reach CI secrets through Claude Code, Gemini CLI and Codex. Upgrade, and keep untrusted input away from secrets.ai-toolsgithub-actionsai-toolsci-cdhttps://vulnpocalypse.dev/advisories/tanstack-nx-console-github-breach/https://vulnpocalypse.dev/advisories/tanstack-nx-console-github-breach/Wed, 11 Nov 2026 12:00:00 +0000Poisoned TanStack packages stole an Nx developer's GitHub token. A trojaned Nx Console release then hit GitHub and Grafana. Check installs, rotate tokens.supply-chainnpmgithub-actionsci-cdhttps://vulnpocalypse.dev/advisories/axios-npm-hijack/https://vulnpocalypse.dev/advisories/axios-npm-hijack/Wed, 11 Nov 2026 12:00:00 +0000A hijacked maintainer account published axios 1.14.1 and 0.30.4 with a dependency that installs a remote access trojan. Check lockfiles for plain-crypto-js.supply-chainnpmci-cdhttps://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/https://vulnpocalypse.dev/advisories/teampcp-trivy-litellm-supply-chain/Wed, 11 Nov 2026 12:00:00 +0000Poisoned Trivy and KICS actions and images, LiteLLM 1.82.7/1.82.8 and Telnyx 4.87.1/4.87.2 stole CI and developer secrets. Check, then rotate.supply-chaingithub-actionspypici-cdai-toolshttps://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/https://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/Tue, 10 Nov 2026 12:00:00 +0000Infosecurity Magazine reports Datadog claims median high/critical cloud workload flaws rose from four to 16; review long-lived keys and dependencyai-toolscloudai-toolsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/https://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/Mon, 09 Nov 2026 12:00:00 +0000Sonatype reports concealed PolinRider loaders in 12 hijacked npm releases; check lockfiles and mirrors and remove the affected versions.supply-chainnpmnodejsopen-sourceci-cdhttps://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/https://vulnpocalypse.dev/advisories/aoki-and-aokigahara-infostealers-target-ai-coding-assistant-credentials/Mon, 09 Nov 2026 12:00:00 +0000Infostealers dubbed Aoki and Aokigahara steal AI coding assistant tokens and cloud keys, so rotate them if a developer machine may be infected.ai-toolsai-toolsendpointcloudci-cdcryptohttps://vulnpocalypse.dev/advisories/dosu-says-attacker-abused-org-invite-flaw-to-reach-its-db-ci-and-cloud/https://vulnpocalypse.dev/advisories/dosu-says-attacker-abused-org-invite-flaw-to-reach-its-db-ci-and-cloud/Sun, 08 Nov 2026 12:00:00 +0000Dosu says an attacker abused an org-invitation flaw to reach its database, CI and cloud; it advises customers to check logs for its listed indicators.ai-toolsci-cdcloudai-toolshttps://vulnpocalypse.dev/advisories/stolen-entra-id-app-credentials-and-azure-devops-identities-used-to-breach-27-or/https://vulnpocalypse.dev/advisories/stolen-entra-id-app-credentials-and-azure-devops-identities-used-to-breach-27-or/Sun, 08 Nov 2026 12:00:00 +0000Attackers used stolen Microsoft Entra ID app credentials and Azure DevOps identities to reach at least 27 organizations via MSPs, with no Microsoft flawbreachcloudenterpriseci-cdhttps://vulnpocalypse.dev/advisories/cisa-says-gitlab-and-cisco-asaftd-flaws-exploited-adds-two-cves-to-kev/https://vulnpocalypse.dev/advisories/cisa-says-gitlab-and-cisco-asaftd-flaws-exploited-adds-two-cves-to-kev/Sun, 08 Nov 2026 12:00:00 +0000CISA says it added GitLab CVE-2026-97229 and Cisco ASA/FTD CVE-2026-76418 to its KEV catalog on exploitation evidence; patch affected systems.exploitedenterprisenetwork-edgeci-cdhttps://vulnpocalypse.dev/advisories/gitlab-ci-regex-rce/https://vulnpocalypse.dev/advisories/gitlab-ci-regex-rce/Sun, 08 Nov 2026 12:00:00 +0000Two CVSS 10 regex flaws give unauthenticated code execution on self-managed GitLab; one is exploited. Upgrade to 19.5.1, 19.4.3, 19.3.6 or a 21 Oct backport.exploitedci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/https://vulnpocalypse.dev/advisories/rapid7-reports-new-metasploit-modules-for-citrix-netscaler-flowise-spip/Fri, 06 Nov 2026 12:00:00 +0000Rapid7 says new Metasploit modules target Citrix NetScaler, Flowise, SPIP and OpenBullet2 flaws, so check exposure and apply vendor fixes.ai-toolsnetwork-edgeci-cdai-toolsphpopen-sourcewebhttps://vulnpocalypse.dev/advisories/truffle-security-says-new-program-targets-14-million-live-leaked-secrets/https://vulnpocalypse.dev/advisories/truffle-security-says-new-program-targets-14-million-live-leaked-secrets/Thu, 05 Nov 2026 12:00:00 +0000Truffle Security says its free program will help issuers revoke 1.4 million exposed but valid secrets, so rotate any key you have published by mistake.ai-toolsopen-sourceai-toolscloudci-cdhttps://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/https://vulnpocalypse.dev/advisories/artex-docker-image-backdoored-researcher-says-cert-in-flags-crafty-falcon/Thu, 05 Nov 2026 12:00:00 +0000A researcher reports a backdoored ARTEX Docker image giving unauthenticated root shells; remove any ARTEX install built from unvetted images.supply-chainai-toolsopen-sourcecloudcryptophpnodejsci-cdhttps://vulnpocalypse.dev/advisories/aikido-reports-deleting-a-leaked-key-from-a-repo-does-not-protect-you/https://vulnpocalypse.dev/advisories/aikido-reports-deleting-a-leaked-key-from-a-repo-does-not-protect-you/Thu, 05 Nov 2026 12:00:00 +0000Aikido says deleting a file, rewriting history or deleting a repo leaves leaked keys reachable; rotate the credential first.supply-chainopen-sourceci-cdhttps://vulnpocalypse.dev/advisories/ghappier-npm-supply-chain-loader/https://vulnpocalypse.dev/advisories/ghappier-npm-supply-chain-loader/Wed, 04 Nov 2026 12:00:00 +0000A loader shipped in @dforge-core/dforge-mcp 0.2.21 with valid npm provenance via GitHub Actions trusted publishing, in 65+ repos. Pin 0.2.22, rotate tokens.supply-chainnpmci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/go-1-27-3-security-releases/https://vulnpocalypse.dev/advisories/go-1-27-3-security-releases/Mon, 02 Nov 2026 12:00:00 +0000Two Go point releases fix HTTP/2 crash and exhaustion bugs, a toolchain checksum bypass and the eMudhra CA keys. Rebuild with Go 1.27.3 or 1.26.10.exploitedopen-sourceci-cdhttps://vulnpocalypse.dev/advisories/ghostaction-github-workflow-secret-theft/https://vulnpocalypse.dev/advisories/ghostaction-github-workflow-secret-theft/Mon, 02 Nov 2026 12:00:00 +0000Stolen GitHub accounts committed security-audit.yml or github_actions_security.yml to thousands of repos. Search all branches and forks, then rotate.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/teamcity-cve-2026-106218-kotlin-dsl-sandbox-escape/https://vulnpocalypse.dev/advisories/teamcity-cve-2026-106218-kotlin-dsl-sandbox-escape/Mon, 02 Nov 2026 12:00:00 +0000A Kotlin DSL sandbox escape gives code execution on TeamCity servers, and Git submodule URLs could read local repos. Update to TeamCity 2026.2.1.exploitedci-cdenterprisehttps://vulnpocalypse.dev/advisories/openssh-10-6-security-fixes/https://vulnpocalypse.dev/advisories/openssh-10-6-security-fixes/Mon, 02 Nov 2026 12:00:00 +0000OpenSSH 10.6 fixes an sftp path escape, a compression side channel, username injection and six more bugs. Take your distro's OpenSSH update; none are exploited.exploitedopen-sourceci-cdhttps://vulnpocalypse.dev/advisories/subql-common-npm-compromise/https://vulnpocalypse.dev/advisories/subql-common-npm-compromise/Mon, 02 Nov 2026 12:00:00 +0000@subql/common 5.8.3 stole CI, cloud, Vault and Kubernetes secrets on install and on import. Pin 5.8.2, block ci-artifacts.dev, rotate secrets.supply-chainnpmci-cdcloudhttps://vulnpocalypse.dev/advisories/npm-12-install-scripts-off-by-default/https://vulnpocalypse.dev/advisories/npm-12-install-scripts-off-by-default/Mon, 02 Nov 2026 12:00:00 +0000npm 12 skips dependency install scripts and refuses git and URL dependencies unless allowed. Upgrade, run npm approve-scripts and commit the allowlist.supply-chainnpmnodejsci-cdhttps://vulnpocalypse.dev/advisories/hades-pypi-ensmallen-bioinformatics/https://vulnpocalypse.dev/advisories/hades-pypi-ensmallen-bioinformatics/Mon, 02 Nov 2026 12:00:00 +0000Hijacked releases of ensmallen and other graph ML, bioinformatics and AI packages stole CI secrets on import. Kill gh-token-monitor before revoking tokens.supply-chainpypigithub-actionsci-cdai-toolshttps://vulnpocalypse.dev/advisories/microsoft-durabletask-pypi-compromise/https://vulnpocalypse.dev/advisories/microsoft-durabletask-pypi-compromise/Mon, 02 Nov 2026 12:00:00 +0000durabletask 1.4.1, 1.4.2 and 1.4.3 stole cloud, Kubernetes and Vault secrets on import on Linux. Check for pgsql-monitor.service, then rotate and rebuild.supply-chainpypicloudci-cdhttps://vulnpocalypse.dev/advisories/pytorch-lightning-pypi-compromise/https://vulnpocalypse.dev/advisories/pytorch-lightning-pypi-compromise/Mon, 02 Nov 2026 12:00:00 +0000lightning 2.6.2 and 2.6.3 on PyPI stole credentials on import and spread via GitHub and npm. Check installs, rotate secrets, use 2.6.1 or 2.6.4+.supply-chainpypinpmphpai-toolsci-cdhttps://vulnpocalypse.dev/advisories/linux-copy-fail-cve-2026-31431/https://vulnpocalypse.dev/advisories/linux-copy-fail-cve-2026-31431/Mon, 02 Nov 2026 12:00:00 +0000A kernel crypto bug lets any local user overwrite cached setuid binaries and get root, including from containers. Patch the kernel or disable algif_aead.exploitedcloudci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/elementary-data-pypi-ghcr-backdoor/https://vulnpocalypse.dev/advisories/elementary-data-pypi-ghcr-backdoor/Mon, 02 Nov 2026 12:00:00 +0000elementary-data 0.23.3 on PyPI and its GHCR image ran a credential stealer via elementary.pth. Find 0.23.3, move to 0.23.4 or later, and rotate secrets.supply-chainpypigithub-actionsci-cdcloudhttps://vulnpocalypse.dev/advisories/chrome-2026-zero-days/https://vulnpocalypse.dev/advisories/chrome-2026-zero-days/Mon, 02 Nov 2026 12:00:00 +0000Google patched seven Chrome bugs exploited in the wild from February to September 2026. Update Chrome and any bundled Chromium to 153.0.8010.36 or later.exploitedendpointci-cdhttps://vulnpocalypse.dev/advisories/doorway-botnet-cloudsek-reports-router-camera-and-jenkins-compromises/https://vulnpocalypse.dev/advisories/doorway-botnet-cloudsek-reports-router-camera-and-jenkins-compromises/Wed, 28 Oct 2026 12:00:00 +0000CloudSEK reports a Doorway botnet exploiting routers, cameras, Jenkins and Openfire. Remove default credentials and check logs for its indicators.exploitednetwork-edgeendpointenterpriseci-cdhttps://vulnpocalypse.dev/advisories/wiz-reports-gheist-campaign-using-stolen-github-tokens-to-dump-actions-secrets/https://vulnpocalypse.dev/advisories/wiz-reports-gheist-campaign-using-stolen-github-tokens-to-dump-actions-secrets/Sun, 25 Oct 2026 12:00:00 +0000Wiz reports a campaign planting secret-dumping sync-check workflows via stolen GitHub tokens, hunt for ci-sync branches and rotate exposed secrets.ecosystemgithub-actionsci-cdcloudhttps://vulnpocalypse.dev/advisories/jfrog-artifactory-cve-2026-42016-exploited/https://vulnpocalypse.dev/advisories/jfrog-artifactory-cve-2026-42016-exploited/Thu, 17 Sep 2026 12:00:00 +0000Three JFrog Artifactory flaws are exploited in the wild, led by CVE-2026-82329 (CVSS 9.8) forging admin tokens via an empty cluster join key. Patch and rotate.exploitedci-cdenterprise