Yesterday, 12:30 PM
Low
resolved
resolved
GitHub Retired UsernameTakeover From [aws/████████]
Bug reported by Shad0w was disclosed at August 3, 2026, 6:17 pm | Inclusion of Functionality from Untrusted Control Sphere
A retired GitHub username was discovered to be unclaimed, allowing an attacker to register the username and create a repository with the same name as the original. As a result, the original link to the repository now points to the attacker-controlled repository, enabling a persistent repository hijack.
High
resolved
resolved
Unauthenticated Path Traversal (LFI) via /custom-sounds/ when CustomSounds uses FileSystem storage
Bug reported by s was disclosed at August 3, 2026, 1:35 pm | Path Traversal