THE EVIDENCE DESK

Source intelligence

425 collected source records. Original advisories and security research.

300 matching sources · Newest published first

Original publisher records, awaiting Egret editorial review. Headlines open the original source; CVE identifiers open the tracker.

Scroll across the table to see all columns.

Monitored security sources, ordered by original publication date, newest first
Published	Finding / research	Publisher	Identifiers
Nov 09, 2026	Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines GHSA: GHSA-ghgh-57qv-h687 CVE: CVE-2026-88984 Reported severity: high Advisory package entry 1: Affected package: github.com/kubeflow/pipelines (go) Affected versions: < 0.0.0-20260420170029-186dd1f3b040 Patched version:…	GitHub Advisory Database	CVE-2026-77596 CVE-2026-88984GHSA-GHGH-57QV-H687GHSA-RJR3-43J3-4Q8G
Nov 09, 2026	Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation GHSA: GHSA-f7vj-6669-qvv4 CVE: CVE-2026-88983 Reported severity: medium Advisory package entry 1: Affected package: github.com/kubeflow/pipelines (go) Affected versions: < 0.0.0-20260517162502-504d7797c1e0 Patched versio…	GitHub Advisory Database	CVE-2023-6570 CVE-2026-88983GHSA-895M-3HXM-H4MGGHSA-F7VJ-6669-QVV4
Nov 09, 2026	Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user) GHSA: GHSA-2xwh-426q-42c5 CVE: CVE-2026-88982 Reported severity: medium Advisory package entry 1: Affected package: github.com/kubeflow/pipelines (go) Affected versions: < 0.0.0-20260910172610-620d0cc89ae0 Patched versio…	GitHub Advisory Database	CVE-2026-88982GHSA-2XWH-426Q-42C5
Nov 09, 2026	Claude Code: TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace GHSA: GHSA-5xjx-9qx6-jcrv CVE: CVE-2026-88968 Reported severity: high Advisory package entry 1: Affected package: @anthropic-ai/claude-code (npm) Affected versions: < 2.1.251 Patched version: 2.1.251 Advisory description…	GitHub Advisory Database	CVE-2026-88968GHSA-5XJX-9QX6-JCRV
Nov 09, 2026	croc: Overwrite-confirmation bypass via a crafted "croc-stdin-" filename on receive GHSA: GHSA-x89h-7h96-v88f CVE: CVE-2026-119298 Reported severity: medium Advisory package entry 1: Affected package: github.com/schollz/croc/v11 (go) Affected versions: < 11.5.2 Patched version: 11.5.2 Advisory package e…	GitHub Advisory Database	CVE-2023-43619 CVE-2026-119298GHSA-PPJH-XP5V-46WCGHSA-X89H-7H96-V88F
Nov 09, 2026	DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885 GHSA: GHSA-9hq4-hm3j-jmph CVE: CVE-2026-108262 Reported severity: high Advisory package entry 1: Affected package: github.com/ddev/ddev (go) Affected versions: < 1.25.4 Patched version: 1.25.4 Advisory description: Summa…	GitHub Advisory Database	CVE-2026-108262 CVE-2026-32885GHSA-9HQ4-HM3J-JMPH
Nov 09, 2026	Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser GHSA: GHSA-h89v-g948-47vp CVE: CVE-2026-97705 Reported severity: high Advisory package entry 1: Affected package: moleculer (npm) Affected versions: >= 0.15.0-beta1, < 0.15.2 Patched version: 0.15.2 Advisory package entr…	GitHub Advisory Database	CVE-2026-97705GHSA-H89V-G948-47VP
Nov 09, 2026	Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin GHSA: GHSA-9qq5-422f-33c2 CVE: CVE-2026-85737 Reported severity: medium Advisory package entry 1: Affected package: www.velocidex.com/golang/velociraptor (go) Affected versions: <= 0.77.1 Patched version: 0.77.2 Advisory…	GitHub Advisory Database	CVE-2026-85737GHSA-9QQ5-422F-33C2
Nov 09, 2026	Kubeflow Pipelines API server lacks authorization for shared pipeline uploads GHSA: GHSA-rjr3-43j3-4q8g CVE: CVE-2026-77596 Reported severity: critical Advisory package entry 1: Affected package: github.com/kubeflow/pipelines (go) Affected versions: < 0.0.0-20260909234119-62516d8c525f Patched vers…	GitHub Advisory Database	CVE-2023-6570 CVE-2023-6571 CVE-2026-77596GHSA-87Q5-J5JH-FHP8
Nov 09, 2026	FileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files GHSA: GHSA-44r8-3p76-84mw CVE: CVE-2026-94619 Reported severity: medium Advisory package entry 1: Affected package: filegator/filegator (composer) Affected versions: <= 7.14.4 Patched version: 7.15.0 Advisory description…	GitHub Advisory Database	CVE-2026-94619GHSA-44R8-3P76-84MWGHSA-F74M-X83R-C4V4
Nov 09, 2026	FileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive GHSA: GHSA-f74m-x83r-c4v4 CVE: CVE-2026-94618 Reported severity: medium Advisory package entry 1: Affected package: filegator/filegator (composer) Affected versions: <= 7.14.4 Patched version: 7.15.0 Advisory description…	GitHub Advisory Database	CVE-2026-94618GHSA-F74M-X83R-C4V4
Nov 09, 2026	Code Graph RAG structural tools follow out-of-root symlinks GHSA: GHSA-85gg-2gfq-q95m CVE: CVE-2026-87008 Reported severity: high Advisory package entry 1: Affected package: code-graph-rag (pip) Affected versions: <= 0.0.586 Patched version: 0.0.587 Advisory description: A remote…	GitHub Advisory Database	CVE-2026-87008GHSA-85GG-2GFQ-Q95MGHSA-VVR2-H2JP-838M
Nov 09, 2026	GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin GHSA: GHSA-gj9m-f8ph-pmhr CVE: CVE-2026-102895 Reported severity: critical Advisory package entry 1: Affected package: gpustack (pip) Affected versions: < 2.2.0 Patched version: 2.2.0 Advisory description: Impact In GPUS…	GitHub Advisory Database	CVE-2026-102895GHSA-GJ9M-F8PH-PMHR
Nov 09, 2026	Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing GHSA: GHSA-rm8c-2cv8-jwf6 CVE: CVE-2026-115770 Reported severity: critical Advisory package entry 1: Affected package: github.com/pocket-id/pocket-id/backend (go) Affected versions: < 0.0.0-20260727180059-43aaccd5bfac Pa…	GitHub Advisory Database	CVE-2026-115770GHSA-RM8C-2CV8-JWF6
Nov 09, 2026	Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS) GHSA: GHSA-cp25-j9x5-p5xm CVE: CVE-2026-103022 Reported severity: medium Advisory package entry 1: Affected package: urwid (pip) Affected versions: <= 4.0.6 Patched version: 4.0.7 Advisory description: Summary The handle…	GitHub Advisory Database	CVE-2026-103022GHSA-CP25-J9X5-P5XM
Nov 09, 2026	esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal GHSA: GHSA-g3c2-rjq2-c763 CVE: CVE-2026-102657 Reported severity: high Advisory package entry 1: Affected package: github.com/esm-dev/esm.sh/web (go) Affected versions: < 0.2.0 Patched version: 0.2.0 Advisory description…	GitHub Advisory Database	CVE-2026-102657GHSA-G3C2-RJQ2-C763
Nov 09, 2026	fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution GHSA: GHSA-9vhv-g5hf-m7m7 CVE: CVE-2026-102610 Reported severity: medium Advisory package entry 1: Affected package: fast-agent-mcp (pip) Affected versions: <= 0.7.20 Patched version: 0.7.21 Advisory description: Summary…	GitHub Advisory Database	CVE-2026-102610GHSA-9VHV-G5HF-M7M7
Nov 09, 2026	Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets GHSA: GHSA-j8j4-rw65-56r6 CVE: CVE-2026-102340 Reported severity: high Advisory package entry 1: Affected package: github.com/telepresenceio/telepresence (go) Affected versions: < 2.31.0 Patched version: 2.31.0 Advisory …	GitHub Advisory Database	CVE-2026-102340GHSA-J8J4-RW65-56R6
Nov 09, 2026	Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable GHSA: GHSA-6j3h-rp73-6rvf CVE: CVE-2026-102339 Reported severity: high Advisory package entry 1: Affected package: github.com/telepresenceio/telepresence/v2 (go) Affected versions: < 2.31.0 Patched version: 2.31.0 Adviso…	GitHub Advisory Database	CVE-2026-102339GHSA-6J3H-RP73-6RVF
Nov 09, 2026	zizmor: Debug logging prints available GitHub credentials in cleartext GHSA: GHSA-f42p-wjw5-97qh CVE: CVE-2026-102289 Reported severity: high Advisory package entry 1: Affected package: zizmor (pip) Affected versions: = 1.27.0 Patched version: 1.28.0 Advisory description: Summary zizmor 1.2…	GitHub Advisory Database	CVE-2026-102289GHSA-F42P-WJW5-97QH
Nov 09, 2026	ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header GHSA: GHSA-wchh-mrv2-5h4q CVE: CVE-2026-86041 Reported severity: medium Advisory package entry 1: Affected package: github.com/mayswind/ezbookkeeping (go) Affected versions: >= 0.10.0, < 1.6.0 Patched version: 1.6.0 Advi…	GitHub Advisory Database	CVE-2026-86041GHSA-WCHH-MRV2-5H4Q
Nov 09, 2026	OmniAuth: Host Header Injection Vulnerability GHSA: GHSA-m27g-v28p-f9fx CVE: CVE-2026-63183 Reported severity: medium Advisory package entry 1: Affected package: omniauth (rubygems) Affected versions: < 2.2.0 Patched version: 2.2.0 Advisory description: Impact Host …	GitHub Advisory Database	CVE-2026-63183GHSA-M27G-V28P-F9FX
Nov 09, 2026	Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization GHSA: GHSA-rr8v-fxxf-c986 CVE: CVE-2026-75598 Reported severity: high Advisory package entry 1: Affected package: com.gradleup.shadow:com.gradleup.shadow.gradle.plugin (maven) Affected versions: < 9.6.0 Patched version: …	GitHub Advisory Database	CVE-2026-75598GHSA-RR8V-FXXF-C986
Nov 09, 2026	Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read GHSA: GHSA-vvr2-h2jp-838m CVE: CVE-2026-77604 Reported severity: high Advisory package entry 1: Affected package: code-graph-rag (pip) Affected versions: < 0.0.345 Patched version: 0.0.345 Advisory description: Summary T…	GitHub Advisory Database	CVE-2026-77604GHSA-VVR2-H2JP-838M