773 PoCs | 119 CISA KEV

tag

Ci-Cd

TeamCity — Unauthenticated RCE via Agent Polling Deserialization (CVE-2026-63077) KEV EPSS 88%

CVE-2026-63077 web Patched

CVE-2026-63077webCRITICAL 9.8Patched2026-08-09tj-actions/branch-names GitHub Actions Command Injection (CVE-2025-54416)

CVE-2025-54416 cloud Patched

CVE-2025-54416cloudCRITICAL 9.1Patched2026-07-06Supply Chain Command Injection in AWS CDK's NodejsFunction — CVE-2026-11417

CVE-2026-11417 cloud Patched

CVE-2026-11417cloudHIGH 3.1Patched2026-07-05Sherlock CI `pull_request_target` Command Injection → GitHub Actions Secret Exfiltration (CVE-2026-44590)

CVE-2026-44590 cloud Patched

CVE-2026-44590cloudCRITICAL 9.3Patched2026-07-05psf/black GitHub Action RCE via Insecure Regex Version Validation — CVE-2026-31900

CVE-2026-31900 (GHSA-v53h-f6m7-xcgm) misc Patched

CVE-2026-31900miscHIGH 8.7Patched2026-07-05HashiCorp go-getter Git Pathspec Arbitrary File Read (CVE-2026-4660)

CVE-2026-4660 / HCSEC-2026-04 cloud Patched

CVE-2026-4660 / HCSEC-2026-04cloudHIGH 7.5Patched2026-07-05Gitea act_runner container.options Host Namespace Escape

None assigned as of 2026-07-03 cloud Unverified

None assigned as of 2026-07-03cloudHIGHUnverified2026-07-03