https://db.gcve.eu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 06 May 2026 19:02:27 +0000 https://db.gcve.eu/sighting/3e8153b2-d908-46ba-8589-ed5a509fe0ff/export {"uuid": "3e8153b2-d908-46ba-8589-ed5a509fe0ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-FGW4-V983-MGP8", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/6263", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-25204\n\ud83d\udd25 CVSS Score: 6.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N)\n\ud83d\udd39 Description: `gh` is GitHub\u2019s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.\n\ud83d\udccf Published: 2025-02-14T16:38:29.038Z\n\ud83d\udccf Modified: 2025-03-03T19:13:28.888Z\n\ud83d\udd17 References:\n1. https://github.com/cli/cli/security/advisories/GHSA-fgw4-v983-mgp8\n2. https://github.com/cli/cli/issues/10418\n3. https://github.com/cli/cli/pull/10421", "creation_timestamp": "2025-03-03T19:30:58.000000Z"} {"uuid": "3e8153b2-d908-46ba-8589-ed5a509fe0ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "GHSA-FGW4-V983-MGP8", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/6263", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-25204\n\ud83d\udd25 CVSS Score: 6.3 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N)\n\ud83d\udd39 Description: `gh` is GitHub\u2019s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool `gh attestation verify` causes it to return a zero exit status when no attestations are present. This behavior is incorrect: When no attestations are present, `gh attestation verify` should return a non-zero exit status code, thereby signaling verification failure. An attacker can abuse this flaw to, for example, deploy malicious artifacts in any system that uses `gh attestation verify`'s exit codes to gatekeep deployments. Users are advised to update `gh` to patched version `v2.67.0` as soon as possible.\n\ud83d\udccf Published: 2025-02-14T16:38:29.038Z\n\ud83d\udccf Modified: 2025-03-03T19:13:28.888Z\n\ud83d\udd17 References:\n1. https://github.com/cli/cli/security/advisories/GHSA-fgw4-v983-mgp8\n2. https://github.com/cli/cli/issues/10418\n3. https://github.com/cli/cli/pull/10421", "creation_timestamp": "2025-03-03T19:30:58.000000Z"} https://db.gcve.eu/sighting/3e8153b2-d908-46ba-8589-ed5a509fe0ff/export Mon, 03 Mar 2025 19:30:58 +0000