GitHub vulnerabilities are hard to triage and patch

12 posts from 11 people12d activeFading, +0 this week

Posts per day12 posts, Sep 2 to Nov 9

The posts behind it

GitHub issuesmicrosoft/vscode · jwikmanNov 2

False positive: "agent tool must be included in tools" warning when agent/runSubagent is listed instead of the toolset alias

Does this issue occur when all extensions are disabled?: Yes (reproduces in core - `promptValidator.ts` is part of the workbench, not an extension) - VS Code Version: 1.144.0 (Commit 2c33b50b16c472efe58357d1d2a8a5414bc23fbf) - OS Version: Windows_NT x64 10.0.26200 Steps to...

1 reactions

GitHub issuescrewAIInc/crewAI · rezerpaul-cryptoNov 1

Question: opt-in LLMSafe Python compatibility pilot for CrewAI tools and Flows

Hi CrewAI OSS maintainers, I'm Paul, maintainer of [LLMSafe](https://github.com/rezerpaul-crypto/llmsafe), an early-stage open-source Python static scanner for model/user-data trust boundaries. I'm proposing an **optional, free compatibility pilot**, not reporting a...

GitHub issuesmodelcontextprotocol/servers · cliffhallOct 25

Clear the four CodeQL alerts in the release scripts (replaceAll for %2F, comment-line check)

## Problem Four CodeQL alerts are open on `main`, all in release tooling. None is exploitable, but they keep the code-scanning page non-empty, and a dismissed pattern is flagged again wherever it is copied. | Alert | Rule | Location (`v2/main`) | Flagged | Why it is not a...

GitHub issuesprowler-cloud/prowler · Varshith-KaliOct 20

apiserver_auth_mode_include_node / apiserver_auth_mode_include_rbac FAIL every kube-apiserver using --authorization-config (false positive)

### Issue search - [x] I have searched the existing issues and this bug has not been reported yet ### Which component is affected? Prowler CLI/SDK ### Cloud Provider (if applicable) Kubernetes ### Steps to Reproduce 1. Run Prowler against a cluster whose kube-apiserver...

1 replies

GitHub issuesprowler-cloud/prowler · gallis-botOct 19

apiserver_auth_mode_not_always_allow FAILs every Talos kube-apiserver (false positive): check ignores --authorization-config

...nor `--authorization-config`, kube-apiserver does default to AlwaysAllow, and FAILing that remains correct. ### Actual Result FAIL-critical on every kube-apiserver pod of the cluster; the finding is unactionable and must be muted. ### Nuance I'll be upfront about one limitation...

1 replies

GitHub issuesgrafana/grafana · tpcdraperOct 13

Upgrade github.com/grafana/tempo to prevent S3 SSE-C Encryption Key Exposure (CVE-2026-28377)

**Why is this needed**: We are deploying Grafana Enterprise as part of our observability suite within a secured DoW cloud hosting environment. To maintain our Authority to Operate (ATO), we have active Plan of Action and Milestones (POA&Ms) in place to address open security...

GitHub issuesmodelcontextprotocol/servers · cliffhallOct 7

Create a GitHub App for board writes, and board sweep-filed issues from the workflows

## Problem The issue-filing sweeps added by #4874 (`dependency-refresh`, `dependabot-alerts`, `sdk-watch`) file labeled, milestoned issues but **cannot put them on the Servers V2 board (#43)**. Board #43 is an **org** project, so writing a card needs `organization projects:...

Glyph IbisAdvisories (advisories.fru.dev)Sep 25

Ontology comments can break out of generated JSDoc and inject executable TypeScript | pkg:github/google/schema-dts@2.0.0

google: Ontology comments can break out of generated JSDoc and inject executable TypeScript | pkg:github/google/schema-dts@2.0.0

Glyph IbisAdvisories (advisories.fru.dev)Sep 23

gh-aw: HTTPS egress allowlist bypass via TLS SNI domain fronting

github: gh-aw: HTTPS egress allowlist bypass via TLS SNI domain fronting

GitHub issuesmodelcontextprotocol/servers · gautamkishoreSep 19

OpenTrustBench security assessment for servers

Badge for your README if you want it: [![OpenTrustBench](https://www.opentrustbench.com/r/modelcontextprotocol-servers.svg)](https://www.opentrustbench.com/r/modelcontextprotocol-servers.html) Registry re-scans weekly, happy to re-run on request. If any finding looks wrong I...

Hacker NewsHacker News comments · aray07Sep 14

...recordings. False negatives are harder. Opslane reviews session recordings to spot frustration. They look for rage clicks, dead clicks, and abandoned forms. Here is a link to the repo: https://github.com/opslane/opslane

GitHub issuesvercel/next.js · StanzillaSep 2

Pages Router: `prefetch()` checks the client router filter against `as` but stores the `__appRouter` marker under the `href` pathname

...so on a large pages-router site with many `href !== as` links this shows up as sporadic, hard to reproduce crashes tied to specific ids. ### Provide environment information Also reproduced with `next@16.3.3` and `next@16.3.4`. The relevant code is unchanged on `canary`...

2 reactions

Companies and products named

GitHub

12 posts

Model Context Protocol

3 posts

Kubernetes

2 posts

Vercel

1 post

Grafana

1 post

npm

1 post

About this problem

Evidence

12 posts from 11 people in 8 places, about 1 a week over 62 days. Mostly on modelcontextprotocol/servers, Advisories (advisories.fru.dev), prowler-cloud/prowler. Tools named alongside: Model Context Protocol, Kubernetes, Vercel, Grafana.

Frustration Frustration 1 of 3· Seen on GitHub issues, Glyph Ibis, Hacker News

How it was grouped

Posts that state a pain and match the "vuln-noise" rule about GitHub. First post Sep 2, 2026, latest Nov 2, 2026. Corroborated: 3 or more posts from 2 or more people or places. Method

The same problem elsewhere

Momentum went from steady to fading.

Nov 9, 2026

Momentum went from fading to steady.

Nov 7, 2026

Momentum went from steady to fading.

Nov 1, 2026

Momentum went from fading to steady.

Oct 22, 2026

Momentum went from steady to fading.

Oct 20, 2026

Momentum went from fading to steady.

Oct 17, 2026

Momentum went from steady to fading.

Oct 14, 2026

Momentum went from fading to steady.

Oct 9, 2026

Momentum went from steady to fading.

Oct 2, 2026

First seen with 3 posts.

Sep 25, 2026