Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

Actual Sync Server CORS Proxy GitHub API Allowlist Bypass

Actual Sync Server's CORS proxy uses an improper prefix check that allows authenticated users to access private GitHub repositories beyond the allowlisted plugin repositories when a GitHub token is configured. An attacker can bypass the allowlist by requesting API paths for repositories with names that start with an allowlisted repository name.

Disclosed 7 October 2026 · Record updated 7 October 2026

Impact

Authenticated users can read private GitHub resources including environment variables, secrets, and release information from repositories not in the allowlist by exploiting the prefix-based allowlist check.

Our coverage

Sources

  1. github.comhttps://github.com/advisories/GHSA-m62c-5q34-f3cf