https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:24:24.975237+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349304 EUVD-2026-349304 2026-10-03T04:24:24.980650+00:00 EUVD-2026-349304 https://cve.radiocsirt.org/vuln/fkie_cve-2026-64653 fkie_cve-2026-64653 2026-10-03T04:24:24.980680+00:00

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-64653 msrc_CVE-2026-64653 — GitHub CLI: Unescaped variable components in request URLs could allow path traversal 2026-10-03T04:24:24.980711+00:00 msrc_CVE-2026-64653 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11530-1 openSUSE-SU-2026:11530-1 — gh-2.97.0-1.1 on GA media 2026-10-03T04:24:24.980728+00:00

gh-2.97.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-64653 UBUNTU-CVE-2026-64653 2026-10-03T04:24:24.980745+00:00

Affected: Ubuntu:22.04:LTS: gh, Ubuntu:Pro:24.04:LTS: gh, Ubuntu:Pro:26.04:LTS: gh

GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.97.0, some HTTP request URLs interpolate variable path components without percent encoding, allowing URL path metacharacters in attacker-controlled repository or resource values to make gh address a different API endpoint or resource than the user intended. This issue is fixed in version 2.97.0.