Skip to content

Actions: OpenIdentityPlatform/OpenAM

Actions

CodeQL

Actions

Loading...
Loading

Show workflow options

Create status badge

Loading
codeql.yml
70 workflow runs
70 workflow runs

Filter by Event

⌥ + click/return to exclude

Filter by Status

⌥ + click/return to exclude

Filter by Branch

⌥ + click/return to exclude

Filter by Actor

⌥ + click/return to exclude
Bump fast-uri from 3.1.4 to 3.1.5 in /openam-ui/openam-ui-js-sdk CodeQL #70: Pull request #1096 opened by dependabot Bot
1h 1m 44s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/fast-uri-3.1.5
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/fast-uri-3.1.5
1h 1m 44s
CVE-2026-69185 CVE-2026-33151 Socket.IO: Zero-attachment Memory Exhau… CodeQL #69: Commit 293a589 pushed by vharseko
2h 40m 43s master
master
2h 40m 43s
Harden AuthXMLRequest.setPrincipal against arbitrary class instantiat… CodeQL #68: Commit 0594405 pushed by vharseko
54m 24s master
master
54m 24s
[#1080] OAuth2 consent: accept the resource owner's session id as the… CodeQL #67: Commit 7c3aa34 pushed by vharseko
30s master
master
30s
Harden AuthXMLRequest.setPrincipal against arbitrary class instantiation (same pattern as GHSA-wg5r-wc3x-39vc) CodeQL #66: Pull request #1088 synchronize by BarakSrour
1h 59m 48s BarakSrour:harden/authxmlrequest-setprincipal-reflection
BarakSrour:harden/authxmlrequest-setprincipal-reflection
1h 59m 48s
CVE-2026-69185 CVE-2026-33151 Socket.IO: Zero-attachment Memory Exhaustion + unbounded number of binary attachments CodeQL #65: Pull request #1095 opened by dependabot Bot
2h 25m 44s dependabot/npm_and_yarn/openam-ui/openam-ui-ria/socket.io-parser-4.2.7
dependabot/npm_and_yarn/openam-ui/openam-ui-ria/socket.io-parser-4.2.7
2h 25m 44s
CodeQL CodeQL #64: Scheduled
18m 16s master
master
18m 16s
Harden AuthXMLRequest.setPrincipal against arbitrary class instantiation (same pattern as GHSA-wg5r-wc3x-39vc) CodeQL #63: Pull request #1088 opened by BarakSrour
1h 5m 50s BarakSrour:harden/authxmlrequest-setprincipal-reflection
BarakSrour:harden/authxmlrequest-setprincipal-reflection
1h 5m 50s
[#1082] Fix docs contradicting each other on XUI + HttpOnly session c… CodeQL #62: Commit b4c030a pushed by maximthomas
1h 22m 11s master
master
1h 22m 11s
GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Au… CodeQL #61: Commit ba4af5d pushed by vharseko
19m 9s master
master
19m 9s
GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action … CodeQL #60: Commit a6f70a8 pushed by vharseko
39s master
master
39s
GHSA-qwww-vcr4-c8h2 React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response CodeQL #59: Pull request #1087 opened by dependabot Bot
49m 42s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/react-router-8.3.0
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/react-router-8.3.0
49m 42s
GHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure CodeQL #58: Pull request #1086 opened by dependabot Bot
1h 13m 40s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/postcss-8.5.23
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/postcss-8.5.23
1h 13m 40s
CVE-2026-59949 at.yawk.lz4:lz4-java: Native XXHash implementations ca… CodeQL #57: Commit 20fbed2 pushed by vharseko
50m 43s master
master
50m 43s
CVE-2026-59949 at.yawk.lz4:lz4-java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges CodeQL #56: Pull request #1085 opened by dependabot Bot
14m 31s dependabot/maven/openam-cassandra/at.yawk.lz4-lz4-java-1.11.1
dependabot/maven/openam-cassandra/at.yawk.lz4-lz4-java-1.11.1
14m 31s
[#1082] Fix docs contradicting each other on XUI + HttpOnly session cookies CodeQL #55: Pull request #1084 opened by maximthomas
1h 0m 36s maximthomas:issues/1082-docs-contradict
maximthomas:issues/1082-docs-contradict
1h 0m 36s
[#1080] OAuth2 consent: accept the resource owner's session id as the csrf value CodeQL #54: Pull request #1083 opened by maximthomas
1h 42m 8s maximthomas:issues/1080-csrf-session
maximthomas:issues/1080-csrf-session
1h 42m 8s
[#1080] OAuth2 consent: serve the consent details as JSON CodeQL #53: Pull request #1081 opened by maximthomas
14m 21s maximthomas:issues/1080-oauth2-json-consent
maximthomas:issues/1080-oauth2-json-consent
14m 21s
CodeQL CodeQL #52: Scheduled
18m 32s master
master
18m 32s
CVE-2026-53666 CVE-2026-53669 React Router: Arbitrary Constructor Inj… CodeQL #51: Commit 32f2b95 pushed by vharseko
19m 10s master
master
19m 10s
CVE-2026-59887 linkify-it: Quadratic-complexity DoS via the mailto:… CodeQL #50: Commit 6ec59a2 pushed by vharseko
21s master
master
21s
CVE-2026-13676 CVE-2026-16221 fast-uri vulnerable to host confusion v… CodeQL #49: Commit 628c73b pushed by vharseko
28s master
master
28s
CVE-2026-53666 CVE-2026-53669 React Router: Arbitrary Constructor Injection via deserializeErrors() Open redirect via backslash in <Link> and useNavigate CodeQL #48: Pull request #1079 opened by dependabot Bot
1h 9m 46s dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/react-router-7.18.0
dependabot/npm_and_yarn/openam-ui/openam-ui-js-sdk/react-router-7.18.0
1h 9m 46s
CVE-2026-59887 linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text CodeQL #47: Pull request #1078 opened by dependabot Bot
27m 1s dependabot/npm_and_yarn/openam-ui/openam-ui-ria/linkify-it-5.0.2
dependabot/npm_and_yarn/openam-ui/openam-ui-ria/linkify-it-5.0.2
27m 1s
CVE-2026-13676 CVE-2026-16221 fast-uri vulnerable to host confusion via literal backslash authority delimiter CodeQL #46: Pull request #1077 opened by dependabot Bot
42m 13s dependabot/npm_and_yarn/openam-ui/openam-ui-ria/fast-uri-3.1.4
dependabot/npm_and_yarn/openam-ui/openam-ui-ria/fast-uri-3.1.4
42m 13s