The pull_request_target event is one of the most commonly misused triggers in GitHub Actions, leading to vulnerabilities in workflows. Workflows triggered by pull_request_target run with the base repo...

Versions >= v6.38.0 and < v8.4.2 of the website flavor of Signal for Android (distributed at https://signal.org/android/apk) allows another installed app without any permissions to exfiltrate decrypte...