Vulnerabilities for packages: falcoctl, flux-kustomize-controller, cert-manager, gh, cosign, gitlab-kas, k3s, kubescape, neuvector-sigstore-interface, argo-cd, terraform, gitsign, ksops, keda, sops, flux-image-reflector-controller, nuclei, flux-notification-controller, consul,...
6CVSS
6AI Score
0.0004EPSS
GHSA-8R3F-844C-MC37 vulnerabilities
Vulnerabilities for packages: k3s, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, argo-cd, thanos-operator, gcsfuse, boring-registry, cilium, nuclei, dgraph, tekton-chains, kaf, pulumi, spire-server, doppler-kubernetes-operator, zot, prometheus-adapter, cri-tools, gitness,...
7.5AI Score
CVE-2023-45289 vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.8AI Score
0.0004EPSS
CVE-2023-45288 vulnerabilities
Vulnerabilities for packages: tfsec, wait-for-port, argo-cd, mods, boring-registry, cilium, tekton-chains, wazero, kaf, spire-server, shfmt, gitlab-logger, kube-rbac-proxy, metacontroller, grafana, kubevela, istio-cni, haproxy-ingress, temporal, cluster-api-controller, velero-plugin-for-aws,...
6.8AI Score
0.0004EPSS
CVE-2024-24787 vulnerabilities
Vulnerabilities for packages: tfsec, ghaudit, paranoia, tigera-operator, wait-for-port, hcloud, grafana-operator, helm-push, mods, boring-registry, dgraph, tekton-chains, mage, direnv, rabbitmq-default-user-credential-updater, kaf, src-fingerprint, zot, go-md2man, prometheus-adapter, shfmt,...
6.5AI Score
0.0004EPSS
GHSA-5FQ7-4MXC-535H vulnerabilities
Vulnerabilities for packages: tfsec, ghaudit, paranoia, tigera-operator, wait-for-port, hcloud, grafana-operator, helm-push, mods, boring-registry, dgraph, tekton-chains, mage, direnv, rabbitmq-default-user-credential-updater, kaf, src-fingerprint, zot, go-md2man, prometheus-adapter, shfmt,...
7.5AI Score
CVE-2024-24789 vulnerabilities
Vulnerabilities for packages: tfsec, wait-for-port, mods, boring-registry, cilium, tekton-chains, wazero, kaf, spire-server, shfmt, gitlab-logger, fluent-operator, rook, metacontroller, grafana, kubevela, istio-cni, haproxy-ingress, temporal, cluster-api-controller, velero-plugin-for-aws,...
5.5CVSS
6.1AI Score
0.0004EPSS
GHSA-V6V8-XJ6M-XWQH vulnerabilities
Vulnerabilities for packages: falcoctl, flux-kustomize-controller, cert-manager, gh, cosign, gitlab-kas, k3s, kubescape, neuvector-sigstore-interface, argo-cd, terraform, gitsign, ksops, keda, sops, flux-image-reflector-controller, nuclei, flux-notification-controller, consul,...
7.5AI Score
Vulnerabilities for packages: k3s, argo-cd, thanos-operator, dgraph, kaf, pulumi, zot, prometheus-adapter, gitness, nfs-subdir-external-provisioner, newrelic-infrastructure-agent, prometheus-node-exporter, kpt, prometheus-stackdriver-exporter, gomplate, metacontroller, tctl, thanos, kubevela,...
6.1CVSS
7.3AI Score
0.001EPSS
CVE-2023-48795 vulnerabilities
Vulnerabilities for packages: k3s, tigera-operator, kubeflow-pipelines, nerdctl, helm-push, nri-mssql, argo-cd, boring-registry, dgraph, tekton-chains, kaf, src-fingerprint, pulumi, spire-server, zot, prometheus-adapter, gitness, nfs-subdir-external-provisioner, prometheus-node-exporter, falco,...
5.9CVSS
7.1AI Score
0.963EPSS
CVE-2024-24557 vulnerabilities
Vulnerabilities for packages: falcoctl, k3s, cert-manager, timoni, cosign, kubescape, nerdctl, istio-pilot-discovery, gitsign, flux-image-reflector-controller, kubeflow-katib, tekton-chains, scorecard, tekton-pipelines, ctop, up, pulumi, buildkitd, crane, zot, cri-tools, telegraf,...
7.8CVSS
7.5AI Score
0.001EPSS
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: k3s, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, argo-cd, thanos-operator, gcsfuse, boring-registry, cilium, nuclei, dgraph, tekton-chains, kaf, pulumi, spire-server, doppler-kubernetes-operator, zot, prometheus-adapter, cri-tools, gitness,...
6.6AI Score
0.0004EPSS
CVE-2024-24784 vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.8AI Score
0.0004EPSS
GHSA-RR6R-CFGF-GC6H vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.5AI Score
CVE-2024-35255 vulnerabilities
Vulnerabilities for packages: falcoctl, flux-kustomize-controller, cert-manager, cosign, kubescape, restic, secrets-store-csi-driver-provider-azure, teleport, sqlpad, ksops, step, keda, sops, flux-image-reflector-controller, nuclei, boring-registry, chezmoi, tekton-chains, grafana-mimir,...
5.5CVSS
6AI Score
0.0004EPSS
GHSA-M5VV-6R4H-3VJ9 vulnerabilities
Vulnerabilities for packages: falcoctl, flux-kustomize-controller, cert-manager, cosign, kubescape, restic, secrets-store-csi-driver-provider-azure, teleport, sqlpad, ksops, step, keda, sops, flux-image-reflector-controller, nuclei, boring-registry, chezmoi, tekton-chains, grafana-mimir,...
7.5AI Score
GHSA-4V7X-PQXF-CX7M vulnerabilities
Vulnerabilities for packages: tfsec, wait-for-port, argo-cd, mods, boring-registry, cilium, tekton-chains, wazero, kaf, spire-server, shfmt, gitlab-logger, kube-rbac-proxy, metacontroller, grafana, kubevela, istio-cni, haproxy-ingress, temporal, cluster-api-controller, velero-plugin-for-aws,...
7.5AI Score
GHSA-2JWV-JMQ4-4J3R vulnerabilities
Vulnerabilities for packages: tfsec, ghaudit, paranoia, tigera-operator, wait-for-port, hcloud, grafana-operator, helm-push, mods, boring-registry, dgraph, tekton-chains, mage, direnv, rabbitmq-default-user-credential-updater, kaf, src-fingerprint, zot, go-md2man, prometheus-adapter, shfmt,...
7.5AI Score
CVE-2024-24790 vulnerabilities
Vulnerabilities for packages: tfsec, wait-for-port, mods, boring-registry, cilium, tekton-chains, wazero, kaf, spire-server, shfmt, gitlab-logger, fluent-operator, rook, metacontroller, grafana, kubevela, istio-cni, haproxy-ingress, temporal, cluster-api-controller, velero-plugin-for-aws,...
9.8CVSS
9.8AI Score
0.001EPSS
CVE-2023-39325 vulnerabilities
Vulnerabilities for packages: k3s, argo-cd, thanos-operator, dgraph, tekton-chains, kaf, pulumi, zot, prometheus-adapter, gitness, nfs-subdir-external-provisioner, newrelic-infrastructure-agent, prometheus-node-exporter, falco, nats, kpt, prometheus-stackdriver-exporter, gomplate, metacontroller,.....
7.5CVSS
8.4AI Score
0.002EPSS
GHSA-9763-4F94-GFCH vulnerabilities
Vulnerabilities for packages: flux-kustomize-controller, cosign, kubescape, argo-cd, gitsign, kaniko, keda, sops, crossplane, boring-registry, flux-notification-controller, flux-image-automation-controller, melange, tekton-chains, scorecard, actions-runner-controller, pulumi-kubernetes-operator,...
7.5AI Score
GHSA-3Q2C-PVP5-3CQP vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.5AI Score
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.5AI Score
GHSA-J6M3-GC37-6R6Q vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.5AI Score
GHSA-49GW-VXVF-FC2G vulnerabilities
Vulnerabilities for packages: tfsec, wait-for-port, mods, boring-registry, cilium, tekton-chains, wazero, kaf, spire-server, shfmt, gitlab-logger, fluent-operator, rook, metacontroller, grafana, kubevela, istio-cni, haproxy-ingress, temporal, cluster-api-controller, velero-plugin-for-aws,...
7.5AI Score
GHSA-2WRH-6PVC-2JM9 vulnerabilities
Vulnerabilities for packages: k3s, argo-cd, thanos-operator, dgraph, kaf, pulumi, zot, prometheus-adapter, gitness, nfs-subdir-external-provisioner, newrelic-infrastructure-agent, prometheus-node-exporter, kpt, prometheus-stackdriver-exporter, gomplate, metacontroller, tctl, thanos, kubevela,...
7.5AI Score
GHSA-4374-P667-P6C8 vulnerabilities
Vulnerabilities for packages: k3s, argo-cd, thanos-operator, dgraph, tekton-chains, kaf, pulumi, zot, prometheus-adapter, gitness, nfs-subdir-external-provisioner, newrelic-infrastructure-agent, prometheus-node-exporter, falco, nats, kpt, prometheus-stackdriver-exporter, gomplate, metacontroller,.....
7.5AI Score
GHSA-45X7-PX36-X8W8 vulnerabilities
Vulnerabilities for packages: k3s, tigera-operator, kubeflow-pipelines, nerdctl, helm-push, nri-mssql, argo-cd, boring-registry, dgraph, tekton-chains, kaf, src-fingerprint, pulumi, spire-server, zot, prometheus-adapter, gitness, nfs-subdir-external-provisioner, prometheus-node-exporter, falco,...
7.5AI Score
CVE-2024-24783 vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.8AI Score
0.0004EPSS
GHSA-32CH-6X54-Q4H9 vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.5AI Score
CVE-2024-24785 vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
7.8AI Score
0.0004EPSS
CVE-2024-24788 vulnerabilities
Vulnerabilities for packages: tfsec, ghaudit, paranoia, tigera-operator, wait-for-port, hcloud, grafana-operator, helm-push, mods, boring-registry, dgraph, tekton-chains, mage, direnv, rabbitmq-default-user-credential-updater, kaf, src-fingerprint, zot, go-md2man, prometheus-adapter, shfmt,...
6.5AI Score
0.0004EPSS
GHSA-236W-P7WF-5PH8 vulnerabilities
Vulnerabilities for packages: tfsec, wait-for-port, mods, boring-registry, cilium, tekton-chains, wazero, kaf, spire-server, shfmt, gitlab-logger, fluent-operator, rook, metacontroller, grafana, kubevela, istio-cni, haproxy-ingress, temporal, cluster-api-controller, velero-plugin-for-aws,...
7.5AI Score
GHSA-XW73-RW38-6VJC vulnerabilities
Vulnerabilities for packages: falcoctl, k3s, cert-manager, timoni, cosign, kubescape, nerdctl, istio-pilot-discovery, gitsign, flux-image-reflector-controller, kubeflow-katib, tekton-chains, scorecard, tekton-pipelines, ctop, up, pulumi, buildkitd, crane, zot, cri-tools, telegraf,...
7.5AI Score
CVE-2023-45290 vulnerabilities
Vulnerabilities for packages: k3s, bazelisk, paranoia, gh, tigera-operator, kubeflow-pipelines, nerdctl, grafana-operator, helm-push, argo-cd, flannel-cni-plugin, nri-mssql, thanos-operator, wait-for-port, esbuild, gcsfuse, nuclei, dgraph, wazero, mage, direnv, nri-haproxy, nri-nginx, kaf,...
6AI Score
0.0004EPSS
Summary Multiple vulnerabilities in Open Container Initiative runc used by IBM InfoSphere Information Server were addressed. Vulnerability Details ** CVEID: CVE-2024-21626 DESCRIPTION: **Open Container Initiative runc could allow a remote attacker to bypass security restrictions, caused by an...
8.6CVSS
7.8AI Score
0.051EPSS
Exploit for Improper Input Validation in Google Android
Exploit for CVE-2022-20186 The write up can be found...
7.8CVSS
8AI Score
0.0004EPSS
Exploit for Improper Input Validation in Google Android
Exploit for CVE-2022-20186 The write up can be found...
7.8CVSS
8AI Score
0.0004EPSS
3 More Plugins Infected in WordPress.org Supply Chain Attack Due to Compromised Developer Passwords
Update #1: As of 12:36PM EST, another plugin has been infected. We've updated the list below to include this fourth plugin and the plugins team has been notified. Update #2: As of 2:20 PM EST, two more plugins appear to have malicious commits, however, the releases have not officially been made...
7.1AI Score
Summary A vulnerability in the github.com/containerd/containerd-v1.6.17 package has been addressed. Vulnerability Details ** CVEID: CVE-2023-25173 DESCRIPTION: **containerd could allow a local authenticated attacker to bypass security restrictions, caused by improper setup for supplementary...
7.8CVSS
7AI Score
0.001EPSS
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before...
0.0004EPSS
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before...
6.5AI Score
0.0004EPSS
CVE-2024-5737 HTML Injection in AdmirorFrames Joomla! Extension
Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default (text/html) is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before...
0.0004EPSS
New SnailLoad Attack Exploits Network Latency to Spy on Users' Web Activities
A group of security researchers from the Graz University of Technology have demonstrated a new side-channel attack known as SnailLoad that could be used to remotely infer a user's web activity. "SnailLoad exploits a bottleneck present on all Internet connections," the researchers said in a study...
7.4AI Score
The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...
6.4CVSS
0.001EPSS
The Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the Social Count (Static) widget in all versions up to,.....
6.4CVSS
0.001EPSS
The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...
6.4CVSS
5.8AI Score
0.001EPSS
The Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the Social Count (Static) widget in all versions up to,.....
6.4CVSS
5.7AI Score
0.001EPSS
The Ultimate Post Kit Addons For Elementor – (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the Social Count (Static) widget in all versions up to,.....
6.4CVSS
0.001EPSS
The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...
6.4CVSS
0.001EPSS