GO-2026-5668 vulnerabilities

Vulnerabilities for packages: envoy-gateway, undock, grafana-alloy, portieris, trivy-operator, buildah, docker-credential-gcr, grafana, rancher-agent, nuclei, podman, aws-otel-collector, skopeo, cri-tools, ko, zot, osv-scanner, nerdctl, datadog-agent, kpt, spire-server, trivy, rancher, kots,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: terragrunt, step-ca, flux-image-reflector-controller, chezmoi, tkn, ksops, cosign, sqlpad, harbor-registry, argo-events, sigstore-scaffolding, grafana-agent-operator, kubescape, velero, flux, nuclei, prometheus-operator, grafana-mimir, flyte, rook, buildkitd, cortex,...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, undock, podman, kyverno, kots, ratify, zarf, flux-source-controller, skopeo, aactl, falcoctl, buildah, gitsign, slsa-verifier, tekton-chains, witness, kubescape, falco-no-driver...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: apko, melange, skaffold, policy-controller, flux-source-controller, tkn, aactl, cosign, slsa-verifier, tekton-chains, ko, kubescape, spire-server...

GO-2026-5336 vulnerabilities

Vulnerabilities for packages: melange, gitaly, pulumi-language-yaml, tfsec, steampipe, grafana-alloy, trivy-operator, act, argo-events, argocd-image-updater, grype, witness, kubescape, scorecard, nfpm, flux, nuclei, gptscript, src-fingerprint, kyverno, flux-image-automation-controller, wolfictl,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, dex, tkn, cosign, slsa-verifier, kubescape, flux-kustomize-controller, vexctl, aactl, rekor, gitsign, cloudflared, tekton-chains, spire-server, kots, sops, flux-source-controller, fulcio, argo-workflows, terragrunt...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, mattermost, terraform-provider-acme, chezmoi, tkn, argo-events, argocd-image-updater, crossplane-provider-keycloak, witness, rancher-agent, atlantis, kubernetes, terraform-provider-azapi, crossplane-provider-aws-kinesis, hcloud,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: tkn, cosign, trivy-operator, sigstore-scaffolding, slsa-verifier, gh, docker, kubescape, docker-cli-buildx, witness, kyverno, buildkitd, vexctl, aactl, neuvector-sigstore-interface, ko, kyverno-notation-aws, zot, policy-controller, zarf, ratify, gitsign, goreleaser,...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: tkn, cosign, sigstore-scaffolding, gh, kubescape, witness, docker-cli-buildx, vexctl, aactl, neuvector-sigstore-interface, ko, kyverno-notation-aws, zot, policy-controller, zarf, ratify, gitsign, goreleaser, spire-server, teleport, tflint, skaffold,...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, teleport, zot, policy-controller, ratify, flux-source-controller, tkn, aactl, falcoctl, gitsign, goreleaser, witness...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: melange, tkn, cosign, sigstore-scaffolding, slsa-verifier, gh, kubescape, wolfictl, vexctl, aactl, neuvector-sigstore-interface, zot, policy-controller, zarf, rekor, gitsign, spire-server, apko, trivy, flux-source-controller, falcoctl, tekton-chains...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: tkn, cosign, trivy-operator, sigstore-scaffolding, slsa-verifier, gh, docker, kubescape, witness, buildkitd, vexctl, aactl, neuvector-sigstore-interface, ko, kyverno-notation-aws, zot, policy-controller, zarf, ratify, rekor, gitsign, goreleaser, spire-server, telepor...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: terragrunt, kubernetes-event-exporter, terraform, step-ca, flux-image-reflector-controller, tkn, ksops, cosign, k3s, argo-events, crossplane-provider-azure-storage, sigstore-scaffolding, slsa-verifier, gh, kubescape, scorecard, flux, crossplane-provider-azure-sql,...

CVE-2026-73678: Improper Control of Generation of Code

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

Workspace Topology As an Attack Vector in Agentic Coding Assistants

Agentic coding assistants are finding widespread use, not just in new code development but in quickly ingesting and leveraging third-party code. This opens up a risk of malicious code being ingested as these coding tools operate with broad filesystem access inside developer workspaces. In this...

PT-2026-72043

Name of the Vulnerable Software and Affected Versions ZeroBrew versions prior to 0.3.2 Description A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs,...

CVE-2026-53970: Download of Code Without Integrity Check

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

GHSA-7JMF-5VCP-F672

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

CVE-2026-72839

creationtimestamp| type| source ---|---|--- 2026-08-13 22:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msypldq3wl2e 2026-08-15 08:00:05+00:00| seen| Telegram/7bSAS5c5TE5I5bBpK30fEeCZ4VMtoAAsa45677qm1k6CaLw 2026-08-15 13:40:04+00:00| seen|...

Malicious code in source-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c2f07bb4a673bf18d866e697b1a943783696d2871fbc5e5987c2117377e798 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...