GO-2024-2918 vulnerabilities

Vulnerabilities for packages: airflow, rekor, secrets-store-csi-driver-provider-azure, bank-vaults, tempo, pulumi, goreleaser, guac, sigstore-scaffolding, velero, ksops, argo-workflows, zarf, k8sgpt, chezmoi, cortex, argo-events, fluent-bit-plugin-loki, policy-controller,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: k9s, cilium, argo-cd, crossplane-provider-aws-cloudformation, telegraf, kots, chisel, cilium-cli, k8sgpt, gptscript, pulumi-language-dotnet, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-route53, splunk-otel-collector, fscrypt, go-discover, aactl,...

GO-2026-4503 vulnerabilities

Vulnerabilities for packages: temporal, rekor, gitea, sqlexporter, telegraf, dbmate, kots, spicedb, envoy-gateway, cerbos, argo-workflows, croc, ksops, chezmoi, minio, k3s, nri-mysql, splunk-otel-collector, step, openfga, apko, aactl, step-ca, mariadb-operator, crossplane-provider-sql,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, kube-logging-operator-custom-runner, terraform-provider-time, kbld, falcosidekick, rabbitmq-messaging-topology-operator, tfsec, vertical-pod-autoscaler, ferretdb, newrelic-fluent-bit-output, pgpool2exporter,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, amazon-cloudwatch-agent-operator, cilium-cli, controller-gen, k3d, nri-mysql, k8sgpt, gptscript, chart-testing, aactl, polaris, rabbitmq-cluster-operator, eksctl, ko, dive, terraform-provider-azapi, harbor-registry, wait-for-port...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, skopeo, rekor, bank-vaults, pulumi, goreleaser, scorecard, guac, k3d, sigstore-scaffolding, ksops, zarf, policy-controller, argo-events, k3s, snyk-cli, flux-image-reflector-controller, kubernetes-event-exporter, kubescape,...

CVE-2026-72851

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

CLEANSTART-2026-HR84779 Security fixes in step-ca-fips 0.30.2-r1

Package step-ca-fips version 0.30.2-r1 fixes 16 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CVE-2026-73083 Activepieces: V8 Isolate Sandbox Bypass via importFresh Module Loading

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

CVE-2026-73081

CVE-2026-73081 affects Activepieces prior to 0.80.0. The worker’s code-compilation pipeline creates the on-disk path for a Code step from the step name and passes it to a shell-invoked build command. A step name containing shell metacharacters can break out of the intended build invocation, allow...

CVE-2026-73081 Activepieces: Remote Code Execution via Command Injection in Code Step Name

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

CVE-2026-73081 Activepieces: Remote Code Execution via Command Injection in Code Step Name

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

RLSA-2026:38509 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...

RLSA-2026:38511 Important: vim security update

Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162 vim: Vim: Arbitrary code execution via Python omni-completion...

PT-2026-70355

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, the worker's code-compilation pipeline builds the on-disk path for a Code step from the step's name and passes that path to a shell-invoked build command. A step name containing shell metacharacters can break out of...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server could cause the FreeRDP client to crash by sending audio data in IMA ADPCM format with an invalid initial step index value = 89. The invalid step index was read directly from the netwo...

CVE-2026-47167

A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition...

CVE-2026-47659

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's /$result endpoint allows a caller who can obtain any valid async export job ID to supply file parameter values containing path...

MiracleLinux 9 : vim-8.2.2637-26.el9_8.10.ML.1 (AXSA:2026-1480:21)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1480:21 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162...

CVE-2026-48079 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...