CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, postgres-operator, sbomqs, flux-source-controller, opentelemetry-operator, regclient, frp, gostatsd, temporal-server, memcached-exporter, nri-elasticsearch, seaweedfs, velero-plugin-for-aws, amazon-k8s-cni, terraform-provider-kubernetes,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, postgres-operator, sbomqs, flux-source-controller, opentelemetry-operator, regclient, frp, gostatsd, temporal-server, memcached-exporter, nri-elasticsearch, seaweedfs, velero-plugin-for-aws, amazon-k8s-cni, terraform-provider-kubernetes,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: trufflehog, fluent-bit-plugin-loki, flux-kustomize-controller, crossplane-provider-azure-sql, docker, flux-source-controller, kaniko, rclone, flyte, opentelemetry-operator, scorecard, crossplane-provider-azure, kyverno-notation-aws, mongo-tools, hydra, temporal-serve...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: fluent-bit-plugin-loki, flux-kustomize-controller, postgres-operator, sbomqs, flux-source-controller, regclient, frp, gostatsd, temporal-server, memcached-exporter, velero-plugin-for-aws, amazon-k8s-cni, tflint, oras, argo-workflows, certificate-transparency,...

CVE-2022-39321

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-ui, prometheus-operator, gcsfuse, eksctl, kube-rbac-proxy-fips, ollama, kots, crossplane-provider-aws-firehose, kiam, runc, crossplane-provider-aws-s3, kubernetes-dashboard-metrics-scraper-fips, dynamic-localpv-provisioner-fips,...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis, kaniko, crossplane-provider-aws-sns, crossplane-provider-aws-route53, skaffold, gitness, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-elasticache, terragrunt, grype, kubevela, cosign-fips, scorecard,...

Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower

Impact This vulnerability only impacts versions v2 and lower. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs fs.chmodSynckubectlPath, 777 to set...

CVE-2022-46257

An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploi...

PT-2023-14887

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions prior to 3.7 GitHub Enterprise Server versions 3.3 through 3.3.16 GitHub Enterprise Server versions 3.4 through 3.4.11 GitHub Enterprise Server versions 3.5 through 3.5.8 GitHub Enterprise Server versions 3.6...

CVE-2022-46257: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability was identified in GitHub Enterprise Server that allowed private repositories to be added to a GitHub Actions runner group via the API by a user who did not have access to those repositories, resulting in the repository names being shown in the UI. To exploi...

GitHub Enterprise Server 安全漏洞

GitHub Enterprise Server is a U.S. GitHub open source application. Provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server versions prior to 3.7. An attacker...

CVE-2023-23939 Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower

Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This...

Command injection

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...

GitHub Actions Runner 操作系统命令注入漏洞

GitHub Actions Runner is an application that runs jobs from a GitHub Actions workflow. A security vulnerability exists in GitHub Actions Runner that stems from the presence of a logic error that allows input to escape an environment variable and directly modify that docker command call, Jobs that...

CVE-2022-39321

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...

PT-2022-24898 · Github · Github Actions Runner

Name of the Vulnerable Software and Affected Versions: GitHub Actions Runner versions prior to 2.296.2 GitHub Actions Runner versions prior to 2.293.1 GitHub Actions Runner versions prior to 2.289.4 GitHub Actions Runner versions prior to 2.285.2 GitHub Actions Runner versions prior to 2.283.4...

CVE-2022-39321 GitHub Actions Runner vulnerable to Docker Command Escaping

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...