1334 matches found
Mlflow < 2.11.0 - Path Traversal
A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-codepipeline-fips, karma, kubernetes-replicator, sriov-network-device-plugin-fips, kubernetes-dashboard-web-fips, request-1279-14, commercial-spilo, cloudprober-fips, crossplane-provider-aws-fis, rqlite, gotenberg,...
EUVD-2026-45029
Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list Incomplete fix for CVE-2026-31892...
PT-2026-71769
Authorization Bypass Through User-Controlled Key CWE-639 in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables CAPEC-77. The authorization decision for artifact downloads relied on a client-supplied value that was persisted without being validated against t...
CVE-2026-48791
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated Rekor entry time against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancements that adhere to the Sigstore verificati...
CVE-2026-69106
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...
EUVD-2026-57389
A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content...
CVE-2026-73239
Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
EUVD-2026-57370
Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
CVE-2026-73239 Apache Allura: Missing permission checks IDOR
Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
CVE-2026-73239
CVE-2026-73239 : In Apache Allura, an Insecure Direct Object Reference (IDOR) arises from missing permission checks for multiple Artifact types. Affected versions: before 1.19.1. The advisory recommends upgrading to version 1.19.1 to fix the issue. The available sources consistently describe the ...
CVE-2026-73239
Insecure Direct Object Reference IDOR due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
CVE-2026-69105
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability...
CVE-2026-69107
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...
CVE-2026-69107 Potential unauthorized artifact access in JFrog Artifactory
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...
EUVD-2026-57261
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability...
CVE-2026-69105
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability...
PT-2026-71134
An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability...
PT-2026-71195
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged user can poison cached artifact metadata under specific conditions. This action may lead consumers to retrieve untrusted content. Recommendation...
