GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: local-path-provisioner, spark-operator, http-echo, rancher-loglevel, spqr, incert, helm-docs, xcover, sriov-network-device-plugin, prometheus-alertmanager, terraform-provider-tls, hello-world-golang, aws-s3-controller, runc, terraform-provider-azuread, dask-gateway,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, spark-operator, http-echo, rancher-loglevel, spqr, incert, helm-docs, xcover, sriov-network-device-plugin, prometheus-alertmanager, terraform-provider-tls, hello-world-golang, aws-s3-controller, runc, terraform-provider-azuread, dask-gateway,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: local-path-provisioner, spark-operator, http-echo, rancher-loglevel, spqr, incert, helm-docs, xcover, sriov-network-device-plugin, prometheus-alertmanager, terraform-provider-tls, hello-world-golang, aws-s3-controller, runc, terraform-provider-azuread, dask-gateway,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, gpu-operator, seaweedfs-operator, terraform-provider-time-fips, nvidia-nsight-compute-12.9, cluster-proportional-autoscaler-fips, cloud-provider-aws-fips, vitess, iptables-wrappers, kyverno-policy-reporter-plugins-trivy-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, gpu-operator, seaweedfs-operator, terraform-provider-time-fips, nvidia-nsight-compute-12.9, cluster-proportional-autoscaler-fips, cloud-provider-aws-fips, vitess, iptables-wrappers, kyverno-policy-reporter-plugins-trivy-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, gpu-operator, seaweedfs-operator, terraform-provider-time-fips, nvidia-nsight-compute-12.9, cluster-proportional-autoscaler-fips, cloud-provider-aws-fips, vitess, iptables-wrappers, kyverno-policy-reporter-plugins-trivy-fips,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, gpu-operator, seaweedfs-operator, terraform-provider-time-fips, nvidia-nsight-compute-12.9, cluster-proportional-autoscaler-fips, cloud-provider-aws-fips, vitess, iptables-wrappers, kyverno-policy-reporter-plugins-trivy-fips,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: cluster-api-gcp-controller, gpu-operator, seaweedfs-operator, terraform-provider-time-fips, nvidia-nsight-compute-12.9, cluster-proportional-autoscaler-fips, cloud-provider-aws-fips, vitess, iptables-wrappers, kyverno-policy-reporter-plugins-trivy-fips,...

Improper Access Control

com.liferay.portal, release.portal.bom is vulnerable to improper access control. The vulnerability is due to the failure to restrict API access before a user changes their initial password, which allows an attacker to remotely access and modify content via the API...

EUVD-2014-6422

Malware in sbrugna...

EUVD-2008-4200

Malware in sbrugna...

EUVD-2006-0398

Malware in sbrugna...

EUVD-2022-29594

Malicious code in bioql PyPI...

Reflected Cross-Site Scripting (Reflected XSS)

com.liferay.portal, release.portal.bom is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to improper validation of the snippet parameter, which allows an attacker to inject and execute arbitrary JavaScript code in a victim’s browser...

Cross-Site Request Forgery (CSRF)

com.liferay.portal, release.portal.bom is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper validation of the endpoint parameter, which allows an attacker to perform cross-origin requests on behalf of an authenticated user...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via insufficient protection for omni-administrator users. An attacker can perform unauthorized actions on behalf of authenticated users by tricking them into submitting malicious requests. Remediation...

Spring AI - Groq AI inference

Faster information processing not only inform—it transforms how we perceive and innovate. Spring AI, a powerful framework for integrating AI capabilities into Spring applications, now offers support for Groq - a blazingly fast AI inference engine with supports for Tool/Function calling. Because...

Azure CLI Credentials Gatherer

This module will collect the Azure CLI 2.0+ az cli settings files for all users on a given target. These configuration files contain JWT tokens used to authenticate users and other subscription information. Once tokens are stolen from one host, they can be used to impersonate the user from a...

XML External Entity (XXE)

org.cyclonedx:cyclonedx-core-java is vulnerable to XML External Entity XXE.The vulnerability is caused due to improper configuration of the DocumentBuilderFactory used to evaluate XPath expressions to determine the schema version of the BOM before deserializing CycloneDX Bill of Materials in XML...

Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java

Impact Before deserializing CycloneDX Bill of Materials in XML format, cyclonedx-core-java leverages XPath expressions to determine the schema version of the BOM. The DocumentBuilderFactory used to evaluate XPath expressions was not configured securely, making the library vulnerable to XML Extern...