GHSA-6FHJ-VR9J-G45R CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity XXE injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation. Patches The...

CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity XXE injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation. Patches The...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: kube-state-metrics, ip-masq-agent, terraform-provider-tls, terraform-provider-time, sonobuoy, prometheus-pushgateway, nuclei, terraform-provider-random, cue, vt-cli, secrets-store-csi-driver-provider-aws, ytt, kube-logging-operator-custom-runner, grpcurl,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface, cert-manager-webhook-pdns, kube-state-metrics, terraform-provider-azuread, etcd, ip-masq-agent, spire-controller-manager, terraform-provider-tls, terraform-provider-time, boring-registry, git-credential-oauth, prometheus-pushgatewa...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: cluster-api-fips, sbom-convert, vexctl, vault-secrets-operator, falco-no-driver, pvc-autoresizer, neuvector-dbgen-fips, go-md2man, cloud-provider-azure-fips, tfsec, terraform-provider-kubernetes, kbld, configmap-reload-fips, harbor-scanner-trivy-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: cluster-api-fips, sbom-convert, vexctl, vault-secrets-operator, falco-no-driver, pvc-autoresizer, neuvector-dbgen-fips, go-md2man, cloud-provider-azure-fips, tfsec, terraform-provider-kubernetes, kbld, configmap-reload-fips, harbor-scanner-trivy-fips,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: cluster-api-fips, sbom-convert, vexctl, vault-secrets-operator, falco-no-driver, pvc-autoresizer, neuvector-dbgen-fips, go-md2man, cloud-provider-azure-fips, tfsec, terraform-provider-kubernetes, kbld, configmap-reload-fips, harbor-scanner-trivy-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: cluster-api-fips, sbom-convert, vexctl, vault-secrets-operator, falco-no-driver, pvc-autoresizer, neuvector-dbgen-fips, go-md2man, cloud-provider-azure-fips, tfsec, terraform-provider-kubernetes, kbld, configmap-reload-fips, harbor-scanner-trivy-fips,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: cluster-api-fips, sbom-convert, vexctl, vault-secrets-operator, falco-no-driver, pvc-autoresizer, neuvector-dbgen-fips, go-md2man, cloud-provider-azure-fips, tfsec, terraform-provider-kubernetes, kbld, configmap-reload-fips, harbor-scanner-trivy-fips,...

Improper Access Control

com.liferay.portal, release.portal.bom is vulnerable to improper access control. The vulnerability is due to the failure to restrict API access before a user changes their initial password, which allows an attacker to remotely access and modify content via the API...