GO-2025-3830 vulnerabilities

Vulnerabilities for packages: prometheus, buildah, opentelemetry-collector-fips, zot, prometheus-fips, splunk-otel-collector-fips, aws-otel-collector-fips, opentelemetry-collector-contrib-fips, elastic-agent, spire-server-fips, openfga-fips, zarf, agentbeat-fips, beats-fips, k9s,...

GO-2024-2920 vulnerabilities

Vulnerabilities for packages: dagger, zot, melange, guac...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: goreleaser, melange, wolfictl, tekton-chains, ko, zarf, spire-server, slsa-verifier, skaffold, policy-controller, apko, kubescape, neuvector-sigstore-interface, zot, tkn, vexctl, falcoctl, aactl, flux-source-controller, gitsign...

CVE-2026-74247: Server-Side Request Forgery (SSRF)

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...

PT-2026-72130

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists in the Stripe billing webhook handler. An unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint. The system...

PT-2026-72043

Name of the Vulnerable Software and Affected Versions ZeroBrew versions prior to 0.3.2 Description A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs,...

PT-2026-72132

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A Server-Side Request Forgery SSRF flaw exists within the build API. A user with repository write access and the FEATURE BUILD SUPPORT enabled can provide a malicious URL via the archive...

CVE-2026-53970: Download of Code Without Integrity Check

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840

OpenChoreo is affected by a vulnerability in the POST /api/v1alpha1/autobuild endpoint (internal/openchoreo-api/api/handlers/webhook_handler.go) where a webhook provider is chosen from caller-controlled X-Event-Key, Bitbucket requests may be accepted without HMAC-SHA256 in X-Hub-Signature or a co...

CVE-2026-73532

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-73532 Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-73533 Ninja Tables Pro 5.2.11 Embedded Malicious Code via Tampered Plugin Build

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

EUVD-2026-58112

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CLEANSTART-2026-SG48140 Security fixes in melange 0.56.1-r1

Package melange version 0.56.1-r1 fixes 22 vulnerabilities: CVE-2026-34040, CVE-2026-33997, CVE-2026-54174, CVE-2026-39830, CVE-2026-39831...

LLM-Assisted Dynamic Threat Analysis for Attacker-Reachable Software Weaknesses in Autonomous Vehicles

Autonomous vehicles depend on large safety-critical software stacks, where weaknesses reachable from adversarial inputs may affect steering, braking, or other control decisions. Static analysis can identify candidate sites, but dynamically confirming exploitability requires executable test...