GHSA-92CP-5422-2MW7 vulnerabilities

Vulnerabilities for packages: authservice, gitea, oauth2-proxy, atlantis, fluent-bit-plugin-loki, kots, falcosidekick, splunk-otel-collector...

CVE-2025-29923 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector-fips, splunk-otel-collector, kots, loki, fluent-bit-plugin-loki, dapr-fips, loki-fips, keda, authservice, traefik-fips, rekor-fips, falcosidekick, opentelemetry-collector-contrib-fips, oauth2-proxy, falcosidekick-fips, juicefs, atlantis, argo-cd...

GHSA-92CP-5422-2MW7 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector-fips, splunk-otel-collector, kots, loki, fluent-bit-plugin-loki, dapr-fips, loki-fips, keda, authservice, traefik-fips, rekor-fips, falcosidekick, opentelemetry-collector-contrib-fips, oauth2-proxy, falcosidekick-fips, juicefs, atlantis, argo-cd...

OESA-2025-1301 syslinux security update

The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems SYSLINUX, network booting PXELINUX, bootable "El Torito" CD-ROMs ISOLINUX, and Linux ext2/ext3/ext4 or btrfs filesystems EXTLINUX. The project also includes MEMDISK, a tool to boot legacy operating systems such as DOS...

Critical GitHub Attack

This is serious: A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used “tj-actions/changed-files” utility, is now believed to have...

CVE-2025-29786 vulnerabilities

Vulnerabilities for packages: nats, splunk-otel-collector-fips, splunk-otel-collector, k8sgpt, argo-workflows, argo-workflows-fips, keda, argo-rollouts-fips, opentelemetry-collector-contrib-fips, amazon-cloudwatch-agent-fips, opentelemetry-collector-contrib, opentelemetry-collector-fips,...

GitHub Action Compromise Puts CI/CD Secrets at Risk in Over 23,000 Repositories

Cybersecurity researchers are calling attention to an incident in which the popular GitHub Action tj-actions/changed-files was compromised to leak secrets from repositories using the continuous integration and continuous delivery CI/CD workflow. The incident involved the tj-actions/changed-files...

CVE-2025-27616

Vela Server (CI/CD framework) is affected in versions prior to 0.25.3 and 0.26.3. By spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo-level CI secrets to another repository. Those secrets could be exfiltrate...

Linux Distros Unpatched Vulnerability : CVE-2021-3602

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN...

CVE-2025-0985: Cleartext Storage of Sensitive Information in an Environment Variable

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD stores potentially sensitive information in environment variables that could be obtained by a local user...

Important: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.15.1 security update

An update is now available for Red Hat OpenShift GitOps v1.15.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: hello-world-golang, render-template, ferretdb, http-echo, nri-couchbase, secrets-store-csi-driver-provider-gcp, thanos-operator, actions-runner-controller, flux-helm-controller, eksctl, ytt, esbuild, caddy, memcached-exporter, flux-image-reflector-controller,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: rekor, kubescape, flux-source-controller, spire-server, kots, trufflehog, caddy, oauth2-proxy, wolfictl, temporal, guac, melange, steampipe, goreleaser, aactl, dex, sops, step-ca, zot, skopeo, kargo, splunk-otel-collector, terragrunt, kube-rbac-proxy, weaviate, k3s,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: packer, pulumi, spire-controller-manager-fips, melange, chainctl, nerdctl, bank-vaults, istio-pilot-agent, dagdotdev, distribution-fips, gitsign, containerd-fips, trufflehog, step-issuer-fips, undock, vexctl, cosign, apko, harbor-registry, cert-manager-fips,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: rekor, kubescape, flux-source-controller, spire-server, kots, trufflehog, caddy, oauth2-proxy, wolfictl, temporal, guac, melange, steampipe, goreleaser, aactl, dex, sops, step-ca, zot, skopeo, kargo, splunk-otel-collector, terragrunt, kube-rbac-proxy, weaviate, k3s,...

GHSA-JGFP-53C3-624W vulnerabilities

Vulnerabilities for packages: spark-operator, kubernetes-fips, calico, vcluster, kapp-fips, kubernetes-dns-node-cache, local-static-provisioner-fips, aws-efs-csi-driver, argocd-image-updater-fips, kubernetes, azuredisk-csi, argocd-image-updater, spark-operator-fips, kubernetes-dns-node-cache-fips...

CVE-2025-0426 vulnerabilities

Vulnerabilities for packages: spark-operator, kubernetes-fips, calico, vcluster, kapp-fips, kubernetes-dns-node-cache, local-static-provisioner-fips, aws-efs-csi-driver, argocd-image-updater-fips, kubernetes, azuredisk-csi, argocd-image-updater, spark-operator-fips, kubernetes-dns-node-cache-fips...

SUSE CVE-2025-23216

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write...

CVE-2022-24768

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level. Versions starting with 0.8.0 and 0.5...

CVE-2023-6386

A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 and 16.8 prior to 16.8.2 which allows an attacker to spike the GitLab instance resource usage resulting in service degradation...