1717 matches found
EUVD-2026-62691
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any...
EUVD-2026-62607
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled...
CVE-2026-76228
Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...
Malicious code in @mohamed_nowisar/token3-check (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457 The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the...
Malicious code in @mohamed_nowisar/depconf-canary-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078a8dc3351eb44ee9ff0d5992b9082b726d7fbce0152ae2d44595a9e279ef82 On npm install, the package's preinstall hook runs node beacon.js, which collects host identity os.hostname, os.userInfo.username, process.cwd,...
BIT-GITLAB-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...
BIT-GITLAB-2026-15423 Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...
GHSA-XV7V-HW45-9JGW vulnerabilities
Vulnerabilities for packages: jenkins...
CVE-2026-70429 vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
CVE-2026-74870
opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...
CVE-2026-74870 openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure
opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-monolith, kubernetes-replicator, crossplane-provider-aws-connect-fips, k6, headlamp-fips, chisel, spire-controller-manager, prometheus-redis-exporter, argo-rollouts-fips, lvm-driver-fips, vault-fips, conftest, kbld, argocd-image-updater-fips,...
CVE-2026-22555
A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...
GO-2026-5486 vulnerabilities
Vulnerabilities for packages: tkn-fips, tekton-chains-fips, tekton-chains, tkn, tekton-pipelines, tekton-pipelines-fips...
GO-2026-4678 vulnerabilities
Vulnerabilities for packages: argo-workflows-fips, argo-workflows, kubeflow-pipelines...
GO-2025-3720 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, argo-cd, argocd-image-updater-fips...
GO-2025-3830 vulnerabilities
Vulnerabilities for packages: buf, chainctl, openfga-fips, docker-compose-fips, opentelemetry-collector-contrib-fips, apko-fips, prometheus-fips, osv-scanner, cadvisor-fips, trivy-fips, prometheus, telegraf, buildkitd, grype-fips, trivy, opentelemetry-collector-fips, aws-otel-collector,...
