GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: mockery, hello-world-golang, pguser, restic, kube-rbac-proxy, yunikorn-web, ctop, kubernetes-replicator, secrets-store-csi-driver-provider-gcp, aws-signer-notation-plugin, policy-controller, render-template, helm-docs, mockgen, hivemind, kpt,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: mockery, hello-world-golang, pguser, restic, kube-rbac-proxy, yunikorn-web, ctop, kubernetes-replicator, secrets-store-csi-driver-provider-gcp, aws-signer-notation-plugin, policy-controller, render-template, helm-docs, mockgen, hivemind, kpt,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: mockery, hello-world-golang, pguser, restic, kube-rbac-proxy, yunikorn-web, ctop, kubernetes-replicator, secrets-store-csi-driver-provider-gcp, aws-signer-notation-plugin, policy-controller, render-template, helm-docs, mockgen, hivemind, kpt,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: mockery, hello-world-golang, pguser, restic, kube-rbac-proxy, yunikorn-web, ctop, kubernetes-replicator, aws-signer-notation-plugin, policy-controller, render-template, helm-docs, mockgen, hivemind, kpt, aws-node-termination-handler, apisix-ingress-controller, kind,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: mockery, hello-world-golang, pguser, restic, kube-rbac-proxy, yunikorn-web, ctop, kubernetes-replicator, secrets-store-csi-driver-provider-gcp, aws-signer-notation-plugin, policy-controller, render-template, helm-docs, mockgen, hivemind, kpt,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: mockery, hello-world-golang, pguser, restic, kube-rbac-proxy, yunikorn-web, ctop, kubernetes-replicator, secrets-store-csi-driver-provider-gcp, aws-signer-notation-plugin, policy-controller, render-template, helm-docs, mockgen, hivemind, kpt,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: mockery, hello-world-golang, pguser, restic, kube-rbac-proxy, yunikorn-web, ctop, kubernetes-replicator, secrets-store-csi-driver-provider-gcp, aws-signer-notation-plugin, policy-controller, render-template, helm-docs, mockgen, hivemind, kpt,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: mockery, hello-world-golang, pguser, restic, kube-rbac-proxy, yunikorn-web, ctop, kubernetes-replicator, secrets-store-csi-driver-provider-gcp, aws-signer-notation-plugin, policy-controller, render-template, helm-docs, mockgen, hivemind, kpt,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: linkerd2-cni-plugin, chisel-fips, azure-ipam, metacontroller, manifest-tool, pgpool2exporter, azure-workload-identity-webhook, infinispan-operator, cluster-proportional-autoscaler-fips, ferretdb, prometheus-snmp-exporter, spire-controller-manager, hello-world-golang,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: linkerd2-cni-plugin, chisel-fips, azure-ipam, metacontroller, manifest-tool, pgpool2exporter, azure-workload-identity-webhook, infinispan-operator, cluster-proportional-autoscaler-fips, ferretdb, prometheus-snmp-exporter, spire-controller-manager, hello-world-golang,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: linkerd2-cni-plugin, chisel-fips, azure-ipam, metacontroller, manifest-tool, pgpool2exporter, azure-workload-identity-webhook, infinispan-operator, cluster-proportional-autoscaler-fips, ferretdb, prometheus-snmp-exporter, spire-controller-manager, hello-world-golang,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: linkerd2-cni-plugin, chisel-fips, azure-ipam, metacontroller, manifest-tool, pgpool2exporter, azure-workload-identity-webhook, infinispan-operator, cluster-proportional-autoscaler-fips, ferretdb, prometheus-snmp-exporter, spire-controller-manager, hello-world-golang,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: linkerd2-cni-plugin, chisel-fips, azure-ipam, metacontroller, manifest-tool, pgpool2exporter, azure-workload-identity-webhook, infinispan-operator, cluster-proportional-autoscaler-fips, ferretdb, prometheus-snmp-exporter, spire-controller-manager, hello-world-golang,...

AZL-69200 CVE-2025-58183 affecting package gh for versions less than 2.62.0-10

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

CVE-2025-54545 On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges...

CVE-2025-54545 On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges...

CVE-2025-54545

CVE-2025-54545 is a local privilege-escalation in Arista DANZ Monitoring Fabric (DMF) and related products. A restricted user could break out of the CLI sandbox to the system shell, gaining elevated privileges. Arista’s Security Advisory 0124 confirms affected products across DMF, Converged Cloud...

CVE-2025-11202

win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-11202 win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability

win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-11202

CVE-2025-11202 relates to win-cli-mcp-server. The issue is in the resolveCommandPath function where a user-supplied string is used to invoke a system call without proper validation, enabling a remote command execution (RCE). The exploit is unauthenticated and would execute code in the service acc...