164 matches found
EUVD-2026-91803
The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...
CVE-2026-104055 Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm
The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...
CVE-2026-104055 Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm
The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...
GO-2026-5762 Wish has SCP Path Traversal that allows arbitrary file read/write in charm.land/wish
Wish has SCP Path Traversal that allows arbitrary file read/write in charm.land/wish...
Soft Serve 安全漏洞
Soft Serve is a self-hosted command-line Git server developed by Charm. Versions of Soft Serve from 0.6.0 to 0.11.6 contained security vulnerabilities. These vulnerabilities were due to an authorization flaw in repository imports, which allowed any authenticated SSH user to clone the server’s loc...
CVE-2026-1237
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or...
CVE-2026-1237
Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious user who is able to update database records can mint an invalid macaroon that is incorrectly validated by the juju controller, enabling a charm to maintain otherwise revoked or...
CVE-2022-33733
Sensitive information exposure in onCharacteristicRead in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission...
CVE-2022-33734
Sensitive information exposure in onCharacteristicChanged in Charm by Samsung prior to version 1.2.3 allows attacker to get bluetooth connection information without permission...
EUVD-2009-0764
Malware in sbrugna...
EUVD-2021-24146
Malware in sbrugna...
EUVD-2021-24145
Malware in sbrugna...
EUVD-2022-2461
Malicious code in bioql PyPI...
EUVD-2024-3000
Malicious code in bioql PyPI...
EUVD-2022-39530
Malicious code in bioql PyPI...
EUVD-2022-39529
Malicious code in bioql PyPI...
EUVD-2022-39536
Malicious code in bioql PyPI...
EUVD-2025-20670
Malicious code in bioql PyPI...
EUVD-2022-36772
Malicious code in bioql PyPI...
SUSE CVE-2025-53513
The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through th...