PT-2026-24721

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that, under certain conditions, could have allowed an authenticated user to access previous pipeline job information on projects with repository and CI/CD...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: aws-nuke, loki-fips, karma-fips, cluster-api-azure-controller, helm, backup-restore-operator-fips, render-template-fips, tflint, longhorn-cli-fips, secrets-store-csi-driver-fips, helm-docs, dynamic-localpv-provisioner, kubelet-csr-approver, bom, openbao-fips,...

prima-incident-response-security-poc

DevOps Security Pipeline POC A security-integrated CI/CD pipe...

Best Tools for Test Data Management to Accelerate QA Teams in 2026

Test Data Management tools for 2026 ranked for QA and DevOps teams, comparing speed, self service, masking, CI/CD fit, and enterprise readiness...

CVE-2026-0933

SummaryA command injection vulnerability CWE-78 has been found to exist in the wrangler pages deploy command. The issue occurs because the --commit-hash parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of --commit-hash to...

Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigation

The software supply chain attacks are becoming more and more focused on trusted development and delivery procedures, so the conventional post-build integrity mechanisms cannot be used anymore. The available frameworks like SLSA, SBOM and in toto are majorly used to offer provenance and traceabili...

GO-2025-3995 Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd...

Towards a Blockchain-Based CI/CD Framework to Enhance Security in Cloud Environments

Security is becoming a pivotal point in cloud platforms. Several divisions, such as business organisations, health care, government, etc., have experienced cyber-attacks on their infrastructures. This research focuses on security issues within Continuous Integration and Deployment CI/CD pipelines...

EUVD-2022-1951

Malicious code in bioql PyPI...

Malicious code in @dtpk-cc/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0b1e4b6fe7f3d42a2752aea1642dd9191f6afeb4dcca96ef97a65b5af5cb192 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-36652

Argo CD's Project API Token Exposes Repository Credentials in github.com/argoproj/argo-cd...

PT-2025-34931 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 18.1.5 GitLab CE/EE versions 18.2 through 18.2.5 GitLab CE/EE versions prior to 18.3.1 Description: An issue exists in GitLab CE/EE that allows unauthenticated users to access sensitive manual CI/CD variables by...

MAL-2025-14188 Malicious code in airbnb-es5 (npm)

The package airbnb-es5 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 8210336cb16ae6428e936268a05b3f57769d39cfc48cbe662870575dc1faf80b This package installs a dependency hosted on a custom domain that runs an info...

PT-2025-32853

Name of the Vulnerable Software and Affected Versions GitHub Copilot affected versions not specified Visual Studio 2022 versions prior to 17.14.12 Description Improper neutralization of special elements used in a command leads to a command injection issue in GitHub Copilot and Visual Studio,...

A Systematic Literature Review on Continuous Integration and Deployment (CI/CD) for Secure Cloud Computing

As cloud environments become widespread, cybersecurity has emerged as a top priority across areas such as networks, communication, data privacy, response times, and availability. Various sectors, including industries, healthcare, and government, have recently faced cyberattacks targeting their...

Intent-Aware Authorization for Zero Trust CI/CD

This paper introduces intent-aware authorization for Zero Trust CI/CD systems. Identity establishes who is making the request, but additional signals are required to decide whether access should be granted. We describe a control loop architecture where policy engines such as OPA and Cedar evaluat...

The vulnerability of the CI/CD application integration and delivery system of JetBrains TeamCity, related to the disclosure of information through registration files, allows a hacker to disclose protected information.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to the disclosure of information through registration files due to incorrect encoding based on the base64 standard. Exploiting this vulnerability can allow a malicious...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, related to insufficient protection of registration data, allows attackers to disclose protected information.

The vulnerability of the Continuous Integration and Deployment application delivery system CI/CD of TeamCity in JetBrains is related to insufficient protection for registration data. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) JetBrains TeamCity, related to improperly used standard permissions, allows a hacker to increase their privileges.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to the incorrect use of standard permissions. Exploiting this vulnerability can allow attackers to increase their privileges...

JetBrains TeamCity Information Disclosure Vulnerability

JetBrains TeamCity is a Continuous Integration CI/CD tool that is primarily used to automate the software build, test, and deployment process. An information disclosure vulnerability exists in JetBrains TeamCity, which stems from a "password"-type parameter that can be disclosed to build logs und...