GHSA-9MJ6-HXHV-W67J vulnerabilities

Vulnerabilities for packages: jitsucom-bulker, sqlexporter-fips, opentelemetry-collector-contrib, telegraf, amazon-cloudwatch-agent, vault, cluster-api-aws-controller, amazon-cloudwatch-agent-fips, sqlexporter, grafana-alloy, bento, splunk-otel-collector, argo-events-fips, argo-events,...

This Week in Spring - October 14th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Boston and New York city and Bulgaria and Poland this week, but I'm still hyped about last week's amazing Devoxx Belgium event! There are a ton of videos to look at, and I'll include just some of them here. So, without...

EUVD-2023-1966

Malicious code in bioql PyPI...

EUVD-2024-1350

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: helm-operator, dive, grafana-rollout-operator, kube-bench, prometheus-operator, ratify, tkn, timescaledb-tune, gatekeeper, linkerd2-cni-plugin, rabbitmq-cluster-operator, buildkitd, azuredisk-csi, ip-masq-agent, containerd, chartmuseum, spire-controller-manager,...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: container-object-storage-interface-fips, step-issuer, nri-mssql, nova-fips, cluster-api-aws-controller, flux-image-reflector-controller-fips, gops, supercronic, sbomqs, vault-env, rancher-fleet-fips, opensearch-k8s-operator, prometheus-mysqld-exporter, etcd,...

GHSA-VRW8-FXC6-2R93 vulnerabilities

Vulnerabilities for packages: tkn, gogatekeeper, kyverno-policy-reporter-ui, buf, sftpgo, gitness, cloudflared, rclone, step, step-ca, step-issuer, karma, caddy...

GHSA-VRW8-FXC6-2R93 vulnerabilities

Vulnerabilities for packages: step-ca-fips, step-issuer, tkn, tkn-fips, caddy-fips, telegraf, sftpgo, cloudflared, kyverno-policy-reporter-ui, rclone-fips, step, gitness, kyverno-policy-reporter-ui-fips, gogatekeeper, step-fips, karma, rclone, step-ca, step-issuer-fips, buf, caddy, dapr, dapr-fip...

CVE-2024-35223

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

GO-2022-1033 Dapr Dashboard vulnerable to Incorrect Access Control in github.com/dapr/dashboard

Dapr Dashboard vulnerable to Incorrect Access Control in github.com/dapr/dashboard...

GO-2023-1955 Dapr API token authentication bypass in HTTP endpoints in github.com/dapr/dapr

Dapr API token authentication bypass in HTTP endpoints in github.com/dapr/dapr...

GO-2024-2879 Dapr API Token Exposure in github.com/dapr/dapr

Dapr API Token Exposure in github.com/dapr/dapr...

CVE-2024-35223

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

CVE-2024-35223 Dapr API Token Exposure

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

CVE-2024-35223 Dapr API Token Exposure

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

CVE-2024-35223 Dapr API Token Exposure

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. Dapr sends the app token of the invoker app instead of the app token of the invoked app. This causes of a leak of the application token of the invoker app to the invoked app when using Dapr as a...

CVE-2024-35223

CVE-2024-35223 affects Dapr where, when acting as a gRPC proxy for remote service invocation, the proxy may leak the invoker app’s token to the invoked app due to incorrect token handling. The root cause is that the proxy forwards the invoker’s app token (APP_API_TOKEN) instead of the invoked app...

Dapr 信息泄露漏洞

Dapr is a portable, serverless, event-driven runtime from the Dapr open source. A security vulnerability exists in Dapr that stems from the disclosure of application tokens when using Dapr as a gRPC proxy for remote service calls. Affected products and versions:Dapr version 1.13.0, 1.13.1, 1.13.2...

GHSA-284C-X8M7-9W5H Dapr API Token Exposure

Summary A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the...

Dapr API Token Exposure

Summary A vulnerability has been found in Dapr that causes a leak of the application token of the invoker app to the invoked app when using Dapr as a gRPC proxy for remote service invocation. This issue arises because Dapr sends the app token of the invoker app instead of the app token of the...