sloppy-joe

환각hallucination된, 오타스쿼팅된, 비정규 의존성을 프로덕션에 도달하기 전에 잡아내세요. cargo install sloppy-joe 2026년 3월의LiteLLM 공급망 공격은 월간 9700만 다운로드의 패키지를 손상시켰습니다. 공격자는 배포 자격 증명을 탈취하고, SSH 키, 클라우드 자격 증명, K8s 비밀을 수집하는 악성 버전을 푸시했습니다. sloppy-joe의 기본 72시간 버전 연령 게이트는 두 개의 감염된 버전을 모두 차단했을 것입니다. 이들은 게이트가 열리기 훨씬 전인 몇 시간 이내에 발견되었습니다...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89145

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 contain a stored XSS vulnerability caused by missing HTML-escaping of plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). An attacker with write access to the plugins directory can create a plugin whose d...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

Gradle 安全漏洞

Gradle is a suite of JVM-based project build tools from Gradle, Inc. that supports maven, Ivy repositories, and more. A security vulnerability exists in Gradle that stems from a dependency validation failure if anything other than a fingerprint is used in the trust element of the dependency...

Gradle 数据伪造问题漏洞

Gradle is a set of JVM-based project building tools from the US company Gradle, which supports maven, Ivy repositories and more. A security vulnerability exists in Gradle versions prior to 7.5, which stems from the fact that dependency validation can ignore checksum validation when signature...

Gradle 安全漏洞

Gradle is a set of JVM-based project build tools from Gradle, Inc. that supports maven, Ivy repositories, and more. Gradle suffers from a security vulnerability that stems from the fact that under certain circumstances, Gradle may skip validation and accept a dependency that would otherwise cause...

GHSA-GVXV-5FP2-358Q Incorrect Resource Transfer Between Spheres in eclipse-wtp

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel http. If the build occurred over an insecure connection, a maliciou...