CVE-2024-45799

FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a...

Malicious code in flux-example-chat (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25c56a7bd2b361d914ee94cd9ec12e8fe10e84358352b4cab6490131e216dbad Any computer that has this package installed or running should be considered...

MAL-2025-707 Malicious code in flux-example-chat (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25c56a7bd2b361d914ee94cd9ec12e8fe10e84358352b4cab6490131e216dbad Any computer that has this package installed or running should be considered...

CVE-2024-56138 vulnerabilities

Vulnerabilities for packages: kyverno-fips, flux-source-controller-fips, flux-source-controller, kyverno-notation-aws, kyverno, flux-fips, flux, kyverno-notation-aws-fips...

CVE-2024-56138 vulnerabilities

Vulnerabilities for packages: flux, kyverno-notation-aws, flux-source-controller...

GHSA-45V3-38PC-874V vulnerabilities

Vulnerabilities for packages: flux, kyverno-notation-aws, flux-source-controller...

CVE-2025-21613 vulnerabilities

Vulnerabilities for packages: gitsign, task, argo-workflows, osv-scanner, trivy-fips, flux-image-automation-controller-fips, pulumi-language-dotnet, k8sgpt, apko, guac, gitea, melange, packer, syft, bom, dagger, argo-workflows-fips, amazon-ssm-agent, chezmoi, flux-kustomize-controller, nuclei,...

CVE-2025-21614 vulnerabilities

Vulnerabilities for packages: k9s, scorecard, argocd-image-updater, pulumi-language-yaml, pulumi-language-java, osv-scanner, wolfictl, kubevela, melange, apko, goreleaser, bom, go-licenses, syft, kargo, nuclei, flux-kustomize-controller, src-fingerprint, kaniko, flux-source-controller, flux, gryp...

CVE-2025-21613 vulnerabilities

Vulnerabilities for packages: k9s, scorecard, argocd-image-updater, pulumi-language-yaml, pulumi-language-java, osv-scanner, wolfictl, kubevela, melange, apko, goreleaser, bom, go-licenses, syft, kargo, nuclei, flux-kustomize-controller, src-fingerprint, kaniko, flux-source-controller, flux, gryp...

GHSA-R9PX-M959-CXF4 vulnerabilities

Vulnerabilities for packages: k9s, scorecard, argocd-image-updater, pulumi-language-yaml, pulumi-language-java, osv-scanner, wolfictl, kubevela, melange, apko, goreleaser, bom, go-licenses, syft, kargo, nuclei, flux-kustomize-controller, src-fingerprint, kaniko, flux-source-controller, flux, gryp...

GHSA-V725-9546-7Q7M vulnerabilities

Vulnerabilities for packages: gitsign, task, argo-workflows, osv-scanner, trivy-fips, flux-image-automation-controller-fips, pulumi-language-dotnet, k8sgpt, apko, guac, gitea, melange, packer, syft, bom, dagger, argo-workflows-fips, amazon-ssm-agent, chezmoi, flux-kustomize-controller, nuclei,...

GHSA-V725-9546-7Q7M vulnerabilities

Vulnerabilities for packages: k9s, scorecard, argocd-image-updater, pulumi-language-yaml, pulumi-language-java, osv-scanner, wolfictl, kubevela, melange, apko, goreleaser, bom, go-licenses, syft, kargo, nuclei, flux-kustomize-controller, src-fingerprint, kaniko, flux-source-controller, flux, gryp...

UBUNTU-CVE-2024-38819

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

GHSA-32GQ-X56H-299C vulnerabilities

Vulnerabilities for packages: chezmoi, flux-kustomize-controller, sops, age-fips, grafana, age, litestream, sops-fips, ksops, flux-kustomize-controller-fips, grafana-fips...

spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource

A flaw was found in Spring applications using the WebMvc.fn or WebFlux.fn frameworks. This issue can allow attackers to perform path traversal attacks via crafted HTTP requests when the application serves static resources using RouterFunctions and explicitly configures resource handling with a...

Hackers Leveraging Cloudflare Tunnels, DNS Fast-Flux to Hide GammaDrop Malware

The threat actor known as Gamaredon has been observed leveraging Cloudflare Tunnels as a tactic to conceal its staging infrastructure hosting a malware called GammaDrop. The activity is part of an ongoing spear-phishing campaign targeting Ukrainian entities since at least early 2024 that's design...

MAL-2024-11542 Malicious code in byte-flux-3822a6dd00d6414daba3ae0de3930a5a (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cec00e10a19e19684fc4887fa09aa1025aafc00f1121baacdf55f0c3b2ba9aec A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Malicious code in byted-flux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a8424c4934716d4a7390731613807c89bca1d0f11a56e3062dacef247d859e80 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11545 Malicious code in byted-flux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a8424c4934716d4a7390731613807c89bca1d0f11a56e3062dacef247d859e80 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

GHSA-29WX-VH33-7X7R vulnerabilities

Vulnerabilities for packages: kubernetes, temporal-server, terraform-provider-azurerm, chartmuseum, tekton-chains, temporal, scorecard, wal-g, weaviate, boring-registry, actions-runner-controller, doppler-kubernetes-operator, vexctl, kubeflow-katib, goreleaser, falcoctl, tkn,...