GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: nfpm, prometheus, syft-fips, knative-serving, flux-operator-fips, flux-kustomize-controller-fips, argo-events, rootlesskit, crossplane-provider-azure-policyinsights, jfrog-cli, juicefs, kargo, vitess, helm, sops, fulcio-fips, nemo, syft, packer-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: prometheus, knative-serving, vitess, helm, nemo, kine, osv-scanner, external-secrets-operator, gatekeeper, harbor, opentofu-fips, gatekeeper-fips, omnictl-multiarch, prometheus-fips, zot, containerd, coder, gitlab-kas, mattermost, prometheus-mongodb-exporter,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: nfpm, prometheus, syft-fips, knative-serving, flux-operator-fips, flux-kustomize-controller-fips, argo-events, rootlesskit, crossplane-provider-azure-policyinsights, jfrog-cli, juicefs, kargo, vitess, helm, sops, fulcio-fips, nemo, syft, packer-fips,...

GO-2026-5527 Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go) in github.com/argoproj/argo-workflows

Argo Affected by SSO RBAC Delegation Nil Pointer Dereference DoS gatekeeper.go in github.com/argoproj/argo-workflows...

CVE-2026-42890

Actual is an open-source personal finance application. In the macOS desktop application version 25.x built on Electron 39.2.7, the ELECTRONRUNASNODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary wit...

Arbitrary Code Injection

Overview desktop-electron is a My Electron application description Affected versions of this package are vulnerable to Arbitrary Code Injection via the ELECTRONRUNASNODE environment variable. An attacker can execute arbitrary code with the application's entitlements and code signature by launchin...

CVE-2026-42890

CVE-2026-42890 affects the macOS desktop application Actual (version 25.x, Electron 39.2.7). The ELECTRON_RUN_AS_NODE fuse was not disabled, allowing a local attacker who can place a file on disk or influence command-line arguments to invoke Actual.app with ELECTRON_RUN_AS_NODE=1. This converts t...

CVE-2026-42890 actual Allows Electron to Run As Node

Actual is an open-source personal finance application. In the macOS desktop application version 25.x built on Electron 39.2.7, the ELECTRONRUNASNODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary wit...

EUVD-2026-36547

Actual is an open-source personal finance application. In the macOS desktop application version 25.x built on Electron 39.2.7, the ELECTRONRUNASNODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary wit...

PT-2026-47558

Summary A electron run as node vulnerability was identified in actual macOS application, version 25.x Electron 39.2.7. Vulnerability Type: Electron Run As Node Description ELECTRON RUN AS NODE fuse enabled Electron 39.2.7 — app can be converted to Node.js REPL for arbitrary code execution Impact ...

PT-2026-47599

Name of the Vulnerable Software and Affected Versions Actual versions prior to 26.5.0 Description In the macOS desktop application, the ELECTRON RUN AS NODE fuse is not disabled. This allows an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app...

CVE-2026-28954

A file quarantine bypass was addressed with additional checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A maliciously crafted disk image may bypass Gatekeeper checks...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via improper handling of file paths in the Bucket reconciliation process and the sparse-checkout feature for GitRepository resources. An attacker can write files outside the intended working directory or enumerat...

gatekeeper_wan_poc_server

This is the...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: k8ssandra-client, trivy, docker, helm, k3s, dagger, ctop, datadog-agent, trivy-operator, rancher-agent, docker-compose, tigera-operator, gatekeeper, teleport, helm-push, helm-set-status, rancher-helm, kubescape-operator, scorecard, syft, zarf, grype, falco-no-driver,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: k8ssandra-client, trivy, docker, helm, k3s, dagger, ctop, datadog-agent, trivy-operator, rancher-agent, docker-compose, tigera-operator, gatekeeper, teleport, helm-push, helm-set-status, rancher-helm, kubescape-operator, scorecard, syft, zarf, grype, falco-no-driver,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: syft-fips, google-osconfig-agent, jfrog-cli, kargo, k8ssandra-client, helm, headlamp, syft, packer-fips, osv-scanner, steampipe, opa-fips-envoy, gatekeeper, neuvector-fips, eksctl, neuvector-scanner-fips, cluster-api-helm-controller, consul-k8s, grype-fips, zot,...

CVE-2026-28914

A logic issue was addressed with improved file handling. This issue is fixed in macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks...

vulnerabilities found in Apple MacOS

Apple has addressed several vulnerabilities in various versions of macOS including Sequoia, Sonoma, and Tahoe versions. These vulnerabilities involve memory management issues such as buffer overflows, use-after-free errors, out-of-bounds reads and writes, and integer overflows. These...

BIT-ARGO-WORKFLOWS-2026-42183 Argo Workflows: SSO RBAC Delegation Nil Pointer Dereference DoS (gatekeeper.go)

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, a nil pointer dereference in server/auth/gatekeeper.go rbacAuthorization causes a panic denial of service for SSO users whose claims match a...