MAL-2025-18224 Malicious code in delta-harbor-buw173-project (npm)

The package delta-harbor-buw173-project was found to contain malicious code...

MAL-2025-18311 Malicious code in desert-harbor-ayw835-project (npm)

The package desert-harbor-ayw835-project was found to contain malicious code...

MAL-2025-39112 Malicious code in whale-harbor-iwx983-project (npm)

The package whale-harbor-iwx983-project was found to contain malicious code...

MAL-2025-28452 Malicious code in orangutan-harbor-nbd505-project (npm)

The package orangutan-harbor-nbd505-project was found to contain malicious code...

MAL-2025-22192 Malicious code in harbor-aspen-dmp363-project (npm)

The package harbor-aspen-dmp363-project was found to contain malicious code...

MAL-2025-22199 Malicious code in harbor-grove-yvc860-project (npm)

The package harbor-grove-yvc860-project was found to contain malicious code...

MAL-2025-22191 Malicious code in harbor-apple-6ip0 (npm)

The package harbor-apple-6ip0 was found to contain malicious code...

MAL-2025-22194 Malicious code in harbor-bonfire-qwl670-project (npm)

The package harbor-bonfire-qwl670-project was found to contain malicious code...

MAL-2025-22203 Malicious code in harbor-maple-jwaq (npm)

The package harbor-maple-jwaq was found to contain malicious code...

SUSE CVE-2025-30086

CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter...

SUSE CVE-2025-32019

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed ...

GO-2025-3826 Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor

Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2025-3825 Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor

Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

BIT-HARBOR-2025-32019 Harbor's repository description page allows for XSS

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0 and 2.13.0, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in...

CVE-2025-30086

CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter...

CVE-2025-32019

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed ...

CVE-2025-30086

CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...