MAL-2025-16534 Malicious code in caravan-harbor-jcj085-project (npm)

The package caravan-harbor-jcj085-project was found to contain malicious code...

MAL-2025-20535 Malicious code in file-alb-um-zip-new-mp3-35841-harbor-lights-hzhvw-aeyuch (npm)

The package file-alb-um-zip-new-mp3-35841-harbor-lights-hzhvw-aeyuch was found to contain malicious code...

MAL-2025-22196 Malicious code in harbor-chime-mpr471-project (npm)

The package harbor-chime-mpr471-project was found to contain malicious code...

MAL-2025-22206 Malicious code in harbor-rainbow-s7vp (npm)

The package harbor-rainbow-s7vp was found to contain malicious code...

MAL-2025-38814 Malicious code in waterfall-harbor-xkl008-project (npm)

The package waterfall-harbor-xkl008-project was found to contain malicious code...

MAL-2025-22209 Malicious code in harbor-tornado-gaq963-project (npm)

The package harbor-tornado-gaq963-project was found to contain malicious code...

MAL-2025-22203 Malicious code in harbor-maple-jwaq (npm)

The package harbor-maple-jwaq was found to contain malicious code...

MAL-2025-22200 Malicious code in harbor-india-eqi7 (npm)

The package harbor-india-eqi7 was found to contain malicious code...

MAL-2025-22205 Malicious code in harbor-prairie-kta125-project (npm)

The package harbor-prairie-kta125-project was found to contain malicious code...

SUSE CVE-2025-30086

CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter...

SUSE CVE-2025-32019

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed ...

GO-2025-3825 Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor

Harbor repository description page has Cross-site Scripting vulnerability in github.com/goharbor/harbor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GO-2025-3826 Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor

Possible ORM Leak Vulnerability in the Harbor in github.com/goharbor/harbor. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

BIT-HARBOR-2025-32019 Harbor's repository description page allows for XSS

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0 and 2.13.0, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed in...

CVE-2025-30086

CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter...

CVE-2025-32019

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed ...

CVE-2025-30086

CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leak users' password hash and salt values. The q URL parameter allows a user to filter users by any column, and filter...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...