GHSA-65R4-943X-97JJ vulnerabilities

Vulnerabilities for packages: opensearch, apache-tika, spdx-tools-java, nextflow...

CVE-2026-75140 vulnerabilities

Vulnerabilities for packages: opensearch, apache-tika, spdx-tools-java, nextflow...

CVE-2026-48722

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

EUVD-2026-78578

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722

Nextflow (a DSL for data-driven computational pipelines) contains an incorrect default permissions flaw (CWE-276) in the nextflow auth login command. The Seqera Platform OIDC bearer token is written to ${NXF_HOME:-~/.nextflow}/seqera-auth.config via Java NIO without setting restrictive file permi...

CVE-2026-48722

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722: Incorrect Default Permissions

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: commercial-elasticsearch, elasticsearch-fips, conductor, nextflow, jmeter, jbang, kayenta-fips, gradle, apache-tika-fips, copybara, elasticsearch, spdx-tools-java, wazuh-indexer, copybara-fips, conductor-fips, apache-hop-fips, scala, apache-tika, kayenta, opensearch,...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: commercial-elasticsearch, elasticsearch-fips, conductor, nextflow, jmeter, jbang, kayenta-fips, gradle, apache-tika-fips, copybara, elasticsearch, spdx-tools-java, wazuh-indexer, copybara-fips, conductor-fips, apache-hop-fips, scala, apache-tika, kayenta, opensearch,...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, opensearch, nextflow, apache-tika, gradle...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, opensearch, nextflow, apache-tika, gradle...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: zookeeper-fips, kserve-modelmesh, nextflow, nacos, ranger, dependency-track-apiserver, dependency-track, kafbat-ui-fips, cassandra-fips, kafbat-ui, zookeeper, hadoop-fips, airbyte-server, localstack, cassandra-reaper, nacos-docker, s3proxy, airbyte-server-fips,...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: zookeeper-fips, kserve-modelmesh, nextflow, nacos, ranger, dependency-track-apiserver, dependency-track, kafbat-ui-fips, cassandra-fips, kafbat-ui, zookeeper, hadoop-fips, airbyte-server, localstack, cassandra-reaper, nacos-docker, s3proxy, airbyte-server-fips,...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, akhq, sonar-scanner-cli, cassandra, kserve-modelmesh, nextflow, zookeeper, keycloak-config-cli, cassandra-reaper, dependency-track, trino, sonarqube...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, akhq, sonar-scanner-cli, cassandra, kserve-modelmesh, nextflow, zookeeper, keycloak-config-cli, cassandra-reaper, dependency-track, trino, sonarqube...

nextflow auth login command has incorrect default permissions

Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...

GHSA-92QF-FCPH-V5WR nextflow auth login command has incorrect default permissions

Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...