CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

ThinkPHP < 3.2.4 - Remote Code Execution

ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via the s parameter in index.php through the invokefunction functionality. id: CVE-2019-9082 info: name: ThinkPHP 3.2.4 - Remote Code Execution author: 0xanis severity: high description: |...

Node.JS System Information Library <5.3.1 - Remote Command Injection

Node.JS System Information Library System before version 5.3.1 is susceptible to remote command injection. Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. id: CVE-2021-21315 info: name: Node.JS System...

CVE-2026-19895

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

CVE-2026-19895 opensourcepos Open Source Point of Sale Login Endpoint Filters.php index excessive authentication

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

EUVD-2026-59760

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: nri-jmx, victoriametrics-cluster, sbom-convert, guac, trino, docker-credential-ecr-login, rancher-system-upgrade-controller, prometheus-operator, flux-notification-controller, verticadb-operator, kitty, runc, argo-rollouts, git-credential-oauth, otel-cli, influx, kap...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: tileserver-gl, jitsucom-jitsu...

GO-2024-2907 vulnerabilities

Vulnerabilities for packages: nuclei...

GO-2025-3604 vulnerabilities

Vulnerabilities for packages: mattermost-fips...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: argo-cd, trivy, dagger, packer, crossplane, gptscript, flux-kustomize-controller-fips, go-licenses, kaniko-fips, pulumi-kubernetes-operator, trivy-fips, pulumi-language-java, nuclei, kargo, argocd-image-updater, flux-kustomize-controller, wolfictl, argo-events-fips,...

GO-2026-5005 vulnerabilities

Vulnerabilities for packages: argo-cd, gatekeeper-fips, knative-kafka-broker, kubernetes-dashboard, vault-fips, cilium, kube-state-metrics, zitadel, kyverno-fips, knative-eventing-fips, commercial-grafana, cilium-cli, external-secrets-operator-fips, docker-cli-buildx-fips, frankenphp-8.5, flux,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: trivy, spire-server, policy-controller, ratify-fips, crossplane, policy-controller-fips, cloudbeat-fips, trivy-fips, tflint, falcoctl, kubescape-server, ko-fips, tkn-fips, chainctl, chainctl-fips, kyverno-policy-reporter-plugins-kyverno,...

GO-2026-4962 vulnerabilities

Vulnerabilities for packages: mattermost...

GO-2025-3565 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GO-2026-5029 vulnerabilities

Vulnerabilities for packages: hubble, fq, crossplane-provider-aws-elasticache, cilium, kubernetes, prometheus, karpenter, crossplane-provider-azure-storage, hydra, prometheus-operator, kubernetes-dashboard, crossplane-provider-azure-authorization, opentelemetry-collector, kine, zot,...

GO-2024-2456 vulnerabilities

Vulnerabilities for packages: go-licenses, gitness, bom, goreleaser, nuclei, gitsign, pulumi-kubernetes-operator, src-fingerprint, scorecard...

GO-2026-5668 vulnerabilities

Vulnerabilities for packages: rancher-agent, envoy-gateway, buildah, nuclei, aws-otel-collector, rancher, trivy-operator, grafana, datadog-agent, k8sgpt, rancher-machine, skopeo, zot, opentelemetry-operator, podman, undock, trivy, nerdctl, portieris, docker-credential-gcr, osv-scanner,...

GO-2026-5336 vulnerabilities

Vulnerabilities for packages: goreleaser, syft, tfsec, nuclei, argo-workflows, crossplane, grafana-alloy, steampipe, trivy-operator, grype, guac, pulumi-language-java, gitlab-runner, terragrunt, trufflehog, zarf, wolfictl, k9s, dagger, cerbos, kubescape, teleport, pulumi-language-yaml, argo-event...

CLEANSTART-2026-YY19713 Security fixes in keycloak 26.7.0-r1

Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...