1389 matches found
EUVD-2026-78587
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...
CVE-2026-54167
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...
CVE-2026-54168
Pipelines-as-Code (Tekton) is a CI/CD system for defining Tekton pipelines in source code repositories. In versions prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0 , a GitHub App installation token issued during webhook processing is not scoped to the triggering repository when the App is installed a...
EUVD-2026-78586
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
CVE-2026-54168
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
CVE-2026-54168 Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
CVE-2026-54167: Insufficient Verification of Data Authenticity
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API host while processing webhook events containing an installation.id, before...
CVE-2026-54168: Improper Privilege Management
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is not scoped to the repository that triggered the event when the App is installe...
hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines
A flaw was found in Hugo. When building a Hugo site that uses Node-based asset pipelines such as PostCSS, Babel, or TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. This could allow code running through these tools to read or write files outside the...
CVE-2026-54745
A flaw was found in Kubeflow Pipelines. An unauthenticated attacker can exploit a Server-Side Request Forgery SSRF and HTTP smuggling vulnerability through the /proxy/ route. This allows the attacker to bypass authorization and forward arbitrary requests to internal services. Consequently, this c...
GHSA-8423-8FGW-73VQ vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, mitmproxy, dask-kubernetes, kubeflow-pipelines-visualization-server, litellm...
CVE-2026-82397 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, mitmproxy, dask-kubernetes, kubeflow-pipelines-visualization-server, litellm...
GHSA-MPF4-983Q-P7J4 vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, mitmproxy, dask-kubernetes, kubeflow-pipelines-visualization-server, litellm...
GHSA-WWV5-G3V4-889X vulnerabilities
Vulnerabilities for packages: tensorflow-gpu-jupyter, mitmproxy, dask-kubernetes, kubeflow-pipelines-visualization-server, litellm...
GHSA-CV2G-M8RR-888C vulnerabilities
Vulnerabilities for packages: apache-beam-python-3.11-sdk, apache-beam-python-3.12-sdk, py3-nltk, nemo, open-webui, kubeflow-pipelines-visualization-server, label-studio, apache-beam-python-3.13-sdk...
GHSA-WWV5-G3V4-889X vulnerabilities
Vulnerabilities for packages: mitmproxy, kubeflow-pipelines-visualization-server, dask-kubernetes...