Practical Guidance For Securing Your Software Supply Chain

The heightened regulatory and legal pressure on software-producing organizations to secure their supply chains and ensure the integrity of their software should come as no surprise. In the last several years, the software supply chain has become an increasingly attractive target for attackers who...

Number withdrawn

ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. This CVE number has been withdrawn...

GHSA-H95X-26F3-88HR vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, kubeflow-pipelines-visualization-server...

GHSA-H95X-26F3-88HR vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2024-28397 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk, kubeflow-pipelines-visualization-server...

CVE-2024-28397 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

Important: Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Client tkn for 1.15.0 release

Red Hat OpenShift Pipelines Client tkn for 1.15.0 has been released. Red Hat OpenShift Pipelines Client, tkn for the 1.15.0 release, provides a CLI tool to interact with the Pipelines and Triggers components provided by Red Hat OpenShift Pipelines 1.15.0 The tkn CLI tool is delivered as an RPM...

Moderate: Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Operator Bundle 1.15.0 release

Red Hat OpenShift Pipelines 1.15.0 has been released. Red Hat OpenShift Pipelines is a cloud-native continuous integration and delivery CI/CD solution for building pipelines using Tekton. Tekton is a flexible, Kubernetes-native, open-source CI/CD framework which enables automating deployments...

CVE-2024-37890 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gemini-cli, kibana, argo-workflows, kubeflow-centraldashboard, arangodb, kubeflow-pipelines, opensearch-dashboards-fips...

GHSA-3H5V-Q93C-6H6Q vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, gemini-cli, kibana, argo-workflows, kubeflow-centraldashboard, arangodb, kubeflow-pipelines, opensearch-dashboards-fips...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: argo-events, sqlpad, rook, flyte, sops, secrets-store-csi-driver-provider-azure, kubescape, thanos, trivy, fluent-bit-plugin-loki, spire-server, step-ca, rclone, restic, chezmoi, velero, hugo, guac, tkn, harbor-registry, prometheus-operator, cosign, cortex,...

GHSA-753J-MPMX-QQ6G vulnerabilities

Vulnerabilities for packages: py3-tornado, kubeflow-pipelines-visualization-server, airflow, dask-gateway...

GHSA-HRW6-WG82-CM62 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3-jupyter-server...

CVE-2024-5206 vulnerabilities

Vulnerabilities for packages: py3-scikit-learn, kubeflow-katib, kubeflow-pipelines-visualization-server...

CVE-2024-35178 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3-jupyter-server...

CVE-2024-5629 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2024-5629 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server...

CVE-2024-34145

A sandbox bypass vulnerability was found in the Jenkins Script Security Plugin within the sandbox-defined classes, enabling the circumvention of security restrictions. This flaw allows authenticated attackers to define and execute sandboxed scripts, including Pipelines, bypassing sandbox protecti...

CVE-2024-34144

A sandbox bypass vulnerability was found in the Jenkins Script Security Plugin involving crafted constructor bodies, enabling the circumvention of security restrictions. With crafted constructor bodies, this flaw allows authenticated attackers to define and execute sandboxed scripts, including...

Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call ...