Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the Terraformer process. An attacker can execute arbitrary code with elevated privileges by injecting malicious Terraform configurations during infrastructure provisioning. Note: This is only exploitable if ...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the Terraformer process. An attacker can execute arbitrary code with elevated privileges by injecting malicious Terraform configurations during infrastructure provisioning. Note: This is only exploitable if ...

GHSA-R3JV-XFGX-GJ24 cors-anywhere vulnerable to server-side request forgery

Rob -- W / cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets SSRF. Because the proxy forwards requests and headers, an attacker can reach internal-only endpoints and link-local metadata services...

CVE-2025-59823 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP...

CVE-2025-59823 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP...

Insufficient Session Expiration

github.com/coder/coder/v2 is vulnerable to Insufficient Session Expiration. The vulnerability is due to session expiration bypass due to Coder allowing a web session to remain active when the OpenID Connect provider does not return a refresh token, so the session can continue past the IdP-issued...

CVE-2025-10360

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled t...

CVE-2025-10360 Insufficiently Protected Credentials in Puppet Enterprise 2025.4 and 2025.5

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled t...

CVE-2025-10360

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled t...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: azure-service-operator, nri-haproxy, tempo, dgraph, witness, ip-masq-agent, cluster-api, nri-redis, libnvidia-container, rabbitmq-messaging-topology-operator, kubecolor, chartmuseum, nats-server-config-reloader, aws-eks-pod-identity-agent, undock, kube-bench, caddy,...

PT-2025-39287

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2025.4.0 through 2025.5 Description The encryption key for the Infra Assistant database was not excluded from Puppet backups in Puppet Enterprise. This key is only present if a Puppet Enterprise Advanced license is...

CVE-2025-10184

CVE-2025-10184 (OnePlus OxygenOS Telephony provider permission bypass) affects OnePlus OxygenOS on multiple devices, via three content providers: com.android.providers.telephony.PushMessageProvider, PushShopProvider and ServiceNumberProvider. Root cause: missing write permissions on these provide...

CVE-2025-10184 OnePlus OxygenOS Telephony provider permission bypass

The vulnerability allows any application installed on the device to read SMS/MMS data and metadata from the system-provided Telephony provider without permission, user interaction, or consent. The user is also not notified that SMS data is being accessed. This could lead to sensitive information...

CVE-2025-10184: OnePlus OxygenOS Telephony provider permission bypass (FIXED as of October 11, 2025)

Overview Rapid7 has identified a permission bypass vulnerability in multiple versions of OnePlus OxygenOS installed on its Android smartphones, across multiple devices. It is expected that a wider range of devices than those tested are affected. When leveraged, the vulnerability allows any...

Unmasking Hidden Threats: Spotting a DPRK IT-Worker Campaign

Unmasking Hidden Threats: Spotting a DPRK IT-Worker Campaign By Duy-Phuc Pham and John Fokker · September 23, 2025 In today's complex threat landscape, staying ahead of sophisticated adversaries is paramount. Organizations face constant pressure to identify threats that do not always involve...

PT-2025-39169

Name of the Vulnerable Software and Affected Versions OnePlus OxygenOS versions 12 through 15 Description A critical security issue exists in OnePlus devices running OxygenOS 12 through 15. This flaw allows any installed application to read SMS/MMS data and metadata from the system Telephony...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: php-fpmexporter, vault-benchmark, gostatsd, kube-vip, cloud-provider-aws, grafana-operator, octo-sts, mongodb-kubernetes-operator, vault-k8s, lvm-driver, container-object-storage-interface, pvc-autoresizer, git-lfs, linkerd2-proxy-init, nats, vexctl, ctop,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: php-fpmexporter, vault-benchmark, gostatsd, kube-vip, cloud-provider-aws, grafana-operator, octo-sts, mongodb-kubernetes-operator, vault-k8s, lvm-driver, container-object-storage-interface, pvc-autoresizer, git-lfs, linkerd2-proxy-init, nats, vexctl, ctop,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: shfmt, gitsign, k8sgpt-operator, cluster-api, stakater-reloader, memcached-exporter-fips, kserve-rest-proxy, node-problem-detector-fips, kubeflow-katib, local-path-provisioner, kube-vip-cloud-provider, blob-csi-fips, terraform-provider-tls-fips, bank-vaults,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: shfmt, gitsign, k8sgpt-operator, cluster-api, stakater-reloader, memcached-exporter-fips, kserve-rest-proxy, node-problem-detector-fips, kubeflow-katib, local-path-provisioner, kube-vip-cloud-provider, blob-csi-fips, terraform-provider-tls-fips, bank-vaults,...