Exposure of Storage Secret in Pyroscope

Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: nfpm, pluto, postgres-operator, promxy, snyk-cli, octo-sts, kpt, prometheus-adapter, nats-server, opa, headlamp, skaffold, paranoia, kube-metrics-adapter, terraform-docs, gitness, nri-consul, rancher-helm, sops, nri-f5, nri-kafka, falco-no-driver, protoc-gen-go,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: nfpm, pluto, postgres-operator, promxy, snyk-cli, octo-sts, kpt, prometheus-adapter, nats-server, opa, headlamp, skaffold, paranoia, kube-metrics-adapter, terraform-docs, gitness, nri-consul, rancher-helm, sops, nri-f5, nri-kafka, falco-no-driver, protoc-gen-go,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: hydra-fips, pulumi-kubernetes-operator, amazon-cloudwatch-agent-fips, paranoia, cloudbeat-fips, tigera-operator-fips, k8sgateway-fips, etcd-fips, knative-operator-fips, configmap-reload-fips, bank-vaults-fips, contour-fips, kiali-fips, dex-fips, nfpm, net-kourier-fip...

CVE-2025-54576 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

GHSA-7RH7-C77V-6434 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

CVE-2025-54576 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

GHSA-7RH7-C77V-6434 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope...

Malware in pyroscope-nodejs

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in grafana-pyroscope

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5535 Malicious code in pyroscope-nodejs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f63660c0844969995da8de5a83535772031d00f3247e8cbb5a40addbc21a234 Any computer that has this package installed or running should be considered...

Malicious code in pyroscope-nodejs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f63660c0844969995da8de5a83535772031d00f3247e8cbb5a40addbc21a234 Any computer that has this package installed or running should be considered...

Malicious code in grafana-pyroscope (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60f047f0a854cfa17b3119b25caf2e1a95069686aa77470689c2cfb55cddf1e0 Any computer that has this package installed or running should be considered...

MAL-2025-5534 Malicious code in grafana-pyroscope (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60f047f0a854cfa17b3119b25caf2e1a95069686aa77470689c2cfb55cddf1e0 Any computer that has this package installed or running should be considered...

Malicious code in pyroscope-oss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78530d6378099081103c13a5d340a9c8562d2c041085a8c20893adb93bdd115d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-235 Malicious code in pyroscope-oss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78530d6378099081103c13a5d340a9c8562d2c041085a8c20893adb93bdd115d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...