GO-2025-3665 Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget

Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget...

CVE-2025-4374 Quay: incorrect privilege assignment

A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository...

PT-2025-19956 · Quay · Quay

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: A flaw was found in Quay where an organization acting as a proxy cache grants "Admin" permissions on a newly created repository when a user or robot pulls an image that hasn't been mirrored ye...

GO-2025-3649 Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet

Fleet doesn’t validate a server’s certificate when connecting through SSH in github.com/rancher/fleet...

GO-2025-3648 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev

Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle MitM attacks in github.com/rancher/stev. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2025-3647 Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher

Rancher users who can create Projects can gain access to arbitrary projects in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

CVE-2022-42118

creationtimestamp| type| source ---|---|--- 2025-05-03 16:34:09+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-42118.yaml 2025-05-05 21:02:24+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lohbckkmji2n...

GitHub: Arbitrary Read of Another Users private repository without Authorization

An improper access control vulnerability was identified in GitHub Enterprise Server that allowed users with access to any repository to retrieve limited code content from another repository by creating a diff between the repositories. This vulnerability affected all versions of GitHub Enterprise...

CVE-2022-26585

creationtimestamp| type| source ---|---|--- 2025-05-01 11:20:11+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2022/CVE-2022-26585.yaml 2025-05-02 21:02:23+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lo7pvr3vs726...

CVE-2025-46554

creationtimestamp| type| source ---|---|--- 2025-04-30 19:13:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14130 2025-04-30 22:06:03+00:00| seen| https://t.me/cvedetector/24135 2025-08-28 13:39:35+00:00| confirmed|...

The vulnerability of the EQUELLA repository in the virtual learning environment Moodle, which allows a perpetrator to execute arbitrary code.

The vulnerability of the EQUELLA repository in the virtual learning environment Moodle is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of Dropbox’s repository in the virtual learning environment Moodle allows a perpetrator to execute arbitrary code.

The vulnerability of Dropbox’s virtual learning environment Moodle is related to improper code generation management. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Remote Code Execution (RCE)

moodle/moodle is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper access control in the Moodle LMS Dropbox repository, allows teachers and managers, by default, to have access to the affected functionality, creating an opportunity for remote code execution...

Security Bulletin: IBM Security Verify Information Queue displays the Grafana signing key when setting up the logs stack (CVE-2021-20412)

Summary IBM Security Verify Information Queue ISIQ offers an optional logs stack to demonstrate logging and monitoring. Among the stack's components is a Grafana dashboard. The initialization file for Grafana contains a hard-coded signing key. As of ISIQ v10.0.0, this signing key has been removed...

Security Bulletin: IBM Security Verify Information Queue does not sufficiently safeguard session IDs from session fixation attacks (CVE-2021-20411)

Summary The web server in IBM Security Verify Information Queue ISIQ does not always update the session identifier when a new user logs in. This could allow a session fixation attack in which a previously used session identifier gets commandeered by an impersonator. As of v10.0.0, ISIQ now...

CVE-2025-3986 Apereo CAS CasConfigurationMetadataServerController.java redos

A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The...

CVE-2025-3509

A Remote Code Execution RCE vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-receive hook functionality, potentially leading to privilege escalation and system compromise. The vulnerability involves using dynamically...

Arbitrary Code Injection

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Arbitrary Code Injection via the Moodle LMS Dropbox repository. An attacker can execute arbitrary code by exploiting insufficient input validation and code sanitization mechanisms. Note: This is onl...

Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By default, this was only available to teachers and managers on sites with the Dropbox repository enabled...

Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled...