GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: bazelisk, steampipe, flux-kustomize-controller, nri-couchbase, helm-operator, spire-server, dbmate, rancher-fleet, configmap-reload, k6, kubernetes-csi-node-driver-registrar, src, docker-machine-driver-linode, local-static-provisioner, direnv,...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: sbomqs, cadvisor, steampipe, gitlab-runner, cluster-api, gatekeeper, whereabouts, grafana-agent-operator, keda, mattermost, flux-kustomize-controller, kubernetes-replicator, rclone, aws-signer-notation-plugin, argo-workflows, nova, gostatsd, rancher-agent,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: bazelisk, steampipe, flux-kustomize-controller, nri-couchbase, helm-operator, spire-server, dbmate, rancher-fleet, configmap-reload, k6, kubernetes-csi-node-driver-registrar, src, docker-machine-driver-linode, local-static-provisioner, oauth2-proxy, pguser, direnv,...

GO-2025-3660 vulnerabilities

Vulnerabilities for packages: dapr, trivy-fips, kyverno-notation-aws-fips, cosign, spire-server-fips, conftest-fips, cosign-fips, spire-server, kyverno-fips, kyverno-notation-aws, witness, policy-controller-fips, kyverno, conftest, policy-controller, trivy, dapr-fips, kots, tfsec...

GO-2024-2920 vulnerabilities

Vulnerabilities for packages: guac, dagger, melange, zot...

GO-2026-5547 vulnerabilities

Vulnerabilities for packages: zot, docker-cli-buildx, gitlab-runner, neuvector-sigstore-interface, gh, tekton-chains, ko, teleport, tkn, docker-compose, policy-controller, gitsign, aactl, bom, slsa-verifier, spire-server, trivy, kyverno-notation-aws, tflint, crossplane, zarf, kyverno, rekor,...

CVE-2026-18353

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

EUVD-2026-51066

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-18353 Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass

PIA's POST /v1/upload/sbom endpoint accepts a Bearer JWT and checks its unverified iss claim against an issuer allowlist using Python's urlparse before performing OIDC discovery with requests. Because urlparse and requests/urllib3 parse an authority string containing a backslash e.g...

CVE-2026-14336

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...

EUVD-2026-41259

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...

CVE-2026-14336

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check issuer.startswith' https://ci.eclipse.org ' in isissuerknown, pia/models.py:139 instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://[email protected]...

PT-2026-54948

Name of the Vulnerable Software and Affected Versions PIA affected versions not specified Description The OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check instead of validating the issuer as a properly host-bounded URL. This allows an attacker to bypass the check using a...

PT-2026-48812

Name of the Vulnerable Software and Affected Versions DevGuard versions prior to 1.4.2 Description On API instances with public assets, any authenticated user can perform unauthorized write operations, regardless of their organization, project, or asset membership. This allows attackers to create...

openSUSE 16 Security Update : syft (openSUSE-SU-2026:20928-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20928-1 advisory. Changes in syft: - Update to version 1.45.0: Added Features - Add support for ZapAddOns as jar files 4654 4932 @douglasclarke - MySQL binary classifier...

OPENSUSE-SU-2026:20928-1 Security update for syft

This update for syft fixes the following issues: Changes in syft: - Update to version 1.45.0: Added Features - Add support for ZapAddOns as jar files 4654 4932 @douglasclarke - MySQL binary classifier should distinguish between MySQL Cluster ndb and MySQL 3297 4907 @witchcraze - Catalog...

openSUSE 16 Security Update : build, product-composer (openSUSE-SU-2026:20676-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20676-1 advisory. Changes in build: - Support a new IgnoreRebuild config. - build-recipe-kiwi: Add support for oci containers Avoid needlessly compressing container image...

SUSE-SU-2026:21518-1 Security update for build, product-composer

This update for build, product-composer fixes the following issues: Changes in build: - Support a new "IgnoreRebuild" config. - build-recipe-kiwi: Add support for oci containers Avoid needlessly compressing container images Detect container images based on build result file name - Fix queryrecipe...

OPENSUSE-SU-2026:20676-1 Security update for build, product-composer

This update for build, product-composer fixes the following issues: Changes in build: - Support a new "IgnoreRebuild" config. - build-recipe-kiwi: Add support for oci containers Avoid needlessly compressing container images Detect container images based on build result file name - Fix queryrecipe...

GHSA-PJ97-4P9W-GX3Q Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Impact This vulnerability impacts users of zarf package inspect sbom or zarf package inspect documentation on untrusted packages. Patches 4793, now fixed in version v0.74.2 Workarounds Avoid inspecting unsigned packages Description The package inspect sbom and package inspect documentation...