GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: teleport, tekton-chains, spire-server, zarf, gitsign, falcoctl, tkn, kubescape, aactl, trivy-operator, kyverno-notation-aws, ko, kyverno, slsa-verifier, crossplane, ratify, goreleaser, neuvector-sigstore-interface, policy-controller, tflint...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: atlantis, age, nfpm, rootlesskit, pulumi-kubernetes-operator, external-secrets-operator, tkn, kubescape, crossplane-provider-azure-authorization, docker, gh, rancher-machine, syft, glab, ko, step, kine, datadog-agent, nerdctl, mattermost, buildkitd, docker-cli-buildx...

Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. Learn more Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting 32 maliciously modified packages across more than 90 versions under the @redhat-cloud-services npm scope. The...

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

In this article 1. Attack chain overview 1. Technical analysis 2. How GitHub took action to prevent further harm 2. Mitigation and protection guidance 1. Microsoft Defender XDR Detections 2. Microsoft Defender XDR Threat analytics 3. Advanced hunting 4. Indicators of Compromise IOC 3. References ...

Exploit for Embedded Malicious Code in Tanstack Tanstack\/Arktype-Adapter

TanStack Supply Chain Compromise - IOC Checker bash curl -...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: nats-fips, vendir, helm-fips, newrelic-fluent-bit-output-fips, image-factory, goreleaser, kubernetes-dashboard, opa-fips-envoy, policy-controller, kube-mgmt-fips, influxd, crossplane-fips, vault-fips, juicefs, kube-arangodb, istio-fips, commercial-expanso-edge,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: nats-fips, vendir, helm-fips, newrelic-fluent-bit-output-fips, image-factory, goreleaser, kubernetes-dashboard, opa-fips-envoy, policy-controller, kube-mgmt-fips, influxd, crossplane-fips, vault-fips, juicefs, kube-arangodb, istio-fips, commercial-expanso-edge,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: nats-fips, vendir, victoriametrics-operator-fips, helm-fips, terraform-provider-random-fips, nri-consul, aws-nuke-fips, kubebuilder, newrelic-fluent-bit-output-fips, gatus-fips, goreleaser, image-factory, kubernetes-dashboard, aws-eks-pod-identity-agent,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: helm-fips, nri-consul, protoc-gen-go-grpc, aws-eks-pod-identity-agent, terraform-provider-sendgrid, kyverno-policy-reporter-plugins-kyverno, nri-couchbase-fips, policy-controller, kube-mgmt-fips, sftpgo, k8s-driver-manager, crossplane-fips, juicefs,...

CVE-2026-22772 vulnerabilities

Vulnerabilities for packages: witness, falcoctl, sigstore-scaffolding, kots, slsa-verifier, vexctl, falco-no-driver, cosign, tekton-chains, kubescape, aactl, zarf, gitsign, skopeo...

GHSA-59JP-PJ84-45MR vulnerabilities

Vulnerabilities for packages: witness, falcoctl, sigstore-scaffolding, kots, slsa-verifier, vexctl, falco-no-driver, cosign, tekton-chains, kubescape, aactl, zarf, gitsign, skopeo...

CVE-2026-22772 vulnerabilities

Vulnerabilities for packages: image-factory, slsa-verifier, skopeo, falco-no-driver, vexctl, cosign, sigstore-scaffolding, kubescape, sigstore-scaffolding-fips, flux-source-controller-fips, kyverno-policy-reporter-plugins-kyverno-fips, zarf, chainctl, falcoctl-fips, kots, tekton-chains, kyverno,...

GHSA-3WHM-J4XM-RV8X vulnerabilities

Vulnerabilities for packages: addon-resizer, gobuster, crossplane-provider-aws-cloudformation, kind, gcsfuse, metrics-server, wazero, kpt, kubernetes-csi-livenessprobe, nvidia-container-toolkit, newrelic-fluent-bit-output, crossplane-provider-aws-rds, http-echo, kubescape, mc,...

GHSA-4F8R-QQR9-FQ8J vulnerabilities

Vulnerabilities for packages: melange, zot, rekor, tekton-chains, spire-server, zarf, gitsign, falcoctl, tkn, flux-source-controller, kubescape, aactl, gh, slsa-verifier, vexctl, trivy, wolfictl, sigstore-scaffolding, apko, cosign, neuvector-sigstore-interface, policy-controller...

CVE-2024-47534 vulnerabilities

Vulnerabilities for packages: melange, zot, rekor, tekton-chains, spire-server, zarf, gitsign, falcoctl, tkn, flux-source-controller, kubescape, aactl, gh, slsa-verifier, vexctl, trivy, wolfictl, sigstore-scaffolding, apko, cosign, neuvector-sigstore-interface, policy-controller...

CVE-2024-45395 vulnerabilities

Vulnerabilities for packages: gh, cosign, slsa-verifier...

CVE-2024-45395 vulnerabilities

Vulnerabilities for packages: slsa-verifier, gh, cosign-fips, cosign...

GHSA-CQ38-JH5F-37MQ vulnerabilities

Vulnerabilities for packages: gh, cosign, slsa-verifier...

GHSA-CQ38-JH5F-37MQ vulnerabilities

Vulnerabilities for packages: slsa-verifier, gh, cosign-fips, cosign...

GO-2023-2188 slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier...