CLEANSTART-2026-NV36169 Security fixes for CVE-2025-61732, CVE-2025-66564, CVE-2025-68121, CVE-2026-24686, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, ghsa-fcv2-xgw5-pqxf applied in versions: 0.7.29-r1, 0.7.29-r2

Multiple security vulnerabilities affect the sigstore-scaffolding package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-dynamodb, mesosphere-vsphere-csi, snyk-cli, cloudprober, kpt, kubernetes-csi-driver-hostpath, helm, kubo, restic, buildah, crossplane-provider-aws-kms, kube-state-metrics, dkron, gatekeeper, otel-cli, go, step-ca, kubernetes-dns-node-cache,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-dynamodb, mesosphere-vsphere-csi, snyk-cli, cloudprober, kpt, kubernetes-csi-driver-hostpath, helm, kubo, restic, buildah, crossplane-provider-aws-kms, kube-state-metrics, dkron, gatekeeper, otel-cli, go, step-ca, kubernetes-dns-node-cache,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-dynamodb, kpt, rabbitmq-default-user-credential-updater, crossplane-provider-aws-kms, kube-state-metrics, rancher-loglevel, gatekeeper, tailscale, kubernetes-dns-node-cache, tetragon, actions-runner-controller, ksops,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-dynamodb, kpt, rabbitmq-default-user-credential-updater, crossplane-provider-aws-kms, kube-state-metrics, rancher-loglevel, gatekeeper, tailscale, kubernetes-dns-node-cache, tetragon, actions-runner-controller, ksops,...

Backstage 日志信息泄露漏洞

Backstage is an open-source application developed by Backstage. It serves as an open platform for building developer portals. Versions of Backstage prior to 3.1.4 contained a vulnerability related to log information leakage. This vulnerability stemmed from malicious scaffolding templates that cou...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

EUVD-2024-2470

Malicious code in bioql PyPI...

EUVD-2024-35107

Malicious code in bioql PyPI...

Malicious code in test-mlw2-clour-heats-nards-scaff (npm)

The package test-mlw2-clour-heats-nards-scaff was found to contain malicious code...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: spire-server, py3-azure-identity, grafana-agent-operator, argo-events, rekor, bank-vaults, sops, restic, tkn, up, opentelemetry-collector, fluent-bit-plugin-loki, flux-source-controller, airflow, secrets-store-csi-driver-provider-azure, flux-image-reflector-controlle...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34913

The CVE-2024-34913 entry impacts r-pan-scaffolding versions 5.0 and older, where an arbitrary file upload vulnerability allows an attacker to execute arbitrary code by uploading a crafted PDF. The root cause is an improper handling of PDF uploads in the file-upload functionality, enabling code ex...

PT-2024-26246 · Unknown · R-Pan-Scaffolding

Name of the Vulnerable Software and Affected Versions: r-pan-scaffolding versions 5.0 and below Description: The issue allows attackers to execute arbitrary code via uploading a crafted PDF file. This is achieved through an arbitrary file upload vulnerability. Recommendations: For versions 5.0 an...

r-pan-scaffolding 安全漏洞

rubinchu r-pan-scaffolding is a simple file management system from rubinchu that implements file uploading, downloading, moving and other functions. A security vulnerability exists in r-pan-scaffolding v5.0 and earlier versions. An attacker can execute arbitrary code by uploading a specially...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: frp, spire-server, rekor, bank-vaults, skopeo, wolfictl, sops, tkn, gitsign, flux-source-controller, apko, kots, policy-controller, temporal-ui-server, cosign, step-ca, rabbitmq-messaging-topology-operator, gomplate, k3s, zot, dgraph, melange, weaviate,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-resizer, rook, smarter-device-manager-fips, flux, atlantis, nfs-subdir-external-provisioner-fips, thanos-operator, crossplane-provider-azure-sql, configmap-reload-fips, grafana-operator, cass-operator-fips, kuberay-operator, terragrunt,...