BIT-NGINX-INGRESS-CONTROLLER-2025-24513 ingress-nginx controller - auth secret file path traversal vulnerability

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or...

BIT-NGINX-INGRESS-CONTROLLER-2025-24514 ingress-nginx controller - configuration injection via unsanitized auth-url annotation

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

CVE-2025-29311

Limited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are able to leverage this vulnerability into creating crafted LLDP packets...

Multiple vulnerabilities in Ingress NGINX Controller for Kubernetes

On March 24, 2025, Kubernetes disclosed 5 new vulnerabilities affecting the Ingress NGINX Controller for Kubernetes. Successful exploitation could allow attackers access to all secrets stored across all namespaces in the Kubernetes cluster, which could result in cluster takeover. CVE-2025-1974 9....

Multiple vulnerabilities in Ingress NGINX Controller for Kubernetes

On March 24, 2025, Kubernetes disclosed 5 new vulnerabilities affecting the Ingress NGINX Controller for Kubernetes. Successful exploitation could allow attackers access to all secrets stored across all namespaces in the Kubernetes cluster, which could result in cluster takeover. CVE-2025-1974 9....

CVE-2025-1097

A flaw was found in ingress-nginx https://github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This issue can lead to arbitrary code execution in the context of the ingress-nginx controller and disclosure of Secrets...

Malicious code in cln-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56b9cc716f2f19131b4daf97b6c72c4b58b5b71d337760dc41188971098e4fb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2693 Malicious code in node-clog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b79afa3c5e7683904826177bb23fa862588f63570cd13fdb1aeda910d3c5ec81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2643 Malicious code in adjksc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a36618278e7c8e1a27990dd6b85d8e183adad107bb6190beec5635aadd61451 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2654 Malicious code in cdn-icon-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c5df12b33f292879e5c1199fb8a0130cbbb1a1cd4cf1d3e72cb723143ccaa1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2685 Malicious code in magpie-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4776d07e83074f4b9eb4c3b26583b7a99bc123558f5d6154e653ac27c5506017 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2718 Malicious code in vue-official-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54297a016228c62dcc04040f8aaf8e680d35a868040c66105b3418e472d4fd67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2669 Malicious code in erp.srm.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aefe5aebf241305b56cc8d9dfa7db5b5ac822991c482e9e6e0890d6475e2240c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2706 Malicious code in sf-intl-sn-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb4cc33212e001bc0af0440f49eb0c52cdc0ad223eba555c5cb2afaa9931e5c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in create-sensort-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da1473448f21d07682398de668daf47a21453a0c884d94a67902afec6616de29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2705 Malicious code in sensort-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da08217a79ac25925bb75373056d29208390b88fa6a4e75d27f6c5889b5a4943 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in elm-lang-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d5eb3c2ea771ad8d786241ffd33fd3345d71c3a00d5aa6a053d81034de8ebd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ofjaaah-dependency-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69d28e1655217e54d687a03a3c6b7d2f1bf2e5098277d42ab0072f39885269bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2630 Malicious code in @ofjaaah/jose2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebd3f76646b8605352a4f16ce597be1bc5465c4fe3856d9a333b5975d8a0f4a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2723 Malicious code in xablaublaubleu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 517f9db9c7e3148af0c2eb9436c27e04be309af39f1cec5b099c2d51fc4d119d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...