CVE-2025-34074

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...

CVE-2025-49521

A flaw was found in the EDA component of the Ansible Automation Platform, where user-supplied Git branch or refspec values are evaluated as Jinja2 templates. This vulnerability allows authenticated users to inject expressions that execute commands or access sensitive files on the EDA worker. In...

CVE-2025-49520

A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift...

PT-2025-27476 · Unknown · Ansible Automation Platform

Name of the Vulnerable Software and Affected Versions: Ansible Automation Platform affected versions not specified Description: A flaw was found in Ansible Automation Platform's EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This issue allows an...

CVE-2025-6705

A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new...

BIT-CONTOUR-2024-36539

Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

BIT-CERT-MANAGER-2024-36537

Insecure permissions in cert-manager v1.14.4 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...

CVE-2025-6705

A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new...

CVE-2025-6705

A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new...

CVE-2025-6705

The CVE-2025-6705 vulnerability affects the Eclipse Open VSX Registry, specifically its automated publishing system. The issue stems from build scripts executing without proper isolation, potentially exposing a privileged token that could be used to publish new extension versions under any namesp...

CVE-2025-6705

A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions. Specifically, the system’s build scripts were executed without proper isolation, potentially exposing a privileged token. This token enabled the publishing of new...

Eclipse Open VSX 安全漏洞

Eclipse Open VSX is an open source registry of code extensions for Eclipse Open Source. A security vulnerability exists in Eclipse Open VSX that stems from a lack of sandboxing restrictions for CI jobs, which could lead to a service account takeover...

PT-2025-27234 · Unknown · Open-Vsx.Org

Name of the Vulnerable Software and Affected Versions: open-vsx.org affected versions not specified Description: The issue allowed an attacker to run arbitrary build scripts for auto-published extensions due to missing sandboxing of CI job runs. An attacker with access to an existing extension...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials for the Service Account. An attacker could use the Service Account as a backdoor to the system using the leaked credentials. Remediation Upgrade openc3 to version 6.0.2 or higher. References - GitHub Commit...

PYSEC-2025-258

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-28388

CVE-2025-28388 affects OpenC3 COSMOS prior to v6.0.2, where hardcoded credentials for the Service Account are disclosed. The vulnerability enables potential unauthorized access with high impact as indicated by the CVSS metrics (CRITICAL, 9.8; network attack; no privileges required; user interacti...