CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: packer-fips, apko-fips, wolfictl, gitsign, kaniko-fips, src-fingerprint-fips, witness, external-secrets-operator, kyverno-fips, gitea, terragrunt-fips, kubescape, mapotf-fips, trivy-operator, grype-fips, gitlab-runner, grype-db, gitlab-runner-fips, nemo, flux-fips,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: frp, flux, rancher-agent, cert-manager-cmctl, percona-server-mongodb-operator, flux-source-controller, openbao, telegraf, terraform, opentofu, cert-manager, xeol, rancher-webhook, trufflehog, grafana, kyverno, seaweedfs, nuclei, rancher, yunikorn-k8shim,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: frp, flux, rancher-agent, cert-manager-cmctl, percona-server-mongodb-operator, flux-source-controller, openbao, telegraf, terraform, opentofu, cert-manager, xeol, rancher-webhook, trufflehog, grafana, kyverno, seaweedfs, nuclei, rancher, yunikorn-k8shim,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: versitygw, terraform-fips, openbao-fips, cert-manager-cmctl, packer-fips, external-secrets-operator, kyverno-fips, gitea, spqr, harbor-fips, cert-manager-google-cas-issuer-fips, gitlab-runner, kyverno-notation-aws, terraform, seaweedfs, gitlab-runner-fips,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: versitygw, terraform-fips, openbao-fips, cert-manager-cmctl, packer-fips, external-secrets-operator, kyverno-fips, gitea, spqr, harbor-fips, cert-manager-google-cas-issuer-fips, gitlab-runner, kyverno-notation-aws, terraform, seaweedfs, gitlab-runner-fips,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane, vcluster, nfpm, flux-kustomize-controller, q, crossplane-provider-aws-cloudfront, wal-g, witness, terragrunt, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-memorydb, kots, crossplane-provider-aws-s3, xeol, cerbos,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane, vcluster, nfpm, flux-kustomize-controller, q, crossplane-provider-aws-cloudfront, wal-g, witness, terragrunt, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-memorydb, kots, crossplane-provider-aws-s3, xeol, cerbos,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: terraform-fips, crossplane-provider-family-azure, openbao-fips, cert-manager-cmctl, packer-fips, apko-fips, crossplane-provider-aws-dynamodb-fips, policy-controller, buildkitd, hydra, hydra-fips, tekton-pipelines-fips, crossplane-provider-aws-lambda-fips, wolfictl,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: step-issuer, step-ca, temporal-server, jitsucom-bulker, mattermost, flux-kustomize-controller, juicefs, kyverno-policy-reporter, openfga, sftpgo, croc, ksops, openbao, telegraf, amass, witness, terragrunt, splunk-otel-collector, kots, crossplane-provider-sql, cerbos,...

How Security Tool Misuse Is Reshaping Cloud Compromise

Key Takeaways Legitimate secret-scanning tools such as TruffleHog have been operationalized in real-world cloud attack campaigns. Attack progression commonly follows a repeatable sequence: credential discovery, live validation, permission enumeration, and data access. Exposed long-lived access ke...

CVE-2026-26958 vulnerabilities

Vulnerabilities for packages: step-issuer, step-ca, temporal-server, jitsucom-bulker, mattermost, flux-kustomize-controller, juicefs, kyverno-policy-reporter, openfga, sftpgo, croc, ksops, openbao, telegraf, amass, witness, terragrunt, splunk-otel-collector, kots, crossplane-provider-sql, cerbos,...

CVE-2026-26958 vulnerabilities

Vulnerabilities for packages: sqlexporter, apko-fips, loki, nri-mysql, hydra, hydra-fips, juicefs, rekor-fips, wolfictl, kine, gitsign, witness, kyverno-fips, gitea, spire-server-fips, terragrunt-fips, reports-server, db-operator, rke2-runtime, seaweedfs, temporal-server, elastic-agent, telegraf,...

TruffleHog, Fade In and BSAFE Crypto-C vulnerabilities

Cisco Talos' Vulnerability Discovery & Research team recently disclosed three vulnerabilities in Dell BSAFE, two in Fade In screenwriting software, and one in Trufflehog. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco 's...

SUSE CVE-2025-41390

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability...

CVE-2025-41390

A flaw was found in the git functionality of TruffleHog. Scanning a specially crafted git repository copied file-for-file, such as via tar, cp, rsync or other tools, with a malicious core.fsmonitor configuration option specified in the .git/config file can cause arbitrary code execution. Mitigati...

EUVD-2025-35053

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability...

CVE-2025-41390

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the core.fsmonitor configuration option in the .git/config file. An attacker can execute arbitrary code by convincing a user or tool to scan a specially crafted repository that contains a malicious...

CVE-2025-41390

CVE-2025-41390 concerns an arbitrary code execution in TruffleHog 3.90.2 through the Git core.fsmonitor handling. A specially crafted repository (e.g., copied file-for-file via tar/cp/rsync) can trigger execution when Git operations are invoked by tooling, due to a malicious core.fsmonitor value ...

CVE-2025-41390

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A specially crafted repository can lead to a arbitrary code execution. An attacker can provide a malicious respository to trigger this vulnerability...