CVE-2026-24131 pnpm has Path Traversal via arbitrary file permission modification

pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's directories.bin field, it uses path.join without validating the result stays within the package root. A malicious npm package can specify "directories": "bin": "../../../../tmp" to escape the package directory,...

CVE-2025-9820

A flaw was found in the GnuTLS library, specifically in the gnutlspkcs11tokeninit function that handles PKCS11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the applicatio...

GHSA-WV3H-X6C4-R867 vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips...

CVE-2026-23960 vulnerabilities

Vulnerabilities for packages: argo-workflows, argo-workflows-fips, kubeflow-pipelines...

CVE-2025-69204 vulnerabilities

Vulnerabilities for packages: imagemagick...

pnpm security vulnerabilities

PNPM is a package manager developed by the open-source project Pnpm. Versions of Pnpm prior to 10.28.2 had security vulnerabilities. These vulnerabilities stemmed from the lack of path validation when processing the directories.bin field of packages. This allowed malicious npm packages to modify...

CVE-2026-24049 vulnerabilities

Vulnerabilities for packages: aws-cli, pypy-3.11, dask-kubernetes, open-webui, mlflow, py3-setuptools, datadog-agent, airflow, kserve, emissary, kubeflow-katib, kubeflow-jupyter-web-app, pip-zipapp, pypy-3.10, superset, py3-virtualenv, semgrep...

GHSA-8RRH-RW8J-W5FX vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, py3-virtualenv, text-generation-inference, nemo, dask-kubernetes, spamcheck, datadog-agent, ansible-operator-fips, opal, request-1276, azure-functions-python-worker, pypy-3.10, airflow, emissary, authentik-fips, apache-beam-python-3.11-sdk,...

CVE-2025-67221 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, litellm, kserve, emissary, datadog-agent, authentik-fips, authentik...

GHSA-HX9Q-6W63-J58V vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, litellm, kserve, emissary, datadog-agent, authentik-fips, authentik...

CVE-2026-0528 vulnerabilities

Vulnerabilities for packages: cloudbeat, cloudbeat-fips, beats, apm-server, apm-server-fips...

GHSA-5RFX-CP42-P624 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-2838-84RJ-32XC vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-azure, linux-gcp, linux-qemu...

CVE-2025-38248 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-azure, linux-gcp, linux-qemu...

CVE-2025-39775 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-azure, linux-gcp, linux-qemu...

CVE-2025-38237 vulnerabilities

Vulnerabilities for packages: linux-vmware, linux-aws, linux-azure, linux-gcp, linux-qemu...

GHSA-5RFX-CP42-P624 vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips...

GHSA-3QMM-R55X-HPXX vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2025-68675 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2025-3839

A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...