PT-2026-39293

Name of the Vulnerable Software and Affected Versions bitcoinj versions prior to 0.17.1 Description The correctlySpends function in core/src/main/java/org/bitcoinj/script/ScriptExecution.java contains two fast-path verification bugs affecting standard P2PKH Pay-to-PubKey-Hash and native P2WPKH...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: ko, ratify, kyverno, trivy-operator, kubescape, kyverno-notation-aws, gh, goreleaser, tkn, sigstore-scaffolding, tekton-chains, buildkitd, cosign, crossplane, falcoctl, policy-controller, aactl, docker, neuvector-sigstore-interface, tflint, trivy, witness, zot, vexct...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: ko, ratify, kyverno, trivy-operator, kubescape, kyverno-notation-aws, gh, goreleaser, tkn, sigstore-scaffolding, tekton-chains, buildkitd, cosign, crossplane, falcoctl, policy-controller, aactl, docker, neuvector-sigstore-interface, tflint, trivy, witness, zot, vexct...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: istio, dask-gateway, argo-cd, gomplate-fips, kubescape, consul-fips, tigera-operator-fips, azuredisk-csi-fips, commercial-grafana, external-secrets-operator, knative-operator, filebrowser, kyverno-fips, newrelic-infrastructure-agent, helm-exporter, mailpit-fips, atla...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: istio, dask-gateway, argo-cd, gomplate-fips, kubescape, consul-fips, tigera-operator-fips, azuredisk-csi-fips, commercial-grafana, external-secrets-operator, knative-operator, filebrowser, kyverno-fips, newrelic-infrastructure-agent, helm-exporter, mailpit-fips, atla...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: flyte, sftpgo-plugin-pubsub, harbor-registry, jaeger, step-issuer, verticadb-operator, kwok, kuberay-operator, ko, newrelic-infrastructure-agent, ratify, crossplane-provider-azure-storage, azure-service-operator, prometheus, headlamp, goreleaser, vcluster, snyk-cli,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: istio, aws-otel-collector-fips, teleport-operator-fips, argo-cd, crossplane-provider-azure-servicenetworking, containerd, kaniko, gomplate-fips, k6-operator, kubescape, consul-fips, azuredisk-csi-fips, commercial-grafana, fluent-operator, temporal-server-fips,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: istio, aws-otel-collector-fips, teleport-operator-fips, argo-cd, crossplane-provider-azure-servicenetworking, containerd, kaniko, gomplate-fips, k6-operator, kubescape, consul-fips, azuredisk-csi-fips, commercial-grafana, fluent-operator, temporal-server-fips,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: loki, lazygit, ollama, rclone, opentelemetry-collector, prometheus, goreleaser, vcluster, datadog-agent, nuclei, weaviate, redpanda, eksctl, malcontent, nfpm, tempo, dagger, terragrunt, gitlab-runner, cri-tools, witness, mcp-grafana, dgraph, k3s, grafana, teleport,...

CVE-2026-20801

Cleartext Transmission of Sensitive Information CWE-319 in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged users with local network access to view live video streams. This issue affects all versions of Gallagher NxWitness VMS integration...

lunarbase-pmm-math (>=0.1.0, <=0.2.6), semaphore-rs-ark-circom (>=0.3.0, <=0.5.1) +3 more potentially affected by unknown CVE via ruint (>=1.13.1, <=1.16.0)

ruint CARGO version =1.13.1, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: GHSA-9FJQ-45QV-PCM7...

lunarbase-pmm-math (>=0.1.0, <=0.2.6), semaphore-rs-ark-circom (>=0.3.0, <=0.5.1) +3 more potentially affected by unknown CVE via ruint (>=1.13.1, <=1.16.0)

ruint CARGO version =1.13.1, =0.1.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =0.5.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0137...

Improper Certificate Validation

github.com/in-toto/go-witness is vulnerable to Improper Certificate Validation. The vulnerability is due to the AWS attestor accepting EC2 instance identity documents without properly validating signatures and relying on outdated public certificates, which allows an attacker to supply or intercep...

PT-2025-45003

Name of the Vulnerable Software and Affected Versions CanalDenuncia.app affected versions not specified Description A lack of authorization exists in CanalDenuncia.app, potentially allowing an attacker to access other users' information. This is achieved by sending a POST request with the...

GO-2025-4028 go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents in github.com/in-toto/go-witness

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents in github.com/in-toto/go-witness...

PT-2025-45829

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents in github.com/in-toto/go-witness...

CVE-2025-62375

go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is...

EUVD-2025-34679

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents...

go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents

Impact This vulnerability only affects users of the AWS attestor. Users of the AWS attestor could have unknowingly received a forged identity document. While this may seem unlikely, AWS recently issued a security bulletin about IMDS Instance Metadata Service impersonation.^1 There are multiple...

CVE-2025-62375 go-witness Improper Verification of AWS EC2 Identity Documents

go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness versions 0.9.2 and earlier the AWS attestor improperly verifies AWS EC2 instance identity documents. Verification can incorrectly succeed when a signature is not present or is...