EUVD-2025-202177

RCE via ZipSlip and symbolic links in argoproj/argo-workflows...

GHSA-XRQC-7XGX-C9VH RCE via ZipSlip and symbolic links in argoproj/argo-workflows

Summary The patch deployed against CVE-2025-62156 is ineffective against malicious archives containing symbolic links. Details The untar code that handles symbolic links in archives is unsafe. Concretely, the computation of the link's target and the subsequent check are flawed:...

CVE-2025-66626: Relative Path Traversal

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 through 3.7.4, contain unsafe untar code that handles symbolic links in archives. Concretely, the computation of a link's target and the...

Argo Workflows 操作系统命令注入漏洞

Argo Workflows is an open source container-native workflow engine for Kubernetes from the Argo project. An operating system command injection vulnerability exists in Argo Workflows versions 3.6.13 and earlier and versions 3.7.0 through 3.7.4, which stems from improper handling of symbolic links a...

Docker-Exploit-Mapper

DEM — Docker Exploit Mapper Welcome to DEM, a fully con...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE due to insufficient isolation in the Python Code Node that uses Pyodide. An authenticated attacker with permissions to create or modify workflows can execute arbitrary commands on the host system by creating or...

GHSA-PJ86-CFQH-VQX6 vulnerabilities

Vulnerabilities for packages: tileserver-gl, sqlpad, saf, thingsboard, json-server...

CVE-2024-51999 vulnerabilities

Vulnerabilities for packages: tileserver-gl, sqlpad, saf, thingsboard, json-server...

GHSA-PJ86-CFQH-VQX6 vulnerabilities

Vulnerabilities for packages: tileserver-gl, json-server, redisinsight, argo-workflows, saf, sqlpad, thingsboard, librechat...

CVE-2024-51999 vulnerabilities

Vulnerabilities for packages: tileserver-gl, json-server, redisinsight, argo-workflows, saf, sqlpad, thingsboard, librechat...

Chopping AI Down to Size: Turning Disruptive Technology into a Strategic Advantage

Most people know the story of Paul Bunyan. A giant lumberjack, a trusted axe, and a challenge from a machine that promised to outpace him. Paul doubled down on his old way of working, swung harder, and still lost by a quarter inch. His mistake was not losing the contest. His mistake was assuming...

Information Disclosure

github.com/argoproj/argo-workflows is vulnerable to Information Disclosure. The vulnerability is due to artifact repository credentials being logged in plaintext within the workflow-controller pod logs, which allows an attacker with permission to read pod logs to obtain these credentials and...

Directory Traversal

github.com/argoproj/argo-workflows is vulnerable to Directory Traversal. The vulnerability is due to improper validation of archive entry paths during artifact extraction, which allows an attacker to craft malicious archive files that write arbitrary files outside the intended extraction director...

Behind the Curtain: How Shared Hosting Providers Respond to Vulnerability Notifications

Large-scale vulnerability notifications VNs can help hosting provider organizations HPOs identify and remediate security vulnerabilities that attackers can exploit in data breaches or phishing campaigns. Previous VN studies have primarily focused on factors under the control of reporters, such as...

CVE-2025-53896 Kiteworks MFT is vulnerable to Insufficient Session Expiration

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0...

CVE-2025-65956

Formwork is a flat file-based Content Management System CMS. Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting XSS. Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controll...

CVE-2025-65956 Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags

Formwork is a flat file-based Content Management System CMS. Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting XSS. Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controll...

Charting the future of SOC: Human and AI collaboration for better security

Security operations centers are under pressure from unprecedented scale and complexity. Speed, precision, and consistency matter more than ever, and AI is everywhere—but hype alone doesn’t solve the challenge. This blog shares our journey and insights from building autonomous AI agents for MDR...

GHSA-7J46-F57W-76PJ Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags

Summary Inserting unsanitized data into the blog tag field in Formwork CMS results in stored cross‑site scripting XSS. Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. Because the issue is...

Bdtask Isshue - Multi Store eCommerce Shopping Cart Solution 安全漏洞

Bdtask Isshue – Multi Store eCommerce Shopping Cart Solution is an e-commerce shopping cart system developed by the Bangladeshi company Bdtask. Version 5 of Bdtask Isshue – Multi Store eCommerce Shopping Cart Solution contains a security vulnerability. This vulnerability arises from incorrect...