Axios NPM Distribution Compromised in Supply Chain Attack

A compromised axios maintainer account led to malicious npm releases that propagated across environments. Learn how to assess impact, detect compromise, and secure your development workflows...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: guac, skaffold, melange, k9s, kargo, flux-fips, crossplane-fips, kaniko, kubevela-fips, chainctl, gitaly, trivy-fips, snyk-cli, rancher-fleet, teleport, zot, flux-image-automation-controller, zarf-fips, apko-fips, chainctl-fips, gomplate-fips, gitsign, packer-fips,...

GHSA-37CH-88JC-XWX2 vulnerabilities

Vulnerabilities for packages: sqlpad, wazuh-dashboard-fips, kubeflow-katib, gitlab-rails-ce-fips, wazuh-dashboard, argo-workflows, langfuse, langfuse-fips, gitlab-rails-ce, py3-captum, kubeflow-pipelines, json-server, kubeflow-centraldashboard, thingsboard-fips, kubescape-grype-offline-db,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: guac, skaffold, melange, k9s, kargo, flux-fips, crossplane-fips, kaniko, kubevela-fips, chainctl, gitaly, trivy-fips, snyk-cli, rancher-fleet, teleport, zot, flux-image-automation-controller, zarf-fips, apko-fips, chainctl-fips, gomplate-fips, gitsign, packer-fips,...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: sqlpad, wazuh-dashboard-fips, kubeflow-katib, gitlab-rails-ce-fips, wazuh-dashboard, argo-workflows, langfuse, langfuse-fips, gitlab-rails-ce, py3-captum, kubeflow-pipelines, json-server, kubeflow-centraldashboard, thingsboard-fips, kubescape-grype-offline-db,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: guac, skaffold, melange, k9s, kargo, flux-fips, crossplane-fips, kaniko, kubevela-fips, chainctl, gitaly, trivy-fips, snyk-cli, rancher-fleet, teleport, zot, flux-image-automation-controller, zarf-fips, apko-fips, chainctl-fips, gomplate-fips, gitsign, packer-fips,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: guac, skaffold, melange, k9s, kargo, flux-fips, crossplane-fips, kaniko, kubevela-fips, chainctl, gitaly, trivy-fips, snyk-cli, rancher-fleet, teleport, zot, flux-image-automation-controller, zarf-fips, apko-fips, chainctl-fips, gomplate-fips, gitsign, packer-fips,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: argo-events, external-secrets-operator, pulumi-language-dotnet, grafana-alloy, nfpm, src-fingerprint, dagger, crossplane, kubescape, zarf, skaffold, kaniko, pulumi-language-java, gitaly, tfsec, cerbos, teleport, argocd-image-updater, guac, xeol, bom, kubevela,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: argo-events, external-secrets-operator, pulumi-language-dotnet, grafana-alloy, nfpm, src-fingerprint, dagger, crossplane, kubescape, zarf, skaffold, kaniko, pulumi-language-java, gitaly, tfsec, cerbos, teleport, argocd-image-updater, guac, xeol, bom, kubevela,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: argo-events, external-secrets-operator, pulumi-language-dotnet, grafana-alloy, nfpm, src-fingerprint, dagger, crossplane, kubescape, zarf, skaffold, kaniko, pulumi-language-java, gitaly, tfsec, cerbos, teleport, argocd-image-updater, guac, xeol, bom, kubevela,...

GHSA-37CH-88JC-XWX2 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, json-server, sqlpad, kubeflow-pipelines, argo-workflows, kubeflow-centraldashboard...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, json-server, sqlpad, kubeflow-pipelines, argo-workflows, kubeflow-centraldashboard...

The Real Risk of Vibecoding

This blog looks at how AI‑driven vibecoding speeds up software development while increasing security risk by outpacing traditional review and ownership. It explains why security needs to move earlier and be built into modern development workflows...

ANT-2026-DJBBBBPE · temporalio/temporal · Broken Access Control

broken-access-control critical CVE-2026-5199 Severity Claude critical · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT The report below was sent to the maintainer and sealed at approval. ANT-2026-DJBBBBPE: Cross-namespace manipulation including deletion of...

SQL Injection

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to SQL Injection in the orderByColumn expression of the Data Table Get node. An attacker with permissions to create or modify workflows can execute arbitrary SQL commands by supplying crafted input,...

CVE-2026-33720

n8n is an open source workflow automation platform. Prior to version 2.8.0, when the N8NSKIPAUTHONOAUTHCALLBACK environment variable is set to true, the OAuth callback handler skips ownership verification of the OAuth state parameter. This allows an attacker to trick a victim into completing an...

Introducing Wiz Workflows: Your path to building a self healing cloud

Orchestrate customizable workflows with agents, enabling end-to-end discovery and response in Wiz...

How AI Translation Fixes Multilingual Content Chaos

AI translation fixes multilingual content chaos by improving consistency, workflows, and speed, helping teams reduce errors and scale global content faster...

Improper Handling Of Symbolic Links

github.com/argoproj/argo-workflows is vulnerable to Improper Handling Of Symbolic Links. The vulnerability is due to flawed validation in the untar process when resolving symbolic links, which allows an attacker to overwrite critical files such as /var/run/argo/argoexec with a malicious script th...

SUSE CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...