CVE-2026-41907 vulnerabilities

Vulnerabilities for packages: saf, redisinsight, librechat, kubeflow-pipelines, kubeflow-centraldashboard, opensearch-dashboards, wazuh-dashboard, kibana, dbgate-fips, prism, langfuse-fips, gemini-cli, opensearch-dashboards-fips, argo-workflows, renovate, npm, code-server, sqlpad,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: apko, karpenter, clickhouse-operator, grafana-operator, temporal, flux-image-automation-controller, aws-load-balancer-controller, github-mcp-server, secrets-store-csi-driver-provider-aws, grafana-rollout-operator, ingress-nginx-controller,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: flannel, slsa-verifier, vexctl, postgres-operator, kargo, dataplaneapi, kine, falco-no-driver, terraform-provider-azapi, aws-flb-kinesis, polaris, bazelisk, aws-sigv4-proxy, kots, nri-nginx, knative-eventing, prometheus, kubernetes-dashboard-metrics-scraper,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, helm-push, zot, argocd-image-updater, extism, crossplane-provider-aws-kms, trivy-fips, skaffold, omni, boring-registry, rancher-fleet, flux-helm-controller-fips, q, terraform, vcluster, helm-diff-fips, apko,...

CVE-2026-25547 vulnerabilities

Vulnerabilities for packages: pulumi, renovate, npm, librechat, node-gyp, actions-runner, lerna, sqlpad...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: gops, slsa-verifier, postgres-operator, grafana-alloy, kube-rbac-proxy, kargo, kine, falco-no-driver, polaris, prometheus-alertmanager, kots, nri-nginx, op-geth, knative-eventing, prometheus, kubernetes-dashboard-metrics-scraper, splunk-otel-collector, opencost,...

EUVD-2022-49076

Malicious code in bioql PyPI...

EUVD-2025-27053

Malicious code in bioql PyPI...

EUVD-2022-6988

Malicious code in bioql PyPI...

MAL-2025-46892 Malicious code in actions-runner-admin (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8bf5c8993e97e4a8a3f91ab4b6b7618dc0f73864793854b4458516ece843a6db The OpenSSF Package Analysis project identified 'actions-runner-admin' @ 99.99.99 rubygems as malicious. It is considered malicious because: - T...

Malicious code in actions-runner-admin (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8bf5c8993e97e4a8a3f91ab4b6b7618dc0f73864793854b4458516ece843a6db The OpenSSF Package Analysis project identified 'actions-runner-admin' @ 99.99.99 rubygems as malicious. It is considered malicious because: - T...

GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: slsa-verifier, vexctl, crossplane-provider-aws-kinesis, postgres-operator, grafana-alloy, kube-rbac-proxy, kargo, terraform-provider-azapi, prometheus-alertmanager, kots, docker, op-geth, prometheus, kubernetes-dashboard-metrics-scraper, argo-events,...

CVE-2025-22872 vulnerabilities

Vulnerabilities for packages: slsa-verifier, vexctl, crossplane-provider-aws-kinesis, postgres-operator, grafana-alloy, kube-rbac-proxy, kargo, terraform-provider-azapi, prometheus-alertmanager, kots, docker, op-geth, prometheus, kubernetes-dashboard-metrics-scraper, argo-events,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: slsa-verifier, vexctl, postgres-operator, kube-rbac-proxy, dataplaneapi, kyverno-policy-reporter, terraform-provider-azapi, aws-flb-kinesis, wire-go, prometheus-alertmanager, bazelisk, nri-nginx, prometheus, kubernetes-dashboard-metrics-scraper, kyverno-notation-aws,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: slsa-verifier, vexctl, postgres-operator, kube-rbac-proxy, dataplaneapi, kyverno-policy-reporter, terraform-provider-azapi, aws-flb-kinesis, wire-go, prometheus-alertmanager, bazelisk, nri-nginx, prometheus, kubernetes-dashboard-metrics-scraper, kyverno-notation-aws,...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: vexctl, xeol, argo-rollouts, crossplane-provider-azure-authorization, grafana-alloy, kargo, kaniko, step-ca, kine, terraform-provider-azapi, zot, restic, actions-runner-controller, fulcio, crossplane-provider-azure-managedidentity, kots, docker, tekton-chains, op-get...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: gops, flannel, slsa-verifier, vexctl, postgres-operator, kube-rbac-proxy, dataplaneapi, aws-flb-kinesis, wire-go, prometheus-alertmanager, bazelisk, nri-nginx, kubernetes-dashboard-metrics-scraper, argo-events, mockgen, splunk-otel-collector, vertical-pod-autoscaler,...

CVE-2022-39321

GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands wa...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...