135 matches found
GHSA-X6GF-MPR2-68H6 vulnerabilities
Vulnerabilities for packages: teleport, telegraf, hydra, splunk-otel-collector, src, grafana-alloy, flyte, kots, steampipe, bento, migrate, harbor, trillian...
GHSA-JQCQ-XJH3-6G23 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, teleport, steampipe, splunk-otel-collector, bento, grafana-alloy, splunk-otel-collector-fips, telegraf, bento-fips, kots...
GHSA-X6GF-MPR2-68H6 vulnerabilities
Vulnerabilities for packages: teleport, vault, teleport-operator-fips, wavefront-collector-for-kubernetes, src, grafana-alloy, gotrue-fips, bento-fips, trillian-fips, migrate, splunk-otel-collector, vault-fips, trillian, flyte, ory-kratos-fips, kots, hydra-fips, gotrue, argo-workflows-fips, harbo...
CVE-2026-4427 vulnerabilities
Vulnerabilities for packages: teleport, vault, teleport-operator-fips, wavefront-collector-for-kubernetes, src, grafana-alloy, gotrue-fips, bento-fips, trillian-fips, migrate, splunk-otel-collector, vault-fips, trillian, flyte, ory-kratos-fips, kots, hydra-fips, gotrue, argo-workflows-fips, harbo...
CVE-2026-33744
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.37, the docker.systempackages field in bentofile.yaml accepts arbitrary strings that are interpolated directly into Dockerfile RUN commands without sanitization. Since...
PT-2026-28523
Name of the Vulnerable Software and Affected Versions BentoML versions prior to 1.4.37 Description BentoML is a Python library used for building online serving systems for AI applications and model inference. A flaw exists where the docker.system packages field within the bentofile.yaml file does...
CVE-2026-27905 BentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safeextracttarfile function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path,...
BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
Arbitrary File Write via Symlink Path Traversal in Tar Extraction Summary The safeextracttarfile function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a...
CVE-2026-24123
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...
EUVD-2026-4723
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...
CVE-2026-24123
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate,...
GHSA-6R62-W2Q3-48HF BentoML has a Path Traversal via Bentofile Configuration
Summary BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript, docker.dockerfiletemplate, conda.environmentyml. An attacker can craft a malicious bentofile that, when built by a victim, exfiltrates arbitrary files fr...
BentoML path traversal vulnerability
BentoML is an open-source model service library developed by BentoML. It is used to build high-performance and scalable artificial intelligence applications using Python. Versions of BentoML prior to 1.4.34 contained a path traversal vulnerability. This vulnerability stemmed from the bentofile.ya...
CVE-2025-63811 vulnerabilities
Vulnerabilities for packages: sqlexporter, amazon-cloudwatch-agent, jitsucom-bulker, splunk-otel-collector, grafana-alloy, bento, opentelemetry-collector-contrib, argo-events, cluster-api-aws-controller...
GHSA-9MJ6-HXHV-W67J vulnerabilities
Vulnerabilities for packages: sqlexporter, amazon-cloudwatch-agent, jitsucom-bulker, splunk-otel-collector, grafana-alloy, bento, opentelemetry-collector-contrib, argo-events, cluster-api-aws-controller...
CVE-2025-63811 vulnerabilities
Vulnerabilities for packages: vault, argo-events-fips, grafana-alloy, jitsucom-bulker, splunk-otel-collector, vault-fips, amazon-cloudwatch-agent, dapr-fips, amazon-cloudwatch-agent-fips, sqlexporter, cluster-api-aws-controller-fips, cluster-api-aws-controller, sqlexporter-fips, bento,...
GHSA-9MJ6-HXHV-W67J vulnerabilities
Vulnerabilities for packages: vault, argo-events-fips, grafana-alloy, jitsucom-bulker, splunk-otel-collector, vault-fips, amazon-cloudwatch-agent, dapr-fips, amazon-cloudwatch-agent-fips, sqlexporter, cluster-api-aws-controller-fips, cluster-api-aws-controller, sqlexporter-fips, bento,...
EUVD-2020-11615
Malware in sbrugna...