3310 matches found
GHSA-XV7V-HW45-9JGW vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
EUVD-2026-60205
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...
CVE-2026-71566
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...
CVE-2026-71566
FakeFish passes credentials to scripts for real hardware BMC validation, but the KubeVirt backend ignores them entirely, relying on a mounted KUBECONFIG file. This lets any cluster user control, power-cycle, and attach arbitrary CD images to VMs owned by other users. CVSS 9.3 (Critical). No patch...
CVE-2026-71566 KubeVirt backend is not authenticated
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...
BIT-GITLAB-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...
PT-2026-73291
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...
CVE-2026-71566: Missing Authentication for Critical Function
FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: kserve, crossplane-provider-aws-elastictranscoder-fips, crossplane-provider-aws-networkmanager-fips, aws-signer-notation-plugin-fips, crossplane-provider-aws-connect, crossplane-provider-aws-ds-fips, cilium-cli, kubevela-fips, opensearch-datasource-fips,...
CVE-2026-22555
A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...
GO-2026-5486 vulnerabilities
Vulnerabilities for packages: tekton-chains-fips, tekton-pipelines-fips, tkn-fips, tekton-pipelines, tkn, tekton-chains...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: chartmuseum, kyverno-notation-aws, kyverno-fips, tigera-operator, k9s-fips, helm-exporter, falcoctl-fips, maru, cilium-cli, drone, headlamp-fips, kgateway, consul-k8s-fips, rancher-agent, consul-k8s, helm-operator-fips, cluster-api-helm-controller, helm, xeol-fips,...
GO-2025-3547 vulnerabilities
Vulnerabilities for packages: longhorn-share-manager, rancher-system-agent, longhorn-manager-fips, kubernetes-csi-driver-hostpath, argo-cd-fips, azurefile-csi, eks-distro, azuredisk-csi, longhorn-manager, rke2-runtime-fips, harvester, harvester-fips, azurefile-csi-fips, longhorn-share-manager-fip...
GO-2025-3521 vulnerabilities
Vulnerabilities for packages: longhorn-share-manager, longhorn-manager-fips, kubernetes, spark-operator-fips, argo-cd-fips, azure-container-networking, longhorn-manager, harvester, harvester-fips, longhorn-share-manager-fips, rke2-runtime-fips, vcluster...
GO-2026-4678 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, argo-workflows, argo-workflows-fips...
GO-2026-5418 vulnerabilities
Vulnerabilities for packages: argocd-image-updater, argo-cd, argocd-image-updater-fips...
GO-2026-5693 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, nemo, gitaly, grafana, kyverno, flux-fips, guac, teleport, argo-cd-fips, upwind-agent, argo-cd, flux, terragrunt, terragrunt-fips, external-secrets-operator, gitlab-rails-ce, external-secrets-operator-fips, grafana-fips...