2834 matches found
CVE-2026-45570 vulnerabilities
Vulnerabilities for packages: guac, tfsec, gitlab-runner, kubescape, kaniko, pulumi, gitaly, xeol, act, flux-image-automation-controller, zot, pulumi-language-java, melange, terragrunt, trufflehog, grype, flux, apko, nfpm, snyk-cli, skaffold, gitea, pulumi-kubernetes-operator, k9s, kyverno,...
CVE-2026-45571 vulnerabilities
Vulnerabilities for packages: guac, tfsec, gitlab-runner, kubescape, kaniko, pulumi, gitaly, xeol, act, flux-image-automation-controller, zot, pulumi-language-java, melange, terragrunt, trufflehog, grype, flux, apko, nfpm, snyk-cli, skaffold, gitea, pulumi-kubernetes-operator, k9s, kyverno,...
GHSA-H98R-WV3H-FR38 vulnerabilities
Vulnerabilities for packages: argo-cd, argocd-image-updater, argocd-image-updater-fips...
CVE-2026-45738 vulnerabilities
Vulnerabilities for packages: argo-cd, argocd-image-updater, argocd-image-updater-fips...
CVE-2026-45570 vulnerabilities
Vulnerabilities for packages: trivy-operator, gitlab-rails-ce-fips, external-secrets-operator, skaffold-fips, grafana-fips, crossplane, teleport, jfrog-cli, gitlab-rails-ce, kaniko-fips, terragrunt-fips, trivy-operator-fips, nuclei, rancher-fleet-fips, gitea, amazon-ssm-agent-fips, cerbos,...
CVE-2026-45571 vulnerabilities
Vulnerabilities for packages: trivy-operator, gitlab-rails-ce-fips, external-secrets-operator, skaffold-fips, grafana-fips, crossplane, teleport, jfrog-cli, gitlab-rails-ce, kaniko-fips, terragrunt-fips, trivy-operator-fips, nuclei, rancher-fleet-fips, gitea, amazon-ssm-agent-fips, cerbos,...
GHSA-CRHJ-59GH-8X96 vulnerabilities
Vulnerabilities for packages: trivy-operator, gitlab-rails-ce-fips, external-secrets-operator, skaffold-fips, grafana-fips, crossplane, teleport, jfrog-cli, gitlab-rails-ce, kaniko-fips, terragrunt-fips, trivy-operator-fips, nuclei, rancher-fleet-fips, gitea, amazon-ssm-agent-fips, cerbos,...
Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft
In this article 1. Attack chain overview 1. Technical analysis 2. How GitHub took action to prevent further harm 2. Mitigation and protection guidance 1. Microsoft Defender XDR Detections 2. Microsoft Defender XDR Threat analytics 3. Advanced hunting 4. Indicators of Compromise IOC 3. References ...
Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation
Summary A user with application write access developer role can set link.argocd.argoproj.io/ annotations on any ArgoCD Application. These annotation values are rendered in the Summary tab's URLs section as elements without URL validation. Using the pipe-separator trick Display Text |...
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Summary The original fix for GHSA-3v3m-wc6v-x4x3 is incomplete. argocd app diff --server-side-diff can still expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation. The prior fix masks top-level Secret data in ServerSideDiff responses, but it...
GHSA-RG3G-4RW9-GQRP Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations
Summary The original fix for GHSA-3v3m-wc6v-x4x3 is incomplete. argocd app diff --server-side-diff can still expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation. The prior fix masks top-level Secret data in ServerSideDiff responses, but it...
Malicious code in @antv/x6-plugin-snapline (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/insight-component (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/infographic (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g-plugin-svg-renderer (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g-plugin-canvas-path-generator (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g6 (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g2-brush (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g6-mobile (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in @antv/g-plugin-canvaskit-renderer (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...