MAL-2025-17150 Malicious code in closure-es6 (npm)

The package closure-es6 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: google-open-source-security e0574a10de5b6d2bca40b32e3869d3a497db2729667e3523f97b8dde3f5846c7 This package installs a dependency hosted on a custom domain that runs an inf...

MAL-2025-10877 Malicious code in @zalastax/nolb-cd_ (npm)

The package @zalastax/nolb-cd was found to contain malicious code...

MAL-2025-29713 Malicious code in profesia-cd-components (npm)

The package profesia-cd-components was found to contain malicious code...

PT-2025-32128 · Unknown · Virtual Cd

Name of the Vulnerable Software and Affected Versions: Virtual cdm Camera Data Mover affected versions not specified Description: A memory corruption issue exists when utilizing Virtual cdm Camera Data Mover to write registers. Recommendations: At the moment, there is no information about a newer...

CVE-2025-54415

CVE-2025-54415 affects the dag-factory project (Apache Airflow) for versions ≤ 0.23.0a8. The vulnerability lies in the cicd.yml workflow configured in the astronomer/dag-factory GitHub repository, which, when triggered by pull_request_target, can be exploited to execute arbitrary code in the GitH...

IBM多款产品 信任管理问题漏洞

IBM MQ and others are products of International Business Machines IBM.IBM MQ is a messaging middleware product.IBM MQ Operator is a tool for managing the lifecycle of IBM MQ Queue Manager.IBM MQ Container CD is a containerized deployment solution for IBM MQ. A trust management issue vulnerability...

IBM多款产品 安全漏洞

IBM MQ Operator and others are a tool from International Business Machines IBM used to manage the lifecycle of the IBM MQ Queue Manager. A security vulnerability exists in various IBM products that stems from heap memory not being properly cleared before being freed, which could lead to the...

CVE-2025-4563 vulnerabilities

Vulnerabilities for packages: argo-cd, node-feature-discovery-fips, vcluster, rancher, blob-csi-fips, rancher-fleet, rancher-system-agent, cloud-provider-gcp-cloud-controller-manager, yunikorn-k8shim-fips, azurefile-csi-fips, cluster-autoscaler, longhorn-share-manager-fips, cluster-autoscaler-fip...

ALSA-2025:9420 Moderate: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file...

GitLab 17.11 < 17.11.4 / 18.0 < 18.0.2 (CVE-2025-5121)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue that, under certain conditions, could have allowed a successful attacker with authenticated access to a GitLab instance with a GitLab Ultimate license applied paid...

The New Frontline: Why DevOps Became a Cyber Target

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! Your developers didn't become...

CVE-2025-49598

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2025-49598

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2025-49598 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

CVE-2025-49598

Summary: CVE-2025-49598 affects the conda-forge-ci-setup package (and its feedstock setup script) via an unsafe use of eval when parsing version information from a custom-formatted meta.yaml. An attacker who can modify the recipe (RECIPE_DIR) and supply a malicious meta.yaml can cause arbitrary c...

CVE-2025-49598 conda-forge-ci-setup Allows Arbitrary Code Execution via Insecure Version Parsing

conda-forge-ci-setup is a package installed by conda-forge each time a build is run on CI. The conda-forge-ci-setup-feedstock setup script is vulnerable due to the unsafe use of the eval function when parsing version information from a custom-formatted meta.yaml file. An attacker controlling...

The Role of Continuous Integration and Continuous Deployment (CI/CD) in DevOps

Modern software development demands rapid delivery of high-quality applications that can adapt to changing business requirements and user…...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

BIT-ARGO-CD-2025-47933 Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...

SUSE CVE-2025-47933

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...