708 matches found
CVE-2026-45099
Terragrunt (an orchestration tool for OpenTofu/Terraform) prior to v1.0.4 is vulnerable to arbitrary file deletion via a maliciously crafted .terragrunt-module-manifest file in a downloaded external module. The root cause is that fileManifest.Clean() in internal/util/file.go trusted decoded paths...
CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...
CVE-2026-71494
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
CVE-2026-71494
Infracost prior to 0.10.45 contains a token disclosure vulnerability in internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths. The root cause is that a configured Terraform Cloud or registry token can be attached to a destination h...
EUVD-2026-64019
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...
PT-2026-79415
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote variables loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destinati...
CVE-2026-71868 Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...
CVE-2026-76228
Renovate versions =32.124.0 and before 42.68.5 and Mend renovate-ce/renovate-ee before 13.3.0 contain a command injection vulnerability in Gradle Wrapper artifact handling. When Renovate processes Gradle Wrapper updates, it invokes a wrapper update command via a shell e.g. /bin/sh -c ... ./gradle...
GHSA-V5RC-CPWC-CFPR
creationtimestamp| type| source ---|---|--- 2026-08-19 07:31:59+00:00| seen| https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad...
GHSA-V2WP-FRMC-5Q3V
creationtimestamp| type| source ---|---|--- 2026-08-19 07:31:59+00:00| seen| https://gist.github.com/alon710/048e89a8b6d23388e5627d9e6207e2ad...
BIT-GITLAB-2026-15423 Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without...
CVE-2026-70429 vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-XV7V-HW45-9JGW vulnerabilities
Vulnerabilities for packages: jenkins...
GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
Terragrunt: Arbitrary File Deletion via Malicious Module Manifest
Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...
GHSA-25MV-J2QR-V5JQ vulnerabilities
Vulnerabilities for packages: lvm-driver, kepler-fips, crossplane-provider-aws-budgets, gitlab-runner-operator-fips, perses-fips, addon-resizer, crossplane-provider-aws-servicediscovery-fips, opensearch-datasource, metrics-agent-fips, falcosidekick, prometheus-beat-exporter,...
CVE-2026-22555
A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...