201 matches found
EUVD-2025-36551
Contrast has insecure LUKS2 persistent storage partitions may be opened and used...
Files or Directories Accessible to External Parties
Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the secure persistent volume feature. An attacker can access confidential data stored in persistent volumes by providing a crafted LUKS2 volume with a null key-encryption algorithm...
GHSA-F5P4-P5Q5-JV3H Contrast has insecure LUKS2 persistent storage partitions may be opened and used
Summary A malicious host may provide a crafted LUKS2 volume to a Contrast pod VM that uses the secure persistent volume feature. The guest will open the volume and write secret data using a volume key known to the attacker. LUKS2 volume metadata is a not authenticated and b supports null...
PT-2025-45708
Summary A malicious host may provide a crafted LUKS2 volume to a Contrast pod VM that uses the secure persistent volume feature. The guest will open the volume and write secret data using a volume key known to the attacker. LUKS2 volume metadata is a not authenticated and b supports null...
PT-2026-99443
Name of the Vulnerable Software and Affected Versions Contrast versions prior to 1.12.1 Description The secure persistent volume feature is susceptible to an attack where a malicious host provides a crafted LUKS2 volume to a pod VM. This occurs because LUKS2 volume metadata is not authenticated a...
EUVD-2013-6282
Malware in sbrugna...
EUVD-2022-7109
Malicious code in bioql PyPI...
EUVD-2025-29522
Malicious code in bioql PyPI...
EUVD-2025-29502
Malicious code in bioql PyPI...
GO-2025-3920 Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast...
PT-2025-36645
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast...
GHSA-VXG3-W9RV-RHR2 Contrast leaks workload secrets to logs on INFO level
This is the same vulnerability as https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8. The original vulnerability had been fixed for release v1.8.1, but the fix was not ported to the main branch and thus not present in releases v1.9.0 ff. Below is a brief repetition of...
PT-2026-99444
Name of the Vulnerable Software and Affected Versions Edgelesssys Contrast versions 1.9.0 through 1.12.1 Description The initializer logs the full NewMeshCert response to standard output at the INFO level. This response contains the workload secret, making it accessible to any Kubernetes user wit...
PT-2025-36636
This is the same vulnerability as https://github.com/edgelesssys/contrast/security/advisories/GHSA-h5f8-crrq-4pw8. The original vulnerability had been fixed for release v1.8.1, but the fix was not ported to the main branch and thus not present in releases v1.9.0 ff. Below is a brief repetition of...
GO-2025-3807 Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points in github.com/edgelesssys/contrast
Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points in github.com/edgelesssys/contrast...
GHSA-PHHQ-63JG-FP7R Contrast vulnerability allows arbitrary host data Injection into container VOLUME mount points
Background The VOLUME directive in Dockerfiles, or the config.volumes field in OCI image descriptors, indicates filesystem paths "where the process is likely to write data". While these paths have special semantics in Docker, they are only hints in the OCI spec and are not treated specially by...
PT-2025-30162 · Go · Github.Com/Edgelesssys/Contrast
Background The VOLUME directive in Dockerfiles, or the config.volumes field in OCI image descriptors, indicates filesystem paths "where the process is likely to write data". While these paths have special semantics in Docker, they are only hints in the OCI spec and are not treated specially by...
PT-2026-99445
Name of the Vulnerable Software and Affected Versions Contrast versions prior to 1.9.1 Description On bare-metal deployments, an untrusted host can write arbitrary file trees below a mount point inside a confidential container if the image declares at least one VOLUME specified via the...
PCEvolve: Private Contrastive Evolution for Synthetic Dataset Generation Via Few-Shot Private Data and Generative APIs
The rise of generative APIs has fueled interest in privacy-preserving synthetic data generation. While the Private Evolution PE algorithm generates Differential Privacy DP synthetic images using diffusion model APIs, it struggles with few-shot private data due to the limitations of its DP-protect...