139 matches found
Dapr: Service Invocation path traversal ACL bypass
Summary A vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass via the service invocation access control process. An attacker can bypass access control policies and invoke unauthorized methods by submitting specially crafted method paths containing encoded path traversal...
Access Control Bypass
Overview Affected versions of this package are vulnerable to Access Control Bypass via the service invocation access control process. An attacker can bypass access control policies and invoke unauthorized methods by submitting specially crafted method paths containing encoded path traversal...
PT-2026-37119
Name of the Vulnerable Software and Affected Versions Dapr versions 1.3.0 through 1.15.13 Dapr versions 1.16.0-rc.1 through 1.16.13 Dapr versions 1.17.0-rc.1 through 1.17.4 Description An issue exists in the way access control policies for service invocation are handled. The Access Control List A...
CVE-2026-34986 vulnerabilities
Vulnerabilities for packages: crossplane-fips, kaniko, splunk-otel-collector, xeol-fips, flux-kustomize-controller, prometheus-podman-exporter-fips, frp, task-fips, sigstore-scaffolding, authentik, grpc-health-probe, kyverno-fips, terragrunt, bento, kubescape-server, nginx-kubernetes-ingress-fips...
CVE-2022-38817
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...
GHSA-32FW-GQ77-F2F2 vulnerabilities
Vulnerabilities for packages: falcosidekick, bento, minio...
CVE-2025-10543 vulnerabilities
Vulnerabilities for packages: falcosidekick, bento, minio...
GHSA-32FW-GQ77-F2F2 vulnerabilities
Vulnerabilities for packages: elastic-agent, beats, agentbeat-fips, influxd, beats-fips, minio, bento, agentbeat, elastic-agent-fips, dapr-fips, falcosidekick, falcosidekick-fips, dapr, minio-fips, telegraf, zabbix-agent2-fips, zabbix-agent2...
CVE-2025-10543 vulnerabilities
Vulnerabilities for packages: elastic-agent, beats, agentbeat-fips, influxd, beats-fips, minio, bento, agentbeat, elastic-agent-fips, dapr-fips, falcosidekick, falcosidekick-fips, dapr, minio-fips, telegraf, zabbix-agent2-fips, zabbix-agent2...
CVE-2025-63811 vulnerabilities
Vulnerabilities for packages: cluster-api-aws-controller, opentelemetry-collector-contrib, bento, amazon-cloudwatch-agent, sqlexporter, splunk-otel-collector, jitsucom-bulker, argo-events, grafana-alloy...
GHSA-9MJ6-HXHV-W67J vulnerabilities
Vulnerabilities for packages: cluster-api-aws-controller, opentelemetry-collector-contrib, bento, amazon-cloudwatch-agent, sqlexporter, splunk-otel-collector, jitsucom-bulker, argo-events, grafana-alloy...
CVE-2025-63811 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, cluster-api-aws-controller-fips, argo-events-fips, cluster-api-aws-controller, bento, amazon-cloudwatch-agent-fips, grafana-alloy, vault, sqlexporter, amazon-cloudwatch-agent, opentelemetry-collector-contrib, vault-fips, jitsucom-bulker,...
GHSA-9MJ6-HXHV-W67J vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, cluster-api-aws-controller-fips, argo-events-fips, cluster-api-aws-controller, bento, amazon-cloudwatch-agent-fips, grafana-alloy, vault, sqlexporter, amazon-cloudwatch-agent, opentelemetry-collector-contrib, vault-fips, jitsucom-bulker,...
This Week in Spring - October 14th, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring! I'm in Boston and New York city and Bulgaria and Poland this week, but I'm still hyped about last week's amazing Devoxx Belgium event! There are a ton of videos to look at, and I'll include just some of them here. So, without...
EUVD-2023-1966
Malicious code in bioql PyPI...
EUVD-2024-1350
Malicious code in bioql PyPI...
GHSA-8PJC-487G-W6P2 vulnerabilities
Vulnerabilities for packages: gcp-compute-persistent-disk-csi-driver, plugin-barman-cloud, node-problem-detector, flux-operator, headlamp, rancher-system-agent, cis-operator, portieris, wait-for-port, kubernetes-dashboard, nri-haproxy, rclone, cluster-api-azure-controller, zot, mockgen, karpenter...
GHSA-J5PM-7495-QMR3 vulnerabilities
Vulnerabilities for packages: kaniko, metrics-server, splunk-otel-collector, certificate-transparency, fluxcd-kustomize-mutating-webhook, rancher-system-agent, xeol-fips, newrelic-nri-kube-events, flux-kustomize-controller, prometheus-podman-exporter-fips, ipfs-cluster-fips, trino,...