CVE-2026-30944

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocmsapi/dashboard/api-tokens endpoint allows any authenticated user at least Editor to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to...

CVE-2026-30945: Authorization Bypass Through User-Controlled Key

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocmsapi/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner...

CVE-2026-30233

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution exec may be...

CVE-2025-61728 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, omnictl-multiarch, kube-arangodb-fips, redka, logstash, conftest-fips, external-dns-fips, google-osconfig-agent, scorecard, gatekeeper, headlamp, hubble, kubevela-fips, mattermost, thanos-operator-fips, gitlab-rails-ce-fips, packer-fips,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: kargo, supercronic, secrets-store-csi-driver-provider-azure, policy-controller, grafana-operator, nri-f5, k9s, rabbitmq-cluster-operator, boring-registry, nats, nri-haproxy, pgtimetable, rancher-machine, kserve-modelmesh-serving, tofu-controller, portieris, op-geth,...

EUVD-2018-6603

Malware in sbrugna...

EUVD-2018-6602

Malware in sbrugna...

EUVD-2022-27103

Malicious code in bioql PyPI...

GHSA-QXP5-GWG8-XV66 vulnerabilities

Vulnerabilities for packages: kargo, flux-helm-controller, secrets-store-csi-driver-provider-azure, timoni, policy-controller, crossplane, grafana-operator, k9s, docker-compose, rabbitmq-cluster-operator, boring-registry, gcsfuse, nats, lvm-driver, flux-source-controller, conftest, fulcio,...

CVE-2024-45336 vulnerabilities

Vulnerabilities for packages: whereabouts, oauth2-proxy, cass-operator-fips, gosu-fips, velero, velero-plugin-for-aws-fips, dex, cloud-provider-aws-fips, kbld, fluent-operator-fips, wave, karpenter, kustomize, kyverno-policy-reporter-kyverno-plugin, secrets-store-csi-driver-provider-gcp,...

PT-2024-32715 · Unknown · Shilpi Client Dashboard

Name of the Vulnerable Software and Affected Versions: Shilpi Client Dashboard affected versions not specified Description: This issue is due to missing restrictions for incorrect login attempts on the API-based login of the Shilpi Client Dashboard. A remote attacker could exploit this by...

SUSE CVE-2022-21947

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947 rancher desktop: Dashboard API is network accessible

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947 rancher desktop: Dashboard API is network accessible

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947

The CVE-2022-21947 entry concerns SUSE Rancher Desktop (Rancher Desktop) with an exposure of the Dashboard API (steve) to the local network. Affected: Rancher Desktop versions prior to V. Root cause: Exposure of Resource to Wrong Sphere vulnerability allows a local-network attacker to connect to ...

PT-2022-15197 · Suse · Suse Rancher Desktop

Name of the Vulnerable Software and Affected Versions: SUSE Rancher Desktop versions prior to V. Description: A vulnerability in SUSE Rancher Desktop allows attackers in the local network to connect to the "Dashboard API steve" to carry out arbitrary actions due to improper access control...

CVE-2022-21947: Exposure of Resource to Wrong Sphere

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...

CVE-2022-21947

A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API steve to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V...