GO-2026-6213 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, cerbos, argo-workflows, gptscript, pulumi-language-dotnet, argo-events, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, grype, act,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: authservice, seaweedfs-rocksdb, versitygw-fips, crossplane-provider-aws-rds-fips, aws-node-termination-handler-fips, crossplane-provider-aws-scheduler, spegel-fips, crossplane-provider-aws-elbv2, kbld-fips, nsc, cert-manager-google-cas-issuer-fips,...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: witness, docker, spire-server, cg, crossplane, gitsign, gh, buildkitd-fips, goreleaser, trivy-operator, trivy-operator-fips, chainctl, kyverno-fips, kyverno-policy-reporter-plugins-kyverno-fips, kyverno-notation-aws, zarf, vexctl, flux-source-controller,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: ocm-cli-fips, conftest, xeol-fips, kyverno-fips, headlamp, argocd-image-updater, cluster-api-helm-controller-fips, rancher-fleet, cilium-cli, headlamp-fips, argo-cd, falcoctl-fips, falcoctl, ratify, ocm-kubernetes-controller, xeol, trivy, drone, helm-set-status,...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: cri-tools, kubeflow-pipelines, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache, kubernetes-dns-node-cache-fips, k8s-device-plugin, nodetaint, rancher-webhook-fips, node-feature-discovery, argocd-image-updater-fips, aws-efs-csi-driver, ip-masq-agent,...

GO-2025-4098 vulnerabilities

Vulnerabilities for packages: dagger, docker, nerdctl-fips, buildah, xeol-fips, spegel-fips, grafana-alloy, cluster-autoscaler-fips, newrelic-infrastructure-agent-fips, skopeo-fips, blob-csi-fips, docker-fips, ctop, zot, wolfictl, rke2-runtime-fips, prometheus-podman-exporter-fips, xeol, trivy,...

GO-2026-4529 vulnerabilities

Vulnerabilities for packages: crossplane, trivy-operator, trivy-operator-fips, kyverno-fips, aactl, slsa-verifier, kyverno-policy-reporter-plugins-kyverno-fips, kyverno-notation-aws, vexctl, commercial-chainloop-cli, cloudbeat-fips, ko-fips, cloudbeat, commercial-chainloop-backend,...

GO-2025-4257 vulnerabilities

Vulnerabilities for packages: k8sgpt, kserve...

GO-2025-3892 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, kots, zarf, snyk-cli, rancher-fleet, kubescape, grype, terraform, syft, trivy-operator, conftest, wolfictl, steampipe, terragrunt, zot, xeol, trivy, opentofu, tflint...

GO-2026-4883 vulnerabilities

Vulnerabilities for packages: docker, rancher-agent, pulumi, kots, goreleaser, cluster-api, amazon-cloudwatch-agent-operator, envoy-gateway, osv-scanner, zarf, aws-otel-collector, k8sgpt, splunk-otel-collector, datadog-agent, opentelemetry-operator, openfga, apko, traefik,...

PT-2026-42732

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4 Description Sandbox escape flaws in NodeVM allow unauthenticated remote code execution on the host server. The issue occurs because the dangerous builtin denylist in lib/builtin.js misses process and...

azure-devsecops-poc

No d...

PT-2026-34558

Name of the Vulnerable Software and Affected Versions PHPUnit versions prior to 12.5.22 PHPUnit versions prior to 13.1.6 Description PHPUnit forwards PHP INI settings to child processes as -d name=value command-line arguments without neutralizing INI metacharacters. Because the PHP INI parser...

Exploit for Out-of-bounds Write in Netapp Bootstrap_Os

Typeform DevSecOps Pipeline POC !Pythonhttps://img.shields...

PT-2026-3860

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 12.3 through 18.6.3 GitLab CE/EE versions 18.7 through 18.7.1 GitLab CE/EE versions 18.8 through 18.8.1 Description An issue in GitLab CE/EE could allow an unauthenticated user to create a denial of service condition by...

Zero Trust Security Model Implementation in Microservices Architectures Using Identity Federation

The microservice bombshells that have been linked with the microservice expansion have altered the application architectures, offered agility and scalability in terms of complexity in security trade-offs. Feeble legacy-based perimeter-based policies are unable to offer safeguard to distributed...

Secure Coding for Web Applications: Frameworks, Challenges, and the Role of LLMs

Secure coding is a critical yet often overlooked practice in software development. Despite extensive awareness efforts, real-world adoption remains inconsistent due to organizational, educational, and technical barriers. This paper provides a comprehensive review of secure coding practices across...

Improper Certificate Validation

Overview devsecops-engine-tools is a Tool for DevSecOps strategy Affected versions of this package are vulnerable to Improper Certificate Validation via the getaccesstokenclientcredentials function, which uses the requests.request function with verify=False configured. Remediation Upgrade...

Not Your Old ActiveState: Introducing our End-to-End OS Platform

Having been at ActiveState for nearly eight years, I've seen many iterations of our product. However, one thing has stayed true over the years: Our commitment to the open source community and companies using open source in their code. ActiveState has been helping enterprises manage open source fo...

Proactively Securing Cloud Workloads in the CI/CD Pipeline with Rapid7 and Azure DevOps

As organizations continue to embrace cloud-native development practices, the need for integrated security solutions that seamlessly fit into existing DevOps environments has become more pressing than ever. We recognize this critical need and have added new integration for InsightCloudSec ICS and...