CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: tbot, policy-controller, ratify, zarf, ratify-fips, policy-controller-fips, kubescape-server-fips, docker-fips, chainctl-fips, aactl, kyverno-notation-aws-fips, trivy-operator-fips, cloudbeat, ko-fips, kyverno, tkn, trivy-operator, kyverno-notation-aws, spire-server,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: terragrunt, melange, fulcio, grype-fips, teleport-operator-fips, skaffold, crossplane-provider-aws-osis, crossplane-provider-aws-cloudformation, consul, drone-fips, crossplane-provider-aws-rolesanywhere, gitlab-runner-fips, flux-source-controller-fips,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, external-secrets-operator, skaffold, gitea-fips, aactl, drone-fips, minio-fips, drone, harbor-fips, mattermost, kube-conformance, prometheus-fips, traefik-fips, upwind-agent, flux-source-controller-fips, etcd, seaweedfs-rocksdb, helm, kubescape,...

GHSA-9M57-25V3-79X9 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, external-secrets-operator, teleport-operator-fips, aactl, buildah-fips, mattermost, harbor-fips, prometheus-fips, kube-conformance, traefik-fips, upwind-agent, etcd, helm, knative-eventing-fips, harbor, mattermost-fips, terraform-fips, kuma,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: terragrunt, melange, fulcio, grype-fips, teleport-operator-fips, skaffold, crossplane-provider-aws-osis, crossplane-provider-aws-cloudformation, consul, drone-fips, crossplane-provider-aws-rolesanywhere, gitlab-runner-fips, flux-source-controller-fips,...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, apply-cve-bump, external-secrets-operator, longhorn-cli, melange, terragrunt, grype-fips, teleport-operator-fips, skaffold, gitea-fips, gomplate, docker-fips, aactl, pulumi-kubernetes-operator, drone-fips, gitlab-runner-fips, minio-fips, drone,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: docker, buildah, trivy, spire-server, fscrypt, gatus, argo-events, external-secrets-operator, minio, prometheus, gitlab-kas, vault-benchmark, external-dns, pulumi-language-java, step-kms-plugin, kaf, sops, terraform-provider-azurerm, kubescape, kine, melange, helm,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: docker, buildah, trivy, spire-server, fscrypt, gatus, argo-events, external-secrets-operator, minio, prometheus, gitlab-kas, vault-benchmark, external-dns, pulumi-language-java, step-kms-plugin, kaf, sops, terraform-provider-azurerm, kubescape, kine, melange, helm,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: nerdctl, buildah, kots, rancher, spire-server, aactl, cilium-cli, fscrypt, external-secrets-operator, minio, cert-manager, gitlab-kas, prometheus, external-dns, containerd, kaf, snyk-cli, kine, cloud-provider-aws, prometheus-operator, falco-no-driver, k3s, podman,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: docker, trivy, spire-server, fscrypt, gatus, argo-events, external-secrets-operator, minio, prometheus, gitlab-kas, external-dns, pulumi-language-java, kaf, kubescape, kine, melange, helm, gptscript, zarf, nfpm, cilium-cli, act, cert-manager, argo-cd, witness, pulumi...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386 OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`

OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRETKEYBASE=OVERWRITEME as the default Rails master key. Combined with cookiesserializer = :marshal, this gives any logged-in user a deterministic...

CVE-2026-46386

OpenProject’s official docker image ships SECRET_KEY_BASE=OVERWRITE_ME and cookies_serializer = :marshal, creating a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader. This enables potential pre-authentication remote code execution, as noted in the ...

vuln-scanner-agent

vuln-scanner-agent A multi-agent vulnerability scanner for Gi...

CVE-2026-54232

A flaw was found in vLLM, an inference and serving engine for large language models LLMs. This vulnerability, a dependency confusion attack, allows a remote attacker to execute arbitrary code with root privileges during the Docker build process. By exploiting this, an attacker can compromise the...

CVE-2026-54515 vulnerabilities

Vulnerabilities for packages: apache-pulsar-fips, flyway-fips, opensearch, ruby3.4-jrjackson, zaproxy, spark-kubernetes-operator-fips, apache-polaris-fips, tez, kafka-bridge-fips, hadoop-fips, gradle, ruby3.2-jrjackson, apache-tomee, conductor-fips, solr, airflow, geoserver, camunda,...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: apache-pulsar-fips, flyway-fips, opensearch, ruby3.4-jrjackson, zaproxy, spark-kubernetes-operator-fips, apache-polaris-fips, tez, kafka-bridge-fips, hadoop-fips, gradle, ruby3.2-jrjackson, apache-tomee, conductor-fips, solr, airflow, geoserver, camunda,...

CVE-2026-54515 vulnerabilities

Vulnerabilities for packages: ruby3.2-jrjackson, confluent-kafka, apache-nifi-registry, keycloak, ruby4.0-jrjackson, spdx-tools-java, wavefront-proxy, akhq, kserve-modelmesh, scala, strimzi-kafka-operator, zookeeper, apache-pulsar, keycloak-config-cli, management-api-for-apache-cassandra-5.0,...

GHSA-5JMJ-H7XM-6Q6V vulnerabilities

Vulnerabilities for packages: ruby3.2-jrjackson, confluent-kafka, apache-nifi-registry, keycloak, ruby4.0-jrjackson, spdx-tools-java, wavefront-proxy, akhq, kserve-modelmesh, scala, strimzi-kafka-operator, zookeeper, apache-pulsar, keycloak-config-cli, management-api-for-apache-cassandra-5.0,...