36511 matches found
CVE-2026-33314
creationtimestamp| type| source ---|---|--- 2026-03-19 17:55:53+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-q485-cg9q-xq2r...
GHSA-WJ64-GH9J-XM82 vulnerabilities
Vulnerabilities for packages: openssl...
CVE-2026-32737
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod...
CVE-2026-32805
CVE-2026-32805 corresponds to an Archive Slip flaw in Romeo’s webserver sanitization (github.com/ctfer-io/romeo/webserver). The root cause is a missing trailing path separator in the strings.HasPrefix check within sanitizeArchivePath, enabling a crafted tar to traverse outside the intended destin...
CVE-2026-32805
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the sanitizeArchivePath function in webserver/api/v1/decoder.go lines 80-88 is vulnerable to a path...
EUVD-2026-12999
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod...
CVE-2026-32737
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod...
CVE-2026-32737
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod...
GHSA-6P9P-Q6WH-9J89 vulnerabilities
Vulnerabilities for packages: dagdotdev...
com.github.bogdanlivadariu:bootstraped-multi-test-results-report (>=0.0.2, <=1.3.0), org.jenkins-ci.main:jenkins-test-harness (1.615) +4 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.615)
org.jenkins-ci.main:jenkins-core MAVEN version 1.615 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.github.bogdanlivadariu:bootstraped-multi-test-results-report =0.0.2, =1.76, =2.1.2, =2.1.3...
com.coravy.hudson.plugins.github:github (>=1.1, <=1.8), org.jenkins-ci.main:jenkins-test-harness (1.445) +7 more potentially affected by CVE-2026-33001 via org.jenkins-ci.main:jenkins-core (1.445)
org.jenkins-ci.main:jenkins-core MAVEN version 1.445 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.coravy.hudson.plugins.github:github =1.1, =1.88, =1.1, =1.3 Source cves: CVE-2026-33001...
CVE-2026-32694
creationtimestamp| type| source ---|---|--- 2026-03-18 12:55:22+00:00| published-proof-of-concept| https://github.com/juju/juju/security/advisories/GHSA-5cj2-rqqf-hx9p...
GHSA-5PWR-322W-8JR4 vulnerabilities
Vulnerabilities for packages: gitlab-cng-fips, awx, superset, datahub-ingestion, keep, mitmproxy, keep-fips, py3-cassandra-medusa, az, dbt-snowflake, localstack, request-1276, airflow, ggshield, datadog-agent-fips, gitlab-cng, datadog-agent...
CVE-2026-32805: Improper Limitation of a Pathname to a Restricted Directory
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.2, the sanitizeArchivePath function in webserver/api/v1/decoder.go lines 80-88 is vulnerable to a path...
CVE-2026-32737: Improper Access Control
Romeo gives the capability to reach high code coverage of Go ≥1.20 apps by helping to measure code coverage for functional and integration tests within GitHub Actions. Prior to version 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can pivot from the "hardened" namespace to any Pod...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the URL validation logic due to improper handling of underscores in hostnames. An attacker can access internal resources or sensitive endpoints by submitting specially crafted URLs containing...
Egress Policy Bypass via DNS over HTTPS (DoH) in Harden-Runner (Community Tier)
Summary A vulnerability exists in the Community Tier of Harden-Runner that allows bypassing the egress-policy: block network restriction using DNS over HTTPS DoH. Harden-Runner secures GitHub Actions workflows on runners by applying network policies, including an allowed-endpoints configuration...
Egress Policy Bypass via DNS over TCP in Harden-Runner (Community Tier)
Summary A vulnerability exists in the Community Tier of Harden-Runner that allows bypassing the egress-policy: block network restriction using DNS queries over TCP. Harden-Runner enforces egress policies on GitHub runners by filtering outbound connections at the network layer. When egress-policy:...
Investing in the people shaping open source and securing the future together
Open source has always been about community. It's about maintainers who review pull requests late at night. Volunteers who respond to security reports from strangers. And communities that quietly power the world's software. The reality behind the commits is that maintainers get stretched thin. Th...
