110 matches found
GHSA-JHF3-XXHW-2WPP vulnerabilities
Vulnerabilities for packages: zot, rancher-fleet, steampipe, flux, gptscript, dagger, gitea, gitsign, kubescape, scorecard, melange, tfsec, wolfictl, gomplate, kubevela, trufflehog, snyk-cli, xeol, flux-source-controller, nfpm, gitlab-runner, bom, osv-scanner, gitaly, witness, zarf,...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: zot, rancher-fleet, steampipe, flux, gptscript, dagger, gitea, gitsign, kubescape, scorecard, melange, tfsec, wolfictl, gomplate, kubevela, trufflehog, snyk-cli, xeol, flux-source-controller, nfpm, gitlab-runner, bom, osv-scanner, gitaly, witness, zarf,...
CVE-2026-33762 vulnerabilities
Vulnerabilities for packages: zot, rancher-fleet, steampipe, flux, gptscript, dagger, gitea, gitsign, kubescape, scorecard, melange, tfsec, wolfictl, gomplate, kubevela, trufflehog, snyk-cli, xeol, flux-source-controller, nfpm, gitlab-runner, bom, osv-scanner, gitaly, witness, zarf,...
CVE-2026-34165 vulnerabilities
Vulnerabilities for packages: zot, rancher-fleet, steampipe, flux, gptscript, dagger, gitea, gitsign, kubescape, scorecard, melange, tfsec, wolfictl, gomplate, kubevela, trufflehog, snyk-cli, xeol, flux-source-controller, nfpm, gitlab-runner, bom, osv-scanner, gitaly, witness, zarf,...
GO-2026-4717 Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration in github.com/akuity/kargo
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration in github.com/akuity/kargo...
CVE-2026-25365
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...
EUVD-2026-15687
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...
CVE-2026-25365
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...
CVE-2026-25365 WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...
CVE-2026-25365
CVE-2026-25365 describes a Missing Authorization vulnerability in the Kargo Takip WordPress plugin affecting versions < 0.2.4. Public sources flag Missing Authorization for Kargo Takip (
CVE-2026-25365 WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Özgür KARALAR Kargo Takip kargo-takip-turkiye allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kargo Takip: from n/a through 0.2.4...
SUSE CVE-2026-32828
Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery SSRF against link-local addresses, most...
PT-2026-27923
Name of the Vulnerable Software and Affected Versions Kargo Takip versions prior to 0.2.4 Description A missing authorization flaw exists in Özgür KARALAR Kargo Takip kargo-takip-turkiye. This issue stems from incorrectly configured access control security levels, potentially allowing unauthorize...
WordPress plugin Kargo Takip 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...
WordPress Kargo Takip plugin < 0.2.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Kargo Takip versions 0.2.4...
CVE-2026-32828
CVE-2026-32828 affects Kargo promotions: versions 1.4.0–1.6.3, 1.7.0-rc.1–1.7.8, 1.8.0-rc.1–1.8.11, and 1.9.0-rc.1–1.9.4 have HTTP/http-download promotion steps that allow SSRF against link-local addresses, notably 169.254.169.254, enabling exfiltration of sensitive data (e.g., IAM credentials) w...
CVE-2026-32828 Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery SSRF against link-local addresses, most...
CVE-2026-32828 Kargo: SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
Kargo manages and automates the promotion of software artifacts. In versions 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4, the http and http-download promotion steps allow Server-Side Request Forgery SSRF against link-local addresses, most...
kargo 代码问题漏洞
Kargo is an open-source continuous delivery tool developed by Akuity. Versions of Kargo prior to 1.6.3, 1.7.8 and earlier, 1.8.11 and earlier, as well as 1.9.4 and earlier, have code vulnerabilities. These vulnerabilities stem from server-side request forgery during the HTTP and http-download...
Kargo Vulnerable to SSRF in Promotion http/http-download Steps Enables Internal Network Access and Data Exfiltration
Summary Kargo's built-in http and http-download promotion steps execute outbound HTTP requests from the Kargo controller. By design, these steps do not restrict destination addresses, as there are legitimate use cases for requests to internal and private endpoints. However, this also permits...