GO-2023-1840 vulnerabilities

Vulnerabilities for packages: policy-controller, kubeflow-katib, kind...

GO-2023-1987 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, go, kind...

GO-2023-1878 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, go, kind...

GO-2022-0493 vulnerabilities

Vulnerabilities for packages: kind, ctop, k3d, grpcurl, terraform-provider-sendgrid, kubeflow, dynamic-localpv-provisioner...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: k3s, mongo-tools, aws-otel-collector, nri-f5, nuclei, glow, chartmuseum, rabbitmq-default-user-credential-updater, cerbos, ipfs-cluster, nri-nginx, cluster-api-azure-controller, cni-plugins, dive, kapp-controller, kpt, witness, swagger, tekton-chains, kapp, wal-g,...

CVE-2026-63759: Uncontrolled Recursion

SurrealDB before 3.1.0 fails to enforce recursion depth limits in the type/kind parser when processing nested type annotations. Authenticated attackers can send queries with deeply nested type annotations to exhaust server memory and crash the process...

PYSEC-2026-2969 psd-tools vulnerable to arbitrary file write via smart-object filename

psd-tools: arbitrary file write/read via smart-object path traversal Summary In psd-tools all releases exposing the SmartObject API through v1.17.0, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitise...

psd-tools vulnerable to arbitrary file write via smart-object filename

psd-tools: arbitrary file write/read via smart-object path traversal SummaryIn psd-tools all releases exposing the SmartObject API through v1.17.0, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised...

PT-2026-59600

psd-tools: arbitrary file write/read via smart-object path traversal Summary In psd-tools all releases exposing the SmartObject API through v1.17.0, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitise...

[SECURITY] Fedora 43 Update: kind-0.31.0-4.fc43

Kubernetes IN Docker - local clusters for testing Kubernetes...

[SECURITY] Fedora 44 Update: kind-0.31.0-4.fc44

Kubernetes IN Docker - local clusters for testing Kubernetes...

GHSA-2RMG-VRX8-9J2F psd-tools vulnerable to arbitrary file write via smart-object filename

psd-tools: arbitrary file write/read via smart-object path traversal Summary In psd-tools all releases exposing the SmartObject API through v1.17.0, SmartObject.save writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitise...

Fedora 45 : kind (2026-c4a4c6a033)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c4a4c6a033 advisory. Automatic update for kind-0.31.0-4.fc45. Changelog Tue Jul 7 2026 blinxen - 0.31.0-4 - Rebuild rhbz2494326 Tenable has extracted the preceding description...

GHSA-Q8QP-67F9-WR3F SurrealDB vulnerable to Denial of Service due to nested types annotations

The SurrealDB type/kind parser did not enforce the configured recursion depth limit when parsing nested type annotations. The expression parser already enforced the limit for analogous constructs; the kind parser omitted it. An authenticated attacker could send a query with deeply nested type...

The vulnerability of the gf_isom_add_track_kind() function in the isomedia/isom_write.c file, implemented by the MP4Box encoder for the GPAC multimedia platform, allows a malicious actor to cause service interruptions using a specially created MP4 file.

The vulnerability of the gfisomaddtrackkind function in the isomedia/isomwrite.c file, belonging to the MP4Box encoder of the GPAC multimedia platform, is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause service failures through the use of a...

DEBIAN-CVE-2025-55639

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gfisomaddtrackkind function at isomedia/isomwrite.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

CVE-2025-55639

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gfisomaddtrackkind function at isomedia/isomwrite.c. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

PT-2026-51526

Name of the Vulnerable Software and Affected Versions GPAC MP4Box version 2.4 Description A NULL pointer dereference exists in the gf isom add track kind function within the isomedia/isom write.c file. This issue allows a remote attacker to trigger a Denial of Service DoS by processing a speciall...

GHSA-RCX4-77X4-HJX5 Duplicate Advisory: OpenClaw ACP client has permission auto-approval bypass via untrusted tool metadata

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7jx5-9fjg-hp4m. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approv...

PT-2026-26747

OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool...