415 matches found
External Secrets 授权问题漏洞
External Secrets is an open-source Kubernetes-related application developed by External Secrets. Versions of External Secrets prior to 2.4.0 had an authorization issue vulnerability. This vulnerability stemmed from the use of CAProvider for the SecretStore resource, allowing it to resolve CA...
GHSA-PMWQ-PJRM-6P5R vulnerabilities
Vulnerabilities for packages: tkn, vexctl, teleport, zot, kubescape, guac, rekor, buildkitd, goreleaser, zarf, kyverno, trivy, bom, slsa-verifier, ratify, flux-source-controller, gh, neuvector-sigstore-interface, gitlab-runner, cosign, crossplane, aactl, gitsign, falcoctl, spire-server,...
CVE-2025-70069
An issue in Assimp v.6.0.2 allows a remote attacker to cause a denial of service via the FBXConverter.cpp and ConvertMeshMultiMaterial method...
AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache
Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...
MINI-7WQJ-M8M9-RM37
Bulletin has no description...
Towards Personalizing Secure Programming Education with LLM-Injected Vulnerabilities
According to constructivist theory, students learn software security more effectively when examples are grounded in their own code. Generic examples often fail to connect with students' prior work, limiting engagement and understanding. Advances in LLMs are now making it possible to automatically...
OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident
OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user data or internal system was compromised. "Out of an abundance of caution, we are taking steps to protect the process that certifies our macO...
[SECURITY] Fedora 43 Update: trivy-0.69.3-1.fc43
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more...
MINI-W6R6-JM6W-XX9M
Bulletin has no description...
Towards Predicting Multi-Vulnerability Attack Chains in Software Supply Chains from Software Bill of Materials Graphs
Software supply chain security compromises often stem from cascaded interactions of vulnerabilities, for example, between multiple vulnerable components. Yet, Software Bill of Materials SBOM-based pipelines for security analysis typically treat scanner findings as independent per-CVE Common...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: pulumi, pulumi-language-dotnet, argo-events, syft, grafana-alloy, teleport, gptscript, kubescape, zot, kaniko, pulumi-kubernetes-operator, chezmoi, guac, tfsec, pulumi-language-yaml, kots, witness, zarf, flux, argo-workflows, kubevela, k9s, apko, kyverno, trivy,...
CVE-2026-33481
A flaw was found in Syft, a tool for generating Software Bill of Materials SBOM. When Syft scans large or highly compressed archives, it unpacks them into temporary storage. If this process exhausts the temporary storage, Syft fails to properly clean up these files. This can lead to the temporary...
Tillitis TKey Client package 安全漏洞
The Tillitis TKey Client package is an open-source client library in Go language developed by Tillitis AB, designed for controlling hardware security keys. Versions of the Tillitis TKey Client package prior to 1.2.0 contained security vulnerabilities. These vulnerabilities were caused by buffer...
wolfSSL 安全漏洞
wolfSSL CyaSSL is a small, portable embedded SSL programming library developed by the American company wolfSSL, designed for developers working with embedded systems. There is a security vulnerability in wolfSSL. This vulnerability stems from a protection mechanism that fails in the post-quantum...
aicerberus
AICerberus 🐺 AI supply chain security scanner — one comma...
ConnectWise ScreenConnect 安全漏洞
ConnectWise ScreenConnect is a self-hosted remote desktop software application developed by ConnectWise. There is a security vulnerability in ConnectWise ScreenConnect, which arises from the possibility that participants with server-level authentication encryption materials may gain unauthorized...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
SBOM CVE Scanner - Enhanced Edition A comprehensive Python to...
Cross-site Scripting (XSS)
Overview indico is a conference lifecycle management and meeting/lecture scheduling tool. Affected versions of this package are vulnerable to Cross-site Scripting XSS when uploading unspecified files as materials. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...