474 matches found
Towards Predicting Multi-Vulnerability Attack Chains in Software Supply Chains from Software Bill of Materials Graphs
Software supply chain security compromises often stem from cascaded interactions of vulnerabilities, for example, between multiple vulnerable components. Yet, Software Bill of Materials SBOM-based pipelines for security analysis typically treat scanner findings as independent per-CVE Common...
GHSA-GM2X-2G9H-CCM8 vulnerabilities
Vulnerabilities for packages: kargo, apko, nfpm, argo-workflows, gitsign, osv-scanner, skaffold, teleport, trivy, syft, scorecard, zarf, crossplane, pulumi-language-yaml, grype, melange, witness, snyk-cli, flux-image-automation-controller, zot, nuclei, chezmoi, pulumi-language-dotnet, trufflehog,...
CVE-2026-33481
A flaw was found in Syft, a tool for generating Software Bill of Materials SBOM. When Syft scans large or highly compressed archives, it unpacks them into temporary storage. If this process exhausts the temporary storage, Syft fails to properly clean up these files. This can lead to the temporary...
Tillitis TKey Client package security vulnerability
The Tillitis TKey Client package is an open-source client library in Go language developed by Tillitis AB, designed for controlling hardware security keys. Versions of the Tillitis TKey Client package prior to 1.2.0 contained security vulnerabilities. These vulnerabilities were caused by buffer...
wolfSSL security vulnerabilities
wolfSSL CyaSSL is a small, portable embedded SSL programming library developed by the American company wolfSSL, designed for developers working with embedded systems. There is a security vulnerability in wolfSSL. This vulnerability stems from a protection mechanism that fails in the post-quantum...
aicerberus
AICerberus 🐺 AI supply chain security scanner — one comma...
ConnectWise ScreenConnect security vulnerabilities
ConnectWise ScreenConnect is a self-hosted remote desktop software application developed by ConnectWise. There is a security vulnerability in ConnectWise ScreenConnect, which arises from the possibility that participants with server-level authentication encryption materials may gain unauthorized...
materials-informatics-agent (>=0.1.8, <=0.1.24) potentially affected by CVE-2026-28277 via langgraph (0.3.26)
langgraph PYPI version 0.3.26 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - materials-informatics-agent =0.1.8, =0.1.24 Source cves: CVE-2026-28277 Source advisory: OSV:GHSA-G48C-2WQR-H844...
materials-informatics-agent (>=0.1.8, <=0.1.24) potentially affected by CVE-2026-28277 via langgraph (0.3.26)
langgraph PYPI version 0.3.26 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph and may be impacted: - materials-informatics-agent =0.1.8, =0.1.24 Source cves: CVE-2026-28277 Source advisory: OSV:PYSEC-2026-83...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
SBOM CVE Scanner - Enhanced Edition A comprehensive Python to...
Cross-site Scripting (XSS)
Overview indico is a conference lifecycle management and meeting/lecture scheduling tool. Affected versions of this package are vulnerable to Cross-site Scripting XSS when uploading unspecified files as materials. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...
CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace
melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...
CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace
melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...
Uncovering Hidden Inclusions of Vulnerable Dependencies in Real-World Java Projects
Open-source software OSS dependencies are a dominant component of modern software code bases. Using proven and well-tested OSS components lets developers reduce development time and cost while improving quality. However, heavy reliance on open-source software also introduces significant security...
Putting Privacy to the Test: Introducing Red Teaming for Research Data Anonymization
Recently, the data protection practices of researchers in human-computer interaction and elsewhere have gained attention. Initial results suggest that researchers struggle with anonymization, partly due to a lack of clear, actionable guidance. In this work, we propose simulating re-identification...
Cascaded Vulnerability Attacks in Software Supply Chains
Most of the current software security analysis tools assess vulnerabilities in isolation. However, sophisticated software supply chain security threats often stem from cascaded vulnerability and security weakness chains that span dependent components. Moreover, although the adoption of Software...
Altium Enterprise Server security vulnerabilities
Altium Enterprise Server is a localization data management server developed by Altium Corporation in the United States. Version 7.0.3 of Altium Enterprise Server contains a security vulnerability. This vulnerability stems from a stored-xss attack in the Description field of the BOM Viewer, which...
CVE-2025-14802
The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v1/material/fileid REST API endpoint. This is due to a parameter mismatch between the DELETE operation and authorization check, where the...