CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: slsa-verifier, litestream, ctop, kwok, chezmoi, knative-client, malcontent, chartmuseum, sftpgo-plugin-pubsub, otel-cli, ingress-nginx-controller, goreleaser, kubernetes-csi-external-resizer, step, filebrowser, mariadb-operator, github-mcp-server, gcsfuse,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: teleport, opentelemetry-collector, nfpm, malcontent, dagger, minio, tempo, terraform-mcp-server, opentelemetry-collector-contrib, gitlab-runner, goreleaser, dgraph, mcp-grafana, redpanda, maru, nuclei, loki, cri-tools, eksctl, terragrunt, k8sgpt, grafana, rclone,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, trivy-operator, guac, google-osconfig-agent, trivy-operator-fips, kots, gitsign, crossplane-fips, packer, pulumi-language-yaml, livekit-cli, flux, gitaly-fips, grafana, tfsec, kyverno-fips, kubevela, kubescape-server, zot, dagger, melange,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, trivy-operator, guac, google-osconfig-agent, trivy-operator-fips, kots, gitsign, crossplane-fips, packer, pulumi-language-yaml, livekit-cli, flux, gitaly-fips, grafana, tfsec, kyverno-fips, kubevela, kubescape-server, zot, dagger, melange,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: argo-workflows-fips, trivy-operator, guac, google-osconfig-agent, trivy-operator-fips, kots, gitsign, crossplane-fips, packer, pulumi-language-yaml, livekit-cli, flux, gitaly-fips, grafana, tfsec, kyverno-fips, kubevela, kubescape-server, zot, dagger, melange,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: scorecard, skaffold, teleport, gptscript, bom, kaniko, pulumi-language-yaml, trufflehog, osv-scanner, kots, chezmoi, nfpm, trivy-operator, argo-cd, pulumi-language-dotnet, kubescape, dagger, xeol, trivy, argo-workflows, zot, cerbos, wolfictl, guac, steampipe, grype,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: scorecard, skaffold, teleport, gptscript, bom, kaniko, pulumi-language-yaml, trufflehog, osv-scanner, kots, chezmoi, nfpm, trivy-operator, argo-cd, pulumi-language-dotnet, kubescape, dagger, xeol, trivy, argo-workflows, zot, cerbos, wolfictl, guac, steampipe, grype,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: scorecard, skaffold, teleport, gptscript, bom, kaniko, pulumi-language-yaml, trufflehog, osv-scanner, kots, chezmoi, nfpm, trivy-operator, argo-cd, pulumi-language-dotnet, kubescape, dagger, xeol, trivy, argo-workflows, zot, cerbos, wolfictl, guac, steampipe, grype,...

EUVD-2023-1637

Malicious code in bioql PyPI...

Information Disclosure

github.com/goreleaser/nfpm is vulnerable to Information Disclosure. The vulnerability exists due to improper permission configuration in files and folders which allows an attacker access to the package on the file system...

CVE-2023-32698

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

CVE-2023-32698

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

Code injection

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

CVE-2023-32698

CVE-2023-32698 affects the nfpm tool (GoReleaser nfpm) where, if files are packaged without enforcing nfpm’s own permissions, checked‑in files could be created with dangerous permissions (e.g., 666 or 777). The root cause is incorrect/default file permission handling during packaging, leading to ...

CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions

nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files without extra config for enforcing it’s own permissions files could go out with bad permissions chmod 666 or 777. Anyone using nfpm for creating packages without...

nFPM 安全漏洞

nFPM is a GoReleaser open source simple deb, rpm and apk packaging program written in Go. There is a security vulnerability in nFPM that stems from the fact that anyone using nFPM to create packages without checking/setting file permissions prior to packaging can result in incorrect permissions o...

GHSA-W7JW-Q4FG-QC4C nfpm has incorrect default permissions

Summary When building packages directly from source control, file permissions on the checked-in files are not maintained. Details When building packages directly from source control, file permissions on the checked-in files are not maintained. When nfpm packaged the files without extra config for...

nfpm has incorrect default permissions

Summary When building packages directly from source control, file permissions on the checked-in files are not maintained. Details When building packages directly from source control, file permissions on the checked-in files are not maintained. When nfpm packaged the files without extra config for...