OPENSUSE-SU-2025:15775-1 opa-1.11.0-1.1 on GA media

These are all security issues fixed in the opa-1.11.0-1.1 package on the GA media of openSUSE Tumbleweed...

EUVD-2025-33793

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. A vulnerability was discovered in the BeyondTrust provider implementation for External Secrets Operator versions 0.10.1 through 0.19.2. The provider previously...

EUVD-2015-5228

Malware in sbrugna...

EUVD-2006-1884

Malware in sbrugna...

EUVD-2025-12838

Malicious code in bioql PyPI...

EUVD-2024-2556

Malicious code in bioql PyPI...

EUVD-2024-2263

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2024-40627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: longhorn-instance-manager, sqlexporter-fips, cluster-autoscaler-fips, dragonfly-operator, verticadb-operator-fips, yam, crossplane-provider-azure-managedidentity, kubernetes-csi-external-provisioner-fips, mkcert, cluster-api-helm-controller-fips, temporal,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2025:02592-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02592-1 advisory. Update to version 2.5.3 jscSLE-23879: - CVE-2025-46569: Fixed OPA server Data API HTTP path injection of...

Security update for cosign

This update for cosign fixes the following issues: Update to version 2.5.3 jscSLE-23879: CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego bsc1246725 Changelog: Update to 2.5.3: Add signing-config create command 4280 Allow multiple services to be specified for trusted-root...

SUSE-SU-2025:02592-1 Security update for cosign

This update for cosign fixes the following issues: Update to version 2.5.3 jscSLE-23879: - CVE-2025-46569: Fixed OPA server Data API HTTP path injection of Rego bsc1246725 Changelog: Update to 2.5.3: - Add signing-config create command 4280 - Allow multiple services to be specified for trusted-ro...

CVE-2025-46569 affecting package opa for versions less than 0.63.0-2

CVE-2025-46569 affecting package opa for versions less than 0.63.0-2. A patched version of the package is available...

OPENSUSE-SU-2025:15253-1 opa-1.6.0-1.1 on GA media

These are all security issues fixed in the opa-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-40627

Fastapi OPA is an opensource fastapi middleware which includes auth flow. HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. OpaMiddleware allows all HTTP OPTIONS requests without evaluating it against...

GO-2025-3660 OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa

OPA server Data API HTTP path injection of Rego in github.com/open-policy-agent/opa...

Incorrect Authorization

Overview github.com/open-policy-agent/opa/server is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack. Affected versions of this package are vulnerable to Incorrect Authorization via the HTTP Data API. An attacker can...

CVE-2025-46569 OPA server Data API HTTP path injection of Rego

Open Policy Agent OPA is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a singl...

CVE-2025-46569 OPA server Data API HTTP path injection of Rego

Open Policy Agent OPA is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a singl...

GHSA-6M8W-JC87-6CR7 OPA server Data API HTTP path injection of Rego

Impact When run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used...