vet

Find malicious packages, vulnerabilities and risky CI workflows before they reach production. Install • Docs • Commands • Policy • Discord !NOTE This branch is vet v2, in alpha. vet v1 is on main and stays the latest release. The v2.0.0 release notes map each v1 command and flag to v2. Why vet Yo...

GO-2026-5761 vulnerabilities

Vulnerabilities for packages: sriov-network-device-plugin-fips, k8s-device-plugin-fips, rancher, buildah-fips, podman, buildah, sriov-network-device-plugin, node-feature-discovery-fips, podman-fips, docker-machine-driver-harvester, cadvisor, prometheus-podman-exporter-fips, gpu-operator,...

GO-2026-5746 vulnerabilities

Vulnerabilities for packages: cloudbeat, kpt, kubedock-fips, chainloop-control-plane, opentelemetry-operator-fips, amazon-cloudwatch-agent-operator-fips, rancher-machine, spire-server, envoy-gateway-fips, rancher, buildah-fips, nerdctl, podman, vault, datadog-agent, google-cloud-otel-ops-collecto...

GO-2024-2824 vulnerabilities

Vulnerabilities for packages: step-ca-fips, cortex, cert-manager-webhook-pdns-fips, certificate-transparency, jitsucom-bulker, wavefront-collector-for-kubernetes, cue-fips, flux-image-reflector-controller, guac, kube-bench-fips, atlantis-fips, mage, redka, cloudflared, cosign-fips, helm-push,...

GO-2026-4867 vulnerabilities

Vulnerabilities for packages: influx, gitlab-pages, kubeflow-katib, knative-eventing, verticadb-operator, kubernetes, net-kourier, external-secrets-operator, nri-consul, fuse-overlayfs-snapshotter, buf, percona-server-mongodb-operator, cni-plugins, blobfuse2, nats-top, mage, newrelic-nri-statsd,...

GO-2026-4870 vulnerabilities

Vulnerabilities for packages: terraform-provider-time, smokescreen, wuzz, grpc-health-probe, external-secrets-operator, buf, mods, docker-credential-gcr, nats-top, pluto, dask-gateway, memcached-exporter, kubescape, zot, kyverno-policy-reporter-ui, rancher-agent, mountpoint-s3-csi-driver, pulumi,...

GO-2026-5020 vulnerabilities

Vulnerabilities for packages: chisel, flux, kots, crossplane-provider-aws-eks, external-secrets-operator, trivy-operator, mods, flux-notification-controller, gh, containerd, k9s, steampipe, act, ko, crossplane-provider-aws-dynamodb, kubescape, minio, gomplate, crossplane-provider-keycloak, zot,...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Checker A portable Bash script to detect vulne...

Linux Distros Unpatched Vulnerability : CVE-2024-1724

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu,...

Linux Distros Unpatched Vulnerability : CVE-2010-3836

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service assertion failure and server cra...

Node.js Users Beware: Manifest Confusion Attack Opens Door to Malware

The npm registry for the Node.js JavaScript runtime environment is susceptible to what's called a manifest confusion attack that could potentially allow threat actors to conceal malware in project dependencies or perform arbitrary script execution during installation. "A npm package's manifest is...

RHEL 7 : rh-nodejs10-nodejs (RHSA-2020:0597)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0597 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

GuardDog vulnerable to arbitrary file write when scanning a specially-crafted PyPI package

Impact Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed. This is due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the...

Salt Open Linux Vulnerability Scanner: Salt Scanner

Salt Open Linux Vulnerability Scanner A linux vulnerability scanner based on Vulners Audit API and Salt Open, with Slack notifications. Requirements Salt Open salt-master, salt-minion¹ Python 2.7 Salt pip install salt==2016.11.5 Slackclient pip install slackclient==1.0.5 Usage root@localhost pyth...