613855 matches found
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: syft: syft-1.49.0-0.1.hum1 aarch64, x8664 syft-1.49.0-0.1.hum1.src src...
Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
MAL-2026-10979 Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
Malicious code in comp-colors (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ac2a6fc7368c6b3ed1bfac9a3a9ea25e9a54ba5d980a48767c811e03fc72566 The package presents itself as a local color-palette toolkit but exports a public colors function in remote.py that POSTs to the hardcoded endpoint...
MAL-2026-10986 Malicious code in comp-colors (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ac2a6fc7368c6b3ed1bfac9a3a9ea25e9a54ba5d980a48767c811e03fc72566 The package presents itself as a local color-palette toolkit but exports a public colors function in remote.py that POSTs to the hardcoded endpoint...
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...
GHSA-WWQQ-X6W4-FRM2 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through the UpdatePullRequest function. An attacker can cause unauthorized modifications to private repository branches by exploiting a logic flaw in token scope validation during pull request updates from a publ...
GHSA-J3F2-48V5-CCWW vulnerabilities
Vulnerabilities for packages: opentelemetry-auto-instrumentations-node, vitess, jitsucom-jitsu, cadence-web, thingsboard-fips, pulumi, nemo, librechat, kubeflow-centraldashboard, langfuse-fips, homepage, kibana...
CVE-2026-13149 vulnerabilities
Vulnerabilities for packages: thingsboard, lerna, renovate, langfuse, ts-patch, serve, nextcloud-server, saf, pulumi, jupyter-base-notebook, prism, sqlpad, opensearch-dashboards, rancher-api-ui...
GHSA-3JXR-9VMJ-R5CP vulnerabilities
Vulnerabilities for packages: thingsboard, lerna, renovate, langfuse, ts-patch, serve, nextcloud-server, saf, pulumi, jupyter-base-notebook, prism, sqlpad, opensearch-dashboards, rancher-api-ui...
GHSA-6HM7-3PWJ-22RM Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload
Gitea's Debian package registry parser contains an unbounded decompression vulnerability in ParseControlFile. When processing an uploaded .deb file, the parser decompresses control.tar.gz and copies the entire uncompressed stream into a strings.Builder via a TeeReader, with no limit on how much...
Exposure of Sensitive Information Through Metadata
Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via the EarlyResponseForGoGetMeta function. An attacker can obtain sensitive repository metadata, such as the existence of private repositories, their clone URLs, and default branch...
GHSA-9MQ6-MQJJ-C2C5 Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Gitea records non-dot regular file entries...
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads
Summary Hello Gitea Security Team, Thank you for your continued work on Gitea. I would like to responsibly report a potential availability-impact issue that I observed in Gitea’s Arch package registry implementation. During local testing, I noticed that Gitea records non-dot regular file entries...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the CheckAuthToken function. An attacker can maintain unauthorized, persistent access to a user's account by reusing a stolen Remember-Me token, as the compromised session is not invalidated even after...
Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Summary After PR 37118 / CVE-2026-25714 fix: Unify public-only token filtering in API queries and repo access checks, merged 2026-05-18, backport 37773 to 1.26.2 — the May 2026 unification pass for public-only token filtering, reporter Medoedus per the 1.26.2 release notes, the public-only PAT...
GHSA-7P4H-3GXQ-X3H3 Gitea: Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118
Summary After PR 37118 / CVE-2026-25714 fix: Unify public-only token filtering in API queries and repo access checks, merged 2026-05-18, backport 37773 to 1.26.2 — the May 2026 unification pass for public-only token filtering, reporter Medoedus per the 1.26.2 release notes, the public-only PAT...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the checkTokenPublicOnly function when handling Repository and Package categories with owners set to limited visibility. An attacker can gain unauthorized access to internal repository or package content by...