194982 matches found
GHSA-2F9F-GQ7V-9H6M vulnerabilities
Vulnerabilities for packages: vector, parseable...
CVE-2026-43868 vulnerabilities
Vulnerabilities for packages: vector, parseable...
GHSA-2F9F-GQ7V-9H6M vulnerabilities
Vulnerabilities for packages: vector, parseable...
CVE-2026-43868 vulnerabilities
Vulnerabilities for packages: vector, parseable...
CVE-2026-44427 vulnerabilities
Vulnerabilities for packages: goreleaser...
Trust Me, Import This: Dependency Steering Attacks Via Malicious Agent Skills
LLM-powered coding agents increasingly make software supply chain decisions. They generate imports, recommend packages, and write installation commands. Prior work showed that these systems can hallucinate non-existent package names, which attackers may register as malicious packages. In this...
CVE-2026-42574
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
EUVD-2026-28934
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...
CVE-2026-42575 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...
EUVD-2026-28933
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...
CVE-2026-42574
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
EUVD-2026-28932
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...
Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: podman: podman-5.8.2-1.1.hum1 aarch64, x8664 podman-docker-5.8.2-1.1.hum1 noarch podman-machine-5.8.2-1.1.hum1 aarch64, x8664 podman-remote-5.8.2-1.1.hum1 aarch64, x8664 podman-tests-5.8.2-1.1.hu...
@claspo/common (>=5.2.1-theme.13, <=7.4.0), @claspo/components (>=1.1.14, <=1.10.12) +3 more potentially affected by CVE-2026-44966 via velocityjs (2.0.6)
velocityjs NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.4.1 Source cves: CVE-2026-44966 Source...
Linux Distros Unpatched Vulnerability : CVE-2025-71296
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/tests: shmem: Hold reservation lock around purge Acquire and release the GEM object's reservation lock around calls to the object's purge operation. The tes...
Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-1685)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1685 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...
Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2026-1683)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1683 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...
apko 路径遍历漏洞
Apko is an open-source OCI image builder based on APK. In versions 0.14.8 to 1.2.5 of Apko, there was a path traversal vulnerability. This vulnerability occurred because specially crafted APK packages could install entries that pointed to directories other than the build root directory. This...
