1156 matches found
PT-2026-34176
Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions prior to 1.11.1 Description A validation bypass in the VolumeMount path restriction allows mounting volumes under restricted '/tekton/' internal paths by using '..' path traversal components. The restriction check use...
Tekton Pipelines 资源管理错误漏洞
Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. Versions of Tekton Pipelines prior to 1.11.1 contained a resource management vulnerability. This vulnerability stemmed from the FetchHttpResource function in the HTTP parser, which did not limit the size of the response...
PT-2026-34008
Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions 1.0.0 through 1.10.0 Description The git resolver in API mode sends the system-configured Git API token to a user-controlled 'serverURL' when the token parameter is omitted. A tenant with TaskRun or PipelineRun create...
Tekton Pipelines 参数注入漏洞
Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. In versions 1.0.0 to 1.11.0 of Tekton Pipelines, there is a parameter injection vulnerability. This vulnerability stems from the fact that the revision parameter of the git resolver is passed directly as a positional...
Tekton Pipelines 路径遍历漏洞
Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. Versions of Tekton Pipelines prior to 1.11.1 contained a path traversal vulnerability. This vulnerability stemmed from a validation bypass in the VolumeMount path restrictions, allowing path traversal components to mount...
PT-2026-34180
Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions 1.0.0 through 1.10.x Description The git resolver fails to validate the revision parameter, which is passed directly as a positional argument to the git fetch command. This allows an attacker to inject arbitrary flags...
PT-2026-34001
Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions 0.43.0 through 1.11.0 Description Trusted resources verification policies match a resource source string refSource.URI against spec.resources.pattern using the regexp.MatchString function. Because this function report...
PT-2026-34177
Name of the Vulnerable Software and Affected Versions Tekton Pipelines versions prior to 1.11.1 Description The HTTP resolver's FetchHttpResource function reads response bodies without a size limit. A user with permissions to create TaskRuns or PipelineRuns can point the resolver to a malicious...
Tekton Pipelines 安全漏洞
Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. There are security vulnerabilities in versions 1.0.0 to 1.10.0 of Tekton Pipelines. These vulnerabilities stem from the git resolver in API mode, which, when a token parameter is omitted by the user, will send the...
Tekton Pipelines 安全漏洞
Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. There are security vulnerabilities in versions 0.43.0 to 1.11.0 of Tekton Pipelines. These vulnerabilities stem from improper regular expression matching, which could allow attackers to bypass resource verification...
GHSA-5PV2-86QJ-5JF9 Cockpit has NoSQL Injection Through Content Aggregation Pipelines
A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack...
Giskard Has A Regular Expression Denial Of Service (ReDoS) In RegexMatching Check
Summary The RegexMatching check in the "giskard-checks" package passes a user-supplied regular expression pattern directly to Python's re.search without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: envoy-gateway, argo-cd, gitlab-kas, emissary, redis-operator, velero, rancher-agent, kpt, consul-k8s, kargo, istio, docker-cli-buildx, k8ssandra-client, postgres-operator, falcoctl, datadog-agent, cri-tools, trivy-operator, cloudnative-pg, argo-workflows,...
GHSA-R4Q5-VMMM-2653 vulnerabilities
Vulnerabilities for packages: configurable-http-proxy, saf, argo-workflows, kubeflow-katib, thingsboard, kubeflow-pipelines, code-server, lerna, opensearch-dashboards, langfuse, nextcloud-server, prism...
CVE-2026-35469 vulnerabilities
Vulnerabilities for packages: envoy-gateway, argo-cd, gitlab-kas, emissary, redis-operator, velero, rancher-agent, kpt, consul-k8s, kargo, istio, docker-cli-buildx, k8ssandra-client, postgres-operator, falcoctl, datadog-agent, cri-tools, trivy-operator, cloudnative-pg, argo-workflows,...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: cilium-cli, hubble-fips, longhorn-cli, datadog-agent-fips, commercial-grafana, gpu-operator-fips, k8ssandra-client-fips, cloudnative-pg-fips, kcp-fips, grafana-fips, rancher, zarf-fips, eck-operator, infinispan-operator, terraform-provider-kubernetes-fips,...
CVE-2026-40288
PraisonAI and praisonaiagents prior to versions 4.5.139 and 1.5.140 are exposed to a critical RCE via untrusted workflow YAML. When a YAML file for type: job is loaded, the JobWorkflowExecutor (job_workflow.py) processes steps allowing run (subprocess.run), script (inline Python via exec), and py...
PT-2026-32983
Name of the Vulnerable Software and Affected Versions Giskard versions prior to 1.0.2b1 Description The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to the Python re.search function without a timeout, complexity guard, or pattern...