CVE-2026-40161: Insertion of Sensitive Information Into Sent Data

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the Tekton Pipelines git resolver in API mode sends the system-configured Git API token to a user-controlled serverURL...

Tekton Pipelines 路径遍历漏洞

Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. Versions of Tekton Pipelines prior to 1.11.1 contained a path traversal vulnerability. This vulnerability stemmed from a validation bypass in the VolumeMount path restrictions, allowing path traversal components to mount...

Tekton Pipelines 参数注入漏洞

Tekton Pipelines is a cloud-native pipeline developed by Tekton Open Source. In versions 1.0.0 to 1.11.0 of Tekton Pipelines, there is a parameter injection vulnerability. This vulnerability stems from the fact that the revision parameter of the git resolver is passed directly as a positional...

GHSA-5PV2-86QJ-5JF9 Cockpit has NoSQL Injection Through Content Aggregation Pipelines

A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack...

Giskard Has A Regular Expression Denial Of Service (ReDoS) In RegexMatching Check

Summary The RegexMatching check in the "giskard-checks" package passes a user-supplied regular expression pattern directly to Python's re.search without any timeout, complexity guard, or pattern validation. An attacker who can control the regex pattern or the text being matched can craft inputs...

GHSA-R4Q5-VMMM-2653 vulnerabilities

Vulnerabilities for packages: lerna, prism, nextcloud-server, kubeflow-pipelines, langfuse, kubeflow-katib, code-server, configurable-http-proxy, opensearch-dashboards, argo-workflows, thingsboard, saf...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: juicefs-csi-driver, redis-operator, k8ssandra-client, zarf, k8sgpt, velero, k9s, kots, kiali, argo-cd, vcluster, rancher-fleet, hubble, teleport, cri-tools, k3s, jitsucom-bulker, percona-server-mongodb-operator, verticadb-operator, gitlab-kas, rancher, cluster-api,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: juicefs-csi-driver, redis-operator, k8ssandra-client, zarf, k8sgpt, velero, k9s, kots, kiali, argo-cd, vcluster, rancher-fleet, hubble, teleport, cri-tools, k3s, jitsucom-bulker, percona-server-mongodb-operator, verticadb-operator, gitlab-kas, rancher, cluster-api,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: k8sgpt, rke2-runtime, tigera-operator, hubble-fips, trivy-operator, dynamic-localpv-provisioner, eks-distro, datadog-agent-fips, redis-operator, kots, skaffold, istio-fips, consul-k8s-fips, skaffold-fips, cilium-cli, kubescape-server-fips, aws-node-termination-handle...

CVE-2026-40288

PraisonAI and praisonaiagents prior to versions 4.5.139 and 1.5.140 are exposed to a critical RCE via untrusted workflow YAML. When a YAML file for type: job is loaded, the JobWorkflowExecutor (job_workflow.py) processes steps allowing run (subprocess.run), script (inline Python via exec), and py...

PT-2026-32983

Name of the Vulnerable Software and Affected Versions Giskard versions prior to 1.0.2b1 Description The RegexMatching check in the giskard-checks package passes a user-supplied regular expression pattern directly to the Python re.search function without a timeout, complexity guard, or pattern...

GHSA-3P68-RC4W-QGX5 vulnerabilities

Vulnerabilities for packages: lerna, prism, nextcloud-server, kubeflow-pipelines, kubeflow-centraldashboard, jitsucom-jitsu, langfuse, kubeflow-katib, opensearch-dashboards, saf...

CVE-2025-62718 vulnerabilities

Vulnerabilities for packages: lerna, prism, nextcloud-server, kubeflow-pipelines, kubeflow-centraldashboard, jitsucom-jitsu, langfuse, kubeflow-katib, opensearch-dashboards, saf...

CVE-2025-62718 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, librechat, wazuh-dashboard, prism, kubeflow-pipelines, saf, opensearch-dashboards, jitsucom-jitsu, gitlab-rails-ce-fips, nextcloud-server, lerna, awx, gitlab-rails-ce, langfuse, kubeflow-centraldashboard, arangodb, redisinsight,...

GHSA-3P68-RC4W-QGX5 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, librechat, wazuh-dashboard, prism, kubeflow-pipelines, saf, opensearch-dashboards, jitsucom-jitsu, gitlab-rails-ce-fips, nextcloud-server, lerna, awx, gitlab-rails-ce, langfuse, kubeflow-centraldashboard, arangodb, redisinsight,...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, mitmproxy, airflow, jupyter-base-notebook, k8s-sidecar, datadog-agent, ggshield, kserve, py3-cassandra-medusa, kubeflow-volumes-web-app, dask-kubernetes, semgrep, kubeflow-jupyter-web-app, superset, mycli, mlflow,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: open-webui, kubeflow-pipelines-visualization-server, mitmproxy, airflow, jupyter-base-notebook, k8s-sidecar, datadog-agent, ggshield, kserve, py3-cassandra-medusa, kubeflow-volumes-web-app, dask-kubernetes, semgrep, kubeflow-jupyter-web-app, superset, mycli, mlflow,...

CVE-2026-39892 vulnerabilities

Vulnerabilities for packages: opal, ggshield, mlflow, vllm-openai-cuda-12.9, barman, dbt-snowflake, kubeflow-jupyter-web-app, authentik, pgadmin4-fips, openstack-kolla-toolbox-2025.2, datadog-agent-fips, openstack-kolla-toolbox-2025.1, kubeflow-pipelines-visualization-server, in-toto, label-studi...

GHSA-P423-J2CM-9VMQ vulnerabilities

Vulnerabilities for packages: opal, ggshield, mlflow, vllm-openai-cuda-12.9, barman, dbt-snowflake, kubeflow-jupyter-web-app, authentik, pgadmin4-fips, openstack-kolla-toolbox-2025.2, datadog-agent-fips, openstack-kolla-toolbox-2025.1, kubeflow-pipelines-visualization-server, in-toto, label-studi...

PT-2026-31719

Name of the Vulnerable Software and Affected Versions versions not specified Description A remote attacker with low privileges can manipulate Modbus register values used in odorant injection logic, potentially causing over or under-injection of odorant into a gas line. Attackers have exploited th...