PT-2025-48988

Name of the Vulnerable Software and Affected Versions Step CA versions prior to 0.29.0 Description Step CA is an online certificate authority for secure, automated certificate management for DevOps. A flaw exists in the authorization check for SSH certificate revocation, specifically impacting...

step-certificates -- Authorization Bypass in ACME and SCEP Provisioners

smallstep reports: An attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, kube-vip-cloud-provider, prometheus-operator, pulumi-kubernetes-operator, prometheus-adapter, slsa-verifier, dfc, pvc-autoresizer, kafka-proxy, dask-gateway, kubernetes-event-exporter, metrics-server,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, age, php-fpmexporte...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: incert, harbor-registry, policy-controller, nerdctl, chisel, mage, terraform-provider-kubernetes, thanos-operator, istio, kube-vip-cloud-provider, pulumi-kubernetes-operator, sigstore-scaffolding, kapp, xcaddy, azure-workload-identity-webhook, spiffe-helper, nats, ag...

EUVD-2013-3342

Malware in sbrugna...

Malicious code in kitchen-shopify-provisioner (npm)

The package kitchen-shopify-provisioner was found to contain malicious code...

MAL-2025-24548 Malicious code in kitchen-shopify-provisioner (npm)

The package kitchen-shopify-provisioner was found to contain malicious code...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: dex, net-kourier-fips, kubo, kubernetes-dashboard-web, hubble, newrelic-infra-operator, kubernetes-csi-driver-nfs, aws-flb-firehose-fips, flux, harbor-registry, aactl, yunikorn-web, kubeflow-katib, splunk-otel-collector-fips, sqlexporter,...

CVE-2013-3407

The web interface in Cisco Server Provisioner 6.4.0 Patch 5-1301292331 and earlier does not require authentication for unspecified pages, which allows remote attackers to obtain sensitive information via a direct request, aka Bug ID CSCug65664...