GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: hubble, nova, flux-notification-controller, secrets-store-csi-driver-provider-aws, dbmate, clickhouse-operator, kubewatch, nfs-subdir-external-provisioner, spire-server, aws-network-policy-agent, victoriametrics, go, metacontroller, flux-operator, github-mcp-server,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, frp, task, govulncheck, kubernetes-dashboard, gatus, prometheus-pushgateway, aws-load-balancer-controller, dive, regclient, external-secrets-operator, custom-pod-autoscaler, docker-credential-ecr-login, ingress-nginx-controller, kube-state-metrics,...

CLEANSTART-2026-ZM74354 Security fixes for CVE-2025-61732, CVE-2025-66506, CVE-2025-66564, CVE-2025-68121, CVE-2026-22772, CVE-2026-23991, CVE-2026-23992, CVE-2026-24137, CVE-2026-24686, CVE-2026-25679, CVE-2026-26958, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-4qg8-fj49-pxjh, ghsa-59jp-pj84-45mr, ghsa-846p-jg2w-w324, ghsa-fcv2-xgw5-pqxf, ghsa-fphv-w9fq-2525, ghsa-jqc5-w2xx-5vq4 applied in versions: 0.7.31-r0, 0.7.31-r1, 0.7.31-r2

Multiple security vulnerabilities affect the sigstore-scaffolding package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NV36169 Security fixes for CVE-2025-61732, CVE-2025-66564, CVE-2025-68121, CVE-2026-24686, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, ghsa-fcv2-xgw5-pqxf applied in versions: 0.7.29-r1, 0.7.29-r2

Multiple security vulnerabilities affect the sigstore-scaffolding package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: ratify, k8s-device-plugin, undock, crossplane-provider-aws-sqs, kubernetes-dashboard, prometheus-pushgateway, node-feature-discovery, aws-load-balancer-controller, regclient, external-secrets-operator, ingress-nginx-controller, kube-state-metrics, consul-k8s, sonobuo...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana, cilium-envoy, k8s-device-plugin, undock, crossplane-provider-aws-sqs, cert-manager-cmctl, boring-registry, sftpgo-plugin-auth, temporal-server, kubernetes-csi-node-driver-registrar, terragrunt, kubernetes-dashboard, octo-sts,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: ratify, k8s-device-plugin, undock, crossplane-provider-aws-sqs, kubernetes-dashboard, prometheus-pushgateway, node-feature-discovery, aws-load-balancer-controller, regclient, external-secrets-operator, ingress-nginx-controller, kube-state-metrics, consul-k8s, sonobuo...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana, cilium-envoy, k8s-device-plugin, undock, crossplane-provider-aws-sqs, cert-manager-cmctl, boring-registry, sftpgo-plugin-auth, temporal-server, kubernetes-csi-node-driver-registrar, terragrunt, kubernetes-dashboard, octo-sts,...

Backstage 日志信息泄露漏洞

Backstage is an open-source application developed by Backstage. It serves as an open platform for building developer portals. Versions of Backstage prior to 3.1.4 contained a vulnerability related to log information leakage. This vulnerability stemmed from malicious scaffolding templates that cou...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

EUVD-2024-35107

Malicious code in bioql PyPI...

EUVD-2024-2470

Malicious code in bioql PyPI...

Malicious code in test-mlw2-clour-heats-nards-scaff (npm)

The package test-mlw2-clour-heats-nards-scaff was found to contain malicious code...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: druid, fulcio, spire-server, tekton-chains, harbor-registry, py3-azure-identity, rekor, boring-registry, step-ca, hugo-extended, cosign, terragrunt, thanos, velero, flux-image-reflector-controller, opentelemetry-collector-contrib, flux-source-controller, datadog-agen...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

CVE-2024-34913

The CVE-2024-34913 entry impacts r-pan-scaffolding versions 5.0 and older, where an arbitrary file upload vulnerability allows an attacker to execute arbitrary code by uploading a crafted PDF. The root cause is an improper handling of PDF uploads in the file-upload functionality, enabling code ex...

CVE-2024-34913

An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...

PT-2024-26246 · Unknown · R-Pan-Scaffolding

Name of the Vulnerable Software and Affected Versions: r-pan-scaffolding versions 5.0 and below Description: The issue allows attackers to execute arbitrary code via uploading a crafted PDF file. This is achieved through an arbitrary file upload vulnerability. Recommendations: For versions 5.0 an...