85 matches found
GO-2024-2687 vulnerabilities
Vulnerabilities for packages: nri-kubernetes, kaf, task, crossplane-provider-aws-firehose, certificate-transparency, petname, protoc-gen-go, go-licenses, fulcio, crossplane-provider-azure-managedidentity, croc, slsa-verifier, cluster-proportional-autoscaler, helm-push, go-bindata,...
CLEANSTART-2026-CM12732 Security fixes in sigstore-scaffolding 0.7.31-r1
Package sigstore-scaffolding version 0.7.31-r1 fixes 2 vulnerabilities: ghsa-fcv2-xgw5-pqxf, ghsa-jqc5-w2xx-5vq4...
CLEANSTART-2026-QE68045 Security fixes in sigstore-scaffolding 0.7.31-r0
Package sigstore-scaffolding version 0.7.31-r0 fixes 4 vulnerabilities: ghsa-59jp-pj84-45mr, ghsa-846p-jg2w-w324, ghsa-fphv-w9fq-2525, ghsa-4qg8-fj49-pxjh...
PT-2026-85999
Package sigstore-scaffolding version 0.7.31-r0 fixes 4 vulnerabilities: ghsa-59jp-pj84-45mr, ghsa-846p-jg2w-w324, ghsa-fphv-w9fq-2525, ghsa-4qg8-fj49-pxjh...
PT-2026-85843
Package sigstore-scaffolding version 0.7.31-r1 fixes 2 vulnerabilities: ghsa-fcv2-xgw5-pqxf, ghsa-jqc5-w2xx-5vq4...
GHSA-XRMC-C5CG-RV7X SafeInstall agent guard shell parsing can miss raw package execution
Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher names, leading file-descriptor redirections, and supported shell wrappers with options can cause a raw install command to receive no guard...
SafeInstall agent guard shell parsing can miss raw package execution
Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher names, leading file-descriptor redirections, and supported shell wrappers with options can cause a raw install command to receive no guard...
GHSA-FV83-X2XW-2J55 vulnerabilities
Vulnerabilities for packages: karpenter, flux-image-automation-controller, gh, osv-scanner, smarter-device-manager, grafana-rollout-operator, hubble, supercronic, aws-privateca-issuer, envoy-ratelimit, nfs-subdir-external-provisioner, tailscale, go, metacontroller, polaris, victoriametrics,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: kaf, mcp-grafana, task, certificate-transparency, go-licenses, crossplane-provider-azure-managedidentity, croc, slsa-verifier, trivy-operator, cluster-proportional-autoscaler, wal-g, helm-push, cis-operator, kubernetes-dashboard-web, kapp, mesosphere-vsphere-csi,...
CLEANSTART-2026-ZM74354 Security fixes for CVE-2025-61732, CVE-2025-66506, CVE-2025-66564, CVE-2025-68121, CVE-2026-22772, CVE-2026-23991, CVE-2026-23992, CVE-2026-24137, CVE-2026-24686, CVE-2026-25679, CVE-2026-26958, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-4qg8-fj49-pxjh, ghsa-59jp-pj84-45mr, ghsa-846p-jg2w-w324, ghsa-fcv2-xgw5-pqxf, ghsa-fphv-w9fq-2525, ghsa-jqc5-w2xx-5vq4 applied in versions: 0.7.31-r0, 0.7.31-r1, 0.7.31-r2
Multiple security vulnerabilities affect the sigstore-scaffolding package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-NV36169 Security fixes for CVE-2025-61732, CVE-2025-66564, CVE-2025-68121, CVE-2026-24686, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27142, ghsa-fcv2-xgw5-pqxf applied in versions: 0.7.29-r1, 0.7.29-r2
Multiple security vulnerabilities affect the sigstore-scaffolding package. These issues are resolved in later releases. See references for individual vulnerability details...
PT-2026-56372
Multiple security vulnerabilities affect the sigstore-scaffolding package. These issues are resolved in later releases. See references for individual vulnerability details...
GHSA-J3GX-2473-5FP8 vulnerabilities
Vulnerabilities for packages: nri-kubernetes, kaf, mcp-grafana, crossplane-provider-aws-firehose, croc, cluster-proportional-autoscaler, wal-g, cis-operator, kubernetes-dashboard-web, kapp, sqlexporter, mesosphere-vsphere-csi, vertical-pod-autoscaler, sonobuoy, cluster-api-aws-controller,...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: nri-kubernetes, kaf, mcp-grafana, crossplane-provider-aws-firehose, croc, cluster-proportional-autoscaler, wal-g, cis-operator, kubernetes-dashboard-web, kapp, sqlexporter, mesosphere-vsphere-csi, vertical-pod-autoscaler, sonobuoy, cluster-api-aws-controller,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: authservice, podinfo, prometheus-operator, kaf, mcp-grafana, crossplane-provider-aws-firehose, bank-vaults, crossplane-provider-aws-kms, cluster-autoscaler, terraform-provider-time, go, terraform-provider-azuread, polaris, crossplane-provider-aws-eks, steampipe,...
CVE-2026-27142 vulnerabilities
Vulnerabilities for packages: authservice, podinfo, prometheus-operator, kaf, mcp-grafana, crossplane-provider-aws-firehose, bank-vaults, crossplane-provider-aws-kms, cluster-autoscaler, terraform-provider-time, go, terraform-provider-azuread, polaris, crossplane-provider-aws-eks, steampipe,...
Backstage 日志信息泄露漏洞
Backstage is an open-source application developed by Backstage. It serves as an open platform for building developer portals. Versions of Backstage prior to 3.1.4 contained a vulnerability related to log information leakage. This vulnerability stemmed from malicious scaffolding templates that cou...
CVE-2024-34913
An arbitrary file upload vulnerability in r-pan-scaffolding v5.0 and below allows attackers to execute arbitrary code via uploading a crafted PDF file...
