Supply-Chain

Sicherheit der Software-Lieferkette Eine umfassende dreibändige Buchreihe zur Sicherheit der Software-Lieferkette, die Bedrohungen, Abwehrmaßnahmen und Governance abdeckt. Dieses Open-Source-Manuskript bietet Sicherheitsexperten, Entwicklern und Führungskräften in Organisationen praktische...

dependency-track

OWASP Dependency-Track डिपेंडेंसी-ट्रैक एक बुद्धिमान घटक विश्लेषण Component Analysis प्लेटफ़ॉर्म है जो संगठनों को सॉफ़्टवेयर आपूर्ति श्रृंखला में जोखिम की पहचान करने और कम करने की अनुमति देता है। डिपेंडेंसी-ट्रैक सॉफ़्टवेयर बिल ऑफ मैटेरियल्स SBOM की क्षमताओं का लाभ उठाकर एक अद्वितीय और अत्यंत...

CVE-2026-21753

HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious third-party dependencies within the application environment...

Malicious code in desmosmathwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccdafeec1f447c84fcca9f7f17e41c8e940b8bd65c9caf72b1bddbb2befdea4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MINI-Q664-F2C8-9R9X

Bulletin has no description...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, crossplane-provider-aws-s3control, cert-exporter-fips, addon-resizer, lvm-driver-fips, backup-restore-operator, gcp-compute-persistent-disk-csi-driver, tekton-chains-fips, helm-operator, ipfs-cluster-fips, openbao,...

Malicious code in thepackagethatworks_ (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f15296c09e590124cd0c48b05fe2a07d3a2c798fe5ffe5bbc01fa91e1eeb18c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2025-4261 vulnerabilities

Vulnerabilities for packages: gitea-fips...

GO-2026-4753 vulnerabilities

Vulnerabilities for packages: rancher-agent, teleport, dex, mattermost-fips, mattermost, omni, rancher, commercial-grafana, neuvector, gotrue, zitadel, gotrue-fips, neuvector-fips, dex-fips, teleport-operator-fips, omni-fips...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: argo-events-fips, nemo, scorecard, k8sgpt, k9s, skaffold, apko, pulumi, argocd-image-updater, grype, src-fingerprint, pulumi-language-java, wolfictl, flux-source-controller, argo-events, trivy-fips, kaniko, kubescape, task, kyverno-fips, osv-scanner, kargo, melange,...

GO-2026-4602 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, cert-exporter-fips, volume-modifier-for-k8s, addon-resizer, lvm-driver-fips, neuvector, backup-restore-operator, boring-registry, gcp-compute-persistent-disk-csi-driver, kyverno-policy-reporter-plugins-trivy,...

GO-2026-5496 vulnerabilities

Vulnerabilities for packages: argo-events-fips, nemo, pulumi, wolfictl, witness, trivy-fips, kaniko, kargo, melange, cerbos, skaffold-fips, kaniko-fips, gitlab-runner-fips, zot, tfsec, src-fingerprint-fips, grafana-alloy, upwind-agent, xeol-fips, grafana, argocd-image-updater-fips, bom,...

GO-2025-3373 vulnerabilities

Vulnerabilities for packages: neuvector, boring-registry, gcp-compute-persistent-disk-csi-driver, tekton-chains-fips, nfs-subdir-external-provisioner-fips, helm-operator, docker-compose, kustomize, neuvector-sigstore-interface, vexctl, vendir, yace, opentofu-fips, aws-signer-notation-plugin,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, cert-exporter-fips, addon-resizer, neuvector, boring-registry, tekton-chains-fips, nfs-subdir-external-provisioner-fips, helm-operator, docker-compose, kustomize, neuvector-sigstore-interface, nri-postgresql, rabbitmq-cluster-operator-fip...

GO-2026-5239 vulnerabilities

Vulnerabilities for packages: grafana...

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix...

CLEANSTART-2026-CB76425 Security fixes in consul-k8s 2.0.1-r1

Package consul-k8s version 2.0.1-r1 fixes 9 vulnerabilities: CVE-2026-46600, CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-50151, CVE-2026-50162...

Malicious code in dhjksficgwu2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5dc64d0022ee36cd898963db50e3c835990bf94837821fb34408820855c69c0 Package contains a single index.html file declared as main. The HTML impersonates a Cloudflare Turnstile 'Just a moment...' verification page sitekey...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70611 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70611 Source advisory: OSV:GHSA-F2R8-JV7C-XQMP...

Malicious code in @servicetitan/microfront-tests (npm)

npm/@servicetitan/microfront-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...