Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

dependency-track

OWASP Dependency-Track Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials SBO...

CLEANSTART-2026-NX30837 Rekor is an open source software supply chain transparency log

Security vulnerability affects the rekor package. Rekor is an open source software supply chain transparency log...

CLEANSTART-2026-EM54114 Rekor is a software supply chain transparency log

Security vulnerability affects the cosign package. Rekor is a software supply chain transparency log...

Monkeytype software supply chain issue vulnerability

Versions of Monkeytype prior to 26.43.0 contain a vulnerability related to the software supply chain. This vulnerability arises because the GitHub workflow at https://github/workflows/fix-formatting.yml runs with write permissions on the repository under the pullrequesttarget. It retrieves fork...

Jordan functype monorepo software supply chain issue vulnerability

Versions of Jordan functype monorepo prior to 1.4.4 contain a software supply chain vulnerability. This vulnerability arises because the setfunctype monorepoversion MCP tool utilizes only z.string to validate unconstrained version strings, then interpolates them into functype monorepo@ for use by...

Roman Bataev Joker software supply chain issue vulnerability

Versions of Roman Bataev Joker prior to 1.8.2 contain a software supply chain vulnerability. This vulnerability arises when executing the joker --lint command; it searches upward through the .jokerd/ directory for matching linter. files. As a result, code provided by the repository may be execute...

trust-software-supply-chain-poc

Trusted Software Supply Chain — Proof of Concept This proof-...

Mistral AI Mistral Vibe software supply chain issue vulnerability

Versions of Mistral AI Mistral Vibe prior to 3.0.3 contain a software supply chain vulnerability. This vulnerability stems from a git filter driver defined in the .git/config file within an untrusted repository. When launched with --worktree, git worktree add applies .gitattributes and executes...

Vulnerability in the software supply chain of NVIDIA TensorRT-LLM

NVIDIA TensorRT-LLM version 1.3.0rc24 contains a vulnerability related to the software supply chain. This vulnerability arises from the inclusion of functionality originating from untrusted control domains during the loading process of the KvCacheAwareRouter tokenizer. It may lead to code...

Intern Science InternAgent software supply chain issue vulnerability

Version 1.5.0 of Intern Science InternAgent contains a vulnerability related to the software supply chain. This vulnerability stems from improper handling of the basemodelnameorpath parameter in the train function within the file tasks/AutoChem/code/experiment.py. It may allow unauthorized...

Vulnerability related to OpenStack Ironic software supply chain issues

Versions 18.1.0 through 29.1.1, 30.0.0 through 32.1.1, 33.0.0 through 35.1.1, and 36.0.0 through 39.0.1 of OpenStack Ironic contain a vulnerability related to the software supply chain. This vulnerability arises because the vendorpassthru functionality permits operations on the BMC Redfish servic...

Vulnerability related to the software supply chain issue in Bytecode Alliance wasmtime

In versions prior to Bytecode Alliance Wasmtime 48.0.4, versions 47.0.0 and versions prior to 49.0.2, versions 49.0.0 contain a software supply chain vulnerability. This vulnerability stems from improper validation of WebAssembly tag subtype imports for core modules. Malicious actors can...

CloudPirates.io helm-charts software supply chain issue vulnerability

Versions of CloudPirates.io Helm Charts prior to 271d415 contain a software supply chain vulnerability. This vulnerability arises because the pullrequesttarget workflow utilizes github.event.pullrequest.head.sha or head.ref to retrieve forked code, allowing code controlled by attackers to access...

Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain

Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demonstrate that a single malicious package can have wide reaching and devastating impacts overnight. These...

Apple Xcode Software Supply Chain Vulnerabilities

Versions of Apple Xcode prior to Xcode 27 contained vulnerabilities related to the software supply chain. These vulnerabilities stemmed from the failure to perform library validation on affected binary files, which could allow malicious applications to escape the sandbox...

Python Packaging Authority virtualenv software supply chain vulnerability

The Python Packaging Authority identifies a vulnerability in virtualenv versions prior to 21.14.9 within the software supply chain. This vulnerability arises when PipInvoke.getpipinstallcmd calls getwheeldownload=False during processing of --seeder pip --download, allowing pip to query the index ...

Argo Project Argo CD Software Supply Chain Vulnerabilities

The Argo Project’s Argo CD versions from 2.1.0 to 3.3.15, 3.4.0-rc1 to 3.4.10, 3.5.0-rc1 to 3.5.4, and 3.6.0-rc1 to 3.6.0-rc2 contain software supply chain vulnerability issues. This vulnerability arises when --enable-helm is enabled for kustomize builds, allowing helmGlobals.configHome to point ...

Can SOLARBURST Go Silicon? A Systematic Analysis on Software Supply Chain Attacks for VLSI Design Flows

An attacker targeting the software supply chain SWSC of VLSI tools can fully subvert the VLSI design pipeline through purely software level compromises. However, cur- rent literature on both SWSC and VLSI hardware security has not explored how software can be used to subvert the security of the...

EnergizeLab AI Station software supply chain vulnerability issues

EnergizeLab AI Station has a software supply chain vulnerability. This vulnerability stems from downloading firmware updates via plaintext HTTP, without verifying their integrity and authenticity. This could allow attackers to replace malicious updates by intercepting or modifying traffic...