GO-2025-4261 vulnerabilities

Vulnerabilities for packages: gitea-fips...

GO-2026-4753 vulnerabilities

Vulnerabilities for packages: omni-fips, rancher, teleport, commercial-grafana, teleport-operator-fips, omni, neuvector-fips, mattermost, mattermost-fips, gotrue-fips, zitadel, gotrue, neuvector, rancher-agent, dex-fips, dex...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: kaniko, flux-source-controller, zarf, pulumi-language-yaml, gitea-fips, flux-image-automation-controller, flux-source-controller-fips, goreleaser, kubevela, skaffold, gitea, gitsign, nemo, grafana-alloy, tfsec, gptscript, kyverno, trivy, argo-workflows, argo-cd,...

GO-2026-4602 vulnerabilities

Vulnerabilities for packages: vgpu-util, gitlab-cng, calico-fips, crossplane-provider-terraform-fips, k8s-metacollector-fips, flux-source-controller-fips, crossplane-provider-aws-sns, aws-privateca-issuer-fips, crossplane-function-environment-configs-fips, crossplane-provider-aws-ecs-fips,...

GO-2026-5496 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, gomplate, pulumi-language-yaml, teleport, goreleaser, kubevela, kyverno, argo-cd, grafana-alloy-fips, kaniko-fips, nuclei, trivy-operator, guac, dagger, cloudbeat-fips, rancher-fleet, wolfictl, mapotf-fips, argo-cd-fips, coder, gomplate-fips,...

GO-2025-3373 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, vgpu-util, calico-fips, flux-source-controller-fips, aws-privateca-issuer-fips, fluent-operator, dataplaneapi-fips, trillian, docker-credential-ecr-login-fips, promxy-fips, velero-fips, kubernetes-dashboard-api, temporal-server, wave-fips,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, vgpu-util, terraform-provider-azurerm, flux-source-controller-fips, crossplane-provider-aws-sns, protoc-gen-go, fluent-operator, crossplane-provider-aws-cloudwatchlogs, dataplaneapi-fips, trillian, velero-fips, wave-fips,...

GO-2026-5239 vulnerabilities

Vulnerabilities for packages: grafana...

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix...

CLEANSTART-2026-CB76425 Security fixes in consul-k8s 2.0.1-r1

Package consul-k8s version 2.0.1-r1 fixes 9 vulnerabilities: CVE-2026-46600, CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-50151, CVE-2026-50162...

Malicious code in dhjksficgwu2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5dc64d0022ee36cd898963db50e3c835990bf94837821fb34408820855c69c0 Package contains a single index.html file declared as main. The HTML impersonates a Cloudflare Turnstile 'Just a moment...' verification page sitekey...

Malicious code in @servicetitan/microfront-tests (npm)

npm/@servicetitan/microfront-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/acquisition-functions (npm)

npm/@servicetitan/acquisition-functions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

keyv and cacheable npm Package Hijacked in Supply Chain Attack

Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages...

Malicious code in prxca79e95716 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

What Changed in OWASP Top 10 2025 and Recommendations for Each Category

Key Takeaways 1. The 2025 list introduces two new categories – Software Supply Chain Failures A03 and Mishandling of Exceptional Conditions A10 - reflecting attacks already happening in production. 2. Security Misconfiguration jumping from 5 to 2 signals that continuous deployment without...

Embedded Malicious Code

Overview gpsea is a Python package for finding genotype-phenotype associations. Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that ha...

Embedded Malicious Code

Overview embiggen is a graph machine learning submodule of the 🍇 GRAPE library. Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that ha...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...