336444 matches found
GO-2025-3749 vulnerabilities
Vulnerabilities for packages: minio-operator, spiffe-helper, regclient, karma, trust-manager, sftpgo-plugin-eventstore, velero-plugin-for-aws, litefs, speedtest-go, local-path-provisioner, kafkaexporter, rancher-helm, kubernetes-event-exporter, percona-server-mongodb-operator, spqr, maru, nri-jmx...
GO-2026-5496 vulnerabilities
Vulnerabilities for packages: gitaly, src-fingerprint, pulumi-language-java, pulumi-kubernetes-operator, flux-image-automation-controller, pulumi-language-yaml, zot, zarf, kots, kubevela, trivy-operator, argo-cd, kaniko, pulumi-language-dotnet, melange, argo-events, argo-workflows, gptscript,...
MINI-MR2J-V2PG-JFMC
Bulletin has no description...
CVE-2026-1621: Authentication Bypass by Primary Weakness
Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers. This issue affects E-Municipality: from 20251127 before 20260204...
Trust without Boundaries: An Architectural Analysis of Satellite Flight Software
As spacecraft become more software-driven and interconnected, onboard flight software is an increasingly important security boundary. Popular flight software architectures often treat onboard components as trusted peers, simplifying integration while limiting internal isolation and access control...
CVE-2026-56860
Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...
MINI-2QW5-VR2G-4Q26
Bulletin has no description...
CVE-2026-58510
GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...
CVE-2026-58511
Webhook Authorization Header Returned in Plaintext via API...
CVE-2026-58440
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content incomplete revocation cleanup in "DeleteCollaboration"...
CVE-2026-58437
Repository Visibility Manipulation via Git Push Options...
CVE-2026-58434
Private Repository Metadata Remains Accessible After Access Revocation...
CVE-2026-58428
Release attachment extension allowlist bypass via web release edit form variant of CVE-2025-68939...
CVE-2026-56654
Privilege Escalation via Access Token Scope Escalation in API...
CVE-2026-59109 Zalktis: SQL injection via partner-controlled fields in imported e-invoices
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice UBL/PEPPOL or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string...
Malware in async-critical-section
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix...
CVE-2026-27544
Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...