GO-2023-2181 vulnerabilities

Vulnerabilities for packages: aactl, tekton-chains, ko, policy-controller, melange, cosign, slsa-verifier, tkn, spire-server, skaffold, apko, kubescape, flux-source-controller...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: dex, terragrunt, fulcio, flux-kustomize-controller, aactl, cloudflared, cosign, tkn, sops, spire-server, oauth2-proxy, tekton-chains, kubescape, flux-source-controller, kots, rekor, slsa-verifier, vexctl, argo-workflows, gitsign...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: terraform-provider-azurerm, external-secrets-operator, terraform-provider-azapi, policy-controller, terragrunt, melange, fulcio, skaffold, gomplate, crossplane-provider-aws-cloudformation, aactl, crossplane-provider-azure-storage, datadog-agent, glab,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: policy-controller, ratify, buildkitd, gh, zarf, skaffold, aactl, cosign, docker, kyverno, tkn, trivy-operator, kyverno-notation-aws, spire-server, witness, neuvector-sigstore-interface, tflint, vexctl, docker-cli-buildx, zot, trivy, sigstore-scaffolding, tekton-chain...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: policy-controller, ratify, gh, zarf, skaffold, aactl, cosign, tkn, witness, kyverno-notation-aws, spire-server, neuvector-sigstore-interface, tflint, vexctl, docker-cli-buildx, zot, sigstore-scaffolding, tekton-chains, teleport, kubescape, flux-source-controller,...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: aactl, policy-controller, ratify, witness, tkn, kyverno-notation-aws, teleport, goreleaser, flux-source-controller, falcoctl, gitsign, zot...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: policy-controller, ratify, buildkitd, gh, zarf, skaffold, aactl, cosign, docker, tkn, witness, trivy-operator, kyverno-notation-aws, spire-server, neuvector-sigstore-interface, tflint, vexctl, zot, trivy, sigstore-scaffolding, tekton-chains, teleport, kubescape,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: policy-controller, gh, melange, zarf, aactl, cosign, tkn, spire-server, neuvector-sigstore-interface, zot, trivy, sigstore-scaffolding, tekton-chains, apko, kubescape, flux-source-controller, falcoctl, wolfictl, rekor, slsa-verifier, vexctl, gitsign...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: k3d, terraform-provider-azurerm, flux-image-automation-controller, policy-controller, src-fingerprint, buildkitd, gh, terragrunt, zarf, fulcio, step-ca, grafana-mimir, terraform, guac, flux-kustomize-controller, gomplate, crossplane-provider-azure-storage, aactl, flu...

Workspace Topology As an Attack Vector in Agentic Coding Assistants

Agentic coding assistants are finding widespread use, not just in new code development but in quickly ingesting and leveraging third-party code. This opens up a risk of malicious code being ingested as these coding tools operate with broad filesystem access inside developer workspaces. In this...

CVE-2026-53970: Download of Code Without Integrity Check

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

CVE-2026-73678: Improper Control of Generation of Code

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

PT-2026-72043

Name of the Vulnerable Software and Affected Versions ZeroBrew versions prior to 0.3.2 Description A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs,...

GHSA-7JMF-5VCP-F672

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

CVE-2026-72839

creationtimestamp| type| source ---|---|--- 2026-08-13 22:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msypldq3wl2e 2026-08-15 08:00:05+00:00| seen| Telegram/7bSAS5c5TE5I5bBpK30fEeCZ4VMtoAAsa45677qm1k6CaLw 2026-08-15 13:40:04+00:00| seen|...

Malicious code in source-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c2f07bb4a673bf18d866e697b1a943783696d2871fbc5e5987c2117377e798 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14013 Malicious code in source-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c2f07bb4a673bf18d866e697b1a943783696d2871fbc5e5987c2117377e798 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13977 Malicious code in cspell-esm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e857800f57969e257ed22cd056f2e4a4395de09ac9b69becd0c7c2b931314ab Package name resembles the widely-used 'cspell' library but its main entry index.js exports an empty object and provides no functionality. Its...

CVE-2026-73669

creationtimestamp| type| source ---|---|--- 2026-08-13 20:55:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/hi7gjwjvodaob...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...