GO-2026-5336 vulnerabilities

Vulnerabilities for packages: kubevela, dagger, melange, flux, nuclei, nfpm, pulumi-language-java, guac, gitlab-runner, kargo, kubescape, scorecard, argo-workflows, trivy, src-fingerprint, act, grafana-alloy, pulumi-language-yaml, grype, steampipe, gitaly, kaniko, tfsec, gitsign, syft,...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: tkn, apko, spire-server, melange, slsa-verifier, flux-source-controller, kubescape, policy-controller, ko, cosign, aactl, tekton-chains, skaffold...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno-notation-aws, podman, ratify, gitsign, undock, slsa-verifier, witness, flux-source-controller, kubescape, kyverno, zarf, aactl, skopeo, tekton-chains, buildah, falco-no-driver, kots...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: helm, podman, crossplane-provider-keycloak, melange, gh, docker-machine-driver-linode, guac, nfpm, kargo, policy-controller, tkn, cloudflared, crossplane-provider-family-azure, chisel, crossplane-provider-aws-kinesis, kine, vault-benchmark, loki, argo-events,...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, flux-source-controller, gh, kubescape, policy-controller, docker-cli-buildx, neuvector-sigstore-interface, tkn, gitsign, spire-server, vexctl, cosign, skaffold, sigstore-scaffolding, zot, aactl, teleport, tflint, falcoctl, ratify, witness,...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: tkn, falcoctl, kyverno-notation-aws, ratify, gitsign, witness, flux-source-controller, goreleaser, policy-controller, aactl, teleport, zot...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, slsa-verifier, flux-source-controller, gh, kubescape, policy-controller, trivy, docker-cli-buildx, neuvector-sigstore-interface, tkn, gitsign, spire-server, vexctl, cosign, skaffold, sigstore-scaffolding, zot, trivy-operator, aactl, crossplane,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, slsa-verifier, flux-source-controller, gh, kubescape, policy-controller, trivy, neuvector-sigstore-interface, tkn, gitsign, spire-server, vexctl, cosign, skaffold, sigstore-scaffolding, zot, trivy-operator, rekor, aactl, teleport, tflint,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: melange, slsa-verifier, flux-source-controller, gh, kubescape, policy-controller, trivy, neuvector-sigstore-interface, tkn, gitsign, spire-server, vexctl, cosign, sigstore-scaffolding, zot, rekor, wolfictl, aactl, falcoctl, apko, zarf, tekton-chains...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: kubevela, step-ca, opentelemetry-collector, flux, nuclei, slsa-verifier, flux-source-controller, gh, guac, kubescape, kargo, policy-controller, scorecard, fulcio, flux-kustomize-controller, sops, terraform-provider-azurerm, src-fingerprint,...

CVE-2026-73678: Improper Control of Generation of Code

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

CVE-2026-53970: Download of Code Without Integrity Check

ZeroBrew version 0.3.1 and prior contains a missing integrity verification vulnerability in the Ruby compatibility shim that allows network attackers to execute arbitrary code by substituting malicious content at formula resource or URL-based patch URLs without checksum validation. Attackers can...

PT-2026-72043

Name of the Vulnerable Software and Affected Versions ZeroBrew versions prior to 0.3.2 Description A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs,...

Workspace Topology As an Attack Vector in Agentic Coding Assistants

Agentic coding assistants are finding widespread use, not just in new code development but in quickly ingesting and leveraging third-party code. This opens up a risk of malicious code being ingested as these coding tools operate with broad filesystem access inside developer workspaces. In this...

GHSA-7JMF-5VCP-F672

creationtimestamp| type| source ---|---|--- 2026-08-13 22:43:46+00:00| seen| https://gist.github.com/CaptBoykin/fb932b14c932323583161460666e60da...

CVE-2026-72839

creationtimestamp| type| source ---|---|--- 2026-08-13 22:40:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msypldq3wl2e 2026-08-15 08:00:05+00:00| seen| Telegram/7bSAS5c5TE5I5bBpK30fEeCZ4VMtoAAsa45677qm1k6CaLw 2026-08-15 13:40:04+00:00| seen|...

MAL-2026-14013 Malicious code in source-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c2f07bb4a673bf18d866e697b1a943783696d2871fbc5e5987c2117377e798 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malware in source-analyzer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in source-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c2f07bb4a673bf18d866e697b1a943783696d2871fbc5e5987c2117377e798 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13977 Malicious code in cspell-esm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e857800f57969e257ed22cd056f2e4a4395de09ac9b69becd0c7c2b931314ab Package name resembles the widely-used 'cspell' library but its main entry index.js exports an empty object and provides no functionality. Its...