Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes comparison offsets as length - hash.length - 2, so its two comparison loops jointly...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent paths in KCCMBlockCipher and KGCMBlockCipher, which decrypt directly into the caller's output...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation in the calculateAgreementpub, message method of the DHAgreement class, which raises the peer-supplied message to the power of the local static private key x without any range or subgroup-membership check, while...

CLEANSTART-2026-OI85339 Security fixes in tempo 2.8.3-r1

Package tempo version 2.8.3-r1 fixes 4 vulnerabilities: CVE-2026-33186, CVE-2026-34986, ghsa-p77j-4mvh-x3m3, ghsa-78h2-9frx-2jm8...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the CreateSubAgent process. An attacker can gain unauthorized access to workspace applications by registering sub-agent apps with a sharing level that exceeds the administrator's configured maximum, thereby...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the API key management process. An attacker can perform unauthorized key-management operations, such as creating, listing, or revoking API keys for other owners or escalating privileges by generating keys with...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded processing of the p2c parameter in PBES2 JWE decryption. An attacker can cause denial of service by supplying a crafted JWE containing an excessively large p2c value in...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the PUT /api/environments/id/templates/variables endpoint. An attacker can overwrite global environment variables used in all project deployments by sending requests as an authenticated non-admin user,...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to the absence of authentication and authorization checks in the UPI management interface. An attacker can gain unauthorized access to read, modify, or delete UP-node and link topology data by sending...

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control inadequate authorization checks in the POST /api/agents/:id/keys, GET /api/agents/:id/keys, and DELETE /api/agents/:id/keys/:keyId routes. An attacker can gain unauthorized access to sensitive...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in several API endpoints that lack proper authentication checks. An attacker can access sensitive data, perform state-changing operations, and obtain internal configuration details by sending...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions through the GenerateDeterministicNameFromSpec function in pkg/resolution/resource/name.go. An attacker can crash the controller and block all TaskRun/PipelineRun reconciliation by...

Buffer Access with Incorrect Length Value

Overview Affected versions of this package are vulnerable to Buffer Access with Incorrect Length Value via the readSeparateStripsIntoBuffer function in tiffcrop component. A process can crash on malformed TIFF directory that triggers a stack overflow. Remediation Upgrade libtiff to version 4.7.1 ...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the HMAC computation. An attacker can bypass intended challenge expiration and reuse previously solved challenges by submitting a valid proof-of-work with a modified expiration value,...

EUVD-2025-124399

Malicious code in node-config-upgrade-library-carpo npm...

Malicious code in phenomic-upgrade-library-loop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c6da63fbfa2e892e0a97bd188c12afa9f4a7f7644759a1b77e0465f69de6903 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

The vulnerability of the `setUpgradeUboot()` function (upgrade.so) in the TOTOLINK CA300-PoE router’s microprogramming software allows a attacker to execute arbitrary commands.

The vulnerability of the setUpgradeUboot function in the upgrade.so library of TOTOLINK CA300-PoE router microprogramming software is related to the failure to take measures to clean data at the management level when processing the FileName parameter. Exploiting this vulnerability can allow an...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the privatekeyfromfile function. An attacker can potentially access sensitive information or modify data, under certain circumstances such as the specified filename not existing. Note: The vulnerable function has been...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when validating SSH host certificate signatures. Due to a related issue in the processing of IsUserAuthority and IsHostAuthority by x/crypto/ssh, an attacker can gain unauthorized access by providing a signed SSH...

CVE-2023-33959

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Use...