CVE-2021-3572

CVE-2021-3572 Этот репозиторий предназначен для тестирования CVE-2021-3572 в pypa/pip. Для получения дополнительной информации смотрите эти ресурсы: Страница CVE: https://vulners.com/cve/CVE-2021-3572 PR, в котором была исправлена уязвимость: https://github.com/pypa/pip/pull/9827 Вопрос с более...

kit

kit Gestionnaire de registres d'outils — gère les chaînes d'outils des développeurs à partir de registres basés sur git, superposé à mise. Qu'est-ce que c'est kit résout les versions d'outils sur plusieurs registres, génère la configuration mise, vérifie les sommes de contrôle SHA-256 par rapport...

CVE-2026-46420 setup-php: Command Injection in Repository-Derived PHP Version Resolution

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...

CVE-2026-54557

CVE-2026-54557 affects the mise HTTP backend. Before 2026.6.1, install symlinks were created using the raw resolved version string for non-latest versions, instead of the sanitized version pathname. This allows a repository-controlled .tool-versions entry to cause mise install to create a symlink...

Malicious code in @car-loans/applicaion-aff (npm)

Part of a dependency confusion attack campaign targeting the @car-loans, @fb-deposit, and @debit-ib npm scopes. The attacker npm user pik-libs published 25 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version resolution,...

go.sum Is Not a Lockfile

I need everyone to stop looking at go.sum, especially to analyze dependency graphs. It is not a “lockfile,”1 and it has zero semantic effects on version resolution. There is truly no use case for ever parsing it outside of cmd/go. go.sum is only a local cache for the Go Checksum Database. It’s a...

CVE-2023-41332

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In Cilium clusters where Cilium's Layer 7 proxy has been disabled, creating workloads with policy.cilium.io/proxy-visibility annotations in Cilium = v1.13 or io.cilium.proxy-visibility annotations in Cilium...

CVE-2024-56724 affecting package kernel for versions less than 5.15.176.3-1

CVE-2024-56724 affecting package kernel for versions less than 5.15.176.3-1. An upgraded version of the package is available that resolves this issue...