Malicious code in workflows-templates (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9c885607af191f5acc692b6c3050cc0bbdf52d98ab543e79cef7d32387e247d Any computer that has this package installed or running should be considered...

MAL-2025-5319 Malicious code in workflows-templates (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9c885607af191f5acc692b6c3050cc0bbdf52d98ab543e79cef7d32387e247d Any computer that has this package installed or running should be considered...

Why a Classic MCP Server Vulnerability Can Undermine Your Entire AI Agent

A single SQL injection bug in Anthropic’s SQLite MCP server—forked over 5,000 times—can seed stored prompts, exfiltrate data, and hand attackers the keys to entire agent workflows. This entry unpacks the attack chain and lays out concrete fixes to shut it down...

GHSA-V6H2-P8H4-QCJW vulnerabilities

Vulnerabilities for packages: py3-jupyterlab, argo-workflows, vitess, lerna, kubeflow-centraldashboard, jupyter-base-notebook, node-gyp, langfuse, eslint, npm, kubeflow-pipelines, pulumi, renovate, tileserver-gl, ts-patch, opensearch-dashboards, sqlpad, code-server, prism, rancher-api-ui...

CVE-2025-5889 vulnerabilities

Vulnerabilities for packages: py3-jupyterlab, argo-workflows, vitess, lerna, kubeflow-centraldashboard, jupyter-base-notebook, node-gyp, langfuse, eslint, npm, kubeflow-pipelines, pulumi, renovate, tileserver-gl, ts-patch, opensearch-dashboards, sqlpad, code-server, prism, rancher-api-ui...

GHSA-V6H2-P8H4-QCJW vulnerabilities

Vulnerabilities for packages: tileserver-gl, argo-workflows, foxx-cli, lerna, kibana, kubeflow-centraldashboard, tileserver-gl-fips, nextcloud-server, wazuh-dashboard, rancher-api-ui, langfuse, npm, prism, langfuse-fips, pulumi, jupyter-base-notebook, emsdk, kubeflow-pipelines, eslint,...

CVE-2025-5889 vulnerabilities

Vulnerabilities for packages: tileserver-gl, argo-workflows, foxx-cli, lerna, kibana, kubeflow-centraldashboard, tileserver-gl-fips, nextcloud-server, wazuh-dashboard, rancher-api-ui, langfuse, npm, prism, langfuse-fips, pulumi, jupyter-base-notebook, emsdk, kubeflow-pipelines, eslint,...

Innovation in the Fast Lane: Lessons from Motorsport and Cybersecurity

Learn how Trend Micro and NEOM McLaren Formula E Team turn creativity into innovation by rethinking team structures, workflows, and data use...

The Hidden Threat in Your Stack: Why Non-Human Identity Management is the Next Cybersecurity Frontier

Modern enterprise networks are highly complex environments that rely on hundreds of apps and infrastructure services. These systems need to interact securely and efficiently without constant human oversight, which is where non-human identities NHIs come in. NHIs — including application secrets, A...

CVE-2025-49013 WilderForge vulnerable to code Injection via GitHub Actions Workflows

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

PT-2025-24436 · Unknown +1 · Wilderforge +1

Name of the Vulnerable Software and Affected Versions: WilderForge affected versions not specified Description: A critical issue has been identified in the WilderForge organization, stemming from the unsafe use of user-controlled variables, such as $ github.event.review.body , directly inside she...

SCGAgent: Recreating the Benefits of Reasoning Models for Secure Code Generation with Agentic Workflows

Large language models LLMs have seen widespread success in code generation tasks for different scenarios, both everyday and professional. However current LLMs, despite producing functional code, do not prioritize security and may generate code with exploitable vulnerabilities. In this work, we...

Inclusive, Differentially Private Federated Learning for Clinical Data

Federated Learning FL offers a promising approach for training clinical AI models without centralizing sensitive patient data. However, its real-world adoption is hindered by challenges related to privacy, resource constraints, and compliance. Existing Differential Privacy DP approaches often app...

Chances and Challenges of the Model Context Protocol in Digital Forensics and Incident Response

Large language models hold considerable promise for supporting forensic investigations, but their widespread adoption is hindered by a lack of transparency, explainability, and reproducibility. This paper explores how the emerging Model Context Protocol can address these challenges and support th...

CVE-2024-52799

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...

CVE-2024-45919

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information ...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...

CVE-2023-34063

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows...

CVE-2023-6804

Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.1...

CVE-2023-24029

In Progress WSFTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows...