CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: pulumi, pulumi-language-dotnet, argo-events, syft, grafana-alloy, teleport, gptscript, kubescape, zot, kaniko, pulumi-kubernetes-operator, chezmoi, guac, tfsec, pulumi-language-yaml, kots, witness, zarf, flux, argo-workflows, kubevela, k9s, apko, kyverno, trivy,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: pulumi, pulumi-language-dotnet, argo-events, syft, grafana-alloy, teleport, gptscript, kubescape, zot, kaniko, pulumi-kubernetes-operator, chezmoi, guac, tfsec, pulumi-language-yaml, kots, witness, zarf, flux, argo-workflows, kubevela, k9s, apko, kyverno, trivy,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: pulumi, pulumi-language-dotnet, argo-events, syft, grafana-alloy, teleport, gptscript, kubescape, zot, kaniko, pulumi-kubernetes-operator, chezmoi, guac, tfsec, pulumi-language-yaml, kots, witness, zarf, flux, argo-workflows, kubevela, k9s, apko, kyverno, trivy,...

GHSA-37CH-88JC-XWX2 vulnerabilities

Vulnerabilities for packages: sqlpad, kubeflow-centraldashboard, json-server, kubeflow-katib, kubeflow-pipelines, argo-workflows...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: sqlpad, kubeflow-centraldashboard, json-server, kubeflow-katib, kubeflow-pipelines, argo-workflows...

The Real Risk of Vibecoding

This blog looks at how AI‑driven vibecoding speeds up software development while increasing security risk by outpacing traditional review and ownership. It explains why security needs to move earlier and be built into modern development workflows...

ANT-2026-DJBBBBPE · temporalio/temporal · Broken Access Control

broken-access-control critical CVE-2026-5199 Severity Claude critical · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT The report below was sent to the maintainer and sealed at approval. ANT-2026-DJBBBBPE: Cross-namespace manipulation including deletion of...

SQL Injection

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to SQL Injection in the orderByColumn expression of the Data Table Get node. An attacker with permissions to create or modify workflows can execute arbitrary SQL commands by supplying crafted input,...

CVE-2026-33720

n8n is an open source workflow automation platform. Prior to version 2.8.0, when the N8NSKIPAUTHONOAUTHCALLBACK environment variable is set to true, the OAuth callback handler skips ownership verification of the OAuth state parameter. This allows an attacker to trick a victim into completing an...

Introducing Wiz Workflows: Your path to building a self healing cloud

Orchestrate customizable workflows with agents, enabling end-to-end discovery and response in Wiz...

How AI Translation Fixes Multilingual Content Chaos

AI translation fixes multilingual content chaos by improving consistency, workflows, and speed, helping teams reduce errors and scale global content faster...

Improper Handling Of Symbolic Links

github.com/argoproj/argo-workflows is vulnerable to Improper Handling Of Symbolic Links. The vulnerability is due to flawed validation in the untar process when resolving symbolic links, which allows an attacker to overwrite critical files such as /var/run/argo/argoexec with a malicious script th...

SUSE CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

SUSE CVE-2026-31892

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From 2.9.0 to before 4.0.2 and 3.7.11, A user who can submit Workflows can completely bypass all security settings defined in a WorkflowTemplate by including a podSpecPatch field in...

EUVD-2026-14601

Trivy ecosystem supply chain was briefly compromised...

CVE-2026-33475

Langflow is a tool for building and deploying AI-powered agents and workflows. An unauthenticated remote shell injection vulnerability exists in multiple GitHub Actions workflows in the Langflow repository prior to version 1.9.0. Unsanitized interpolation of GitHub context variables e.g., $...

TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials

Two more GitHub Actions workflows have become the latest to be compromised by credential-stealing malware by a threat actor known as TeamPCP, the cloud-native cybercriminal operation also behind the Trivy supply chain attack. The workflows, both maintained by the supply chain security company...

CVE-2026-33634 Trivy ecosystem supply chain briefly compromised

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious...

Introducing Wiz Agents & Workflows: Security at the Speed of AI

A new security operating model powered by AI agents that removes bottlenecks and enables teams to act at the speed of AI...

Duplicate Advisory: OpenClaw Node system.run approval context-binding weakness in approval-enabled host=node flows

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hjvp-qhm6-wrh2. This link is maintained to preserve external references. Original Description OpenClaw versions prior to 2026.2.26 contain an approval context-binding weakness in system.run execution flows with...