GHSA-V6H2-P8H4-QCJW vulnerabilities

Vulnerabilities for packages: pulumi, renovate, sqlpad, lerna, code-server, py3-jupyterlab, argo-workflows, kubeflow-centraldashboard, node-gyp, vitess, opensearch-dashboards, langfuse, npm, eslint, ts-patch, kubeflow-pipelines, tileserver-gl, prism, rancher-api-ui...

CVE-2025-5889 vulnerabilities

Vulnerabilities for packages: pulumi, renovate, sqlpad, lerna, code-server, py3-jupyterlab, argo-workflows, kubeflow-centraldashboard, node-gyp, vitess, opensearch-dashboards, langfuse, npm, eslint, ts-patch, kubeflow-pipelines, tileserver-gl, prism, rancher-api-ui...

GHSA-V6H2-P8H4-QCJW vulnerabilities

Vulnerabilities for packages: tileserver-gl, wazuh-dashboard, tensorflow-cpu-jupyter, pulumi, opensearch-dashboards-fips, prism, renovate, gitlab-rails-ce-fips, node-gyp, eslint, foxx-cli, kubeflow-centraldashboard, gitlab-rails-ce, npm, graalvm, emsdk, lerna, vitess, ts-patch, kubeflow-pipelines...

CVE-2025-5889 vulnerabilities

Vulnerabilities for packages: tileserver-gl, wazuh-dashboard, tensorflow-cpu-jupyter, pulumi, opensearch-dashboards-fips, prism, renovate, gitlab-rails-ce-fips, node-gyp, eslint, foxx-cli, kubeflow-centraldashboard, gitlab-rails-ce, npm, graalvm, emsdk, lerna, vitess, ts-patch, kubeflow-pipelines...

Innovation in the Fast Lane: Lessons from Motorsport and Cybersecurity

Learn how Trend Micro and NEOM McLaren Formula E Team turn creativity into innovation by rethinking team structures, workflows, and data use...

The Hidden Threat in Your Stack: Why Non-Human Identity Management is the Next Cybersecurity Frontier

Modern enterprise networks are highly complex environments that rely on hundreds of apps and infrastructure services. These systems need to interact securely and efficiently without constant human oversight, which is where non-human identities NHIs come in. NHIs — including application secrets, A...

CVE-2025-49013 WilderForge vulnerable to code Injection via GitHub Actions Workflows

WilderForge is a Wildermyth coremodding API. A critical vulnerability has been identified in multiple projects across the WilderForge organization. The issue arises from unsafe usage of $ github.event.review.body and other user controlled variables directly inside shell script contexts in GitHub...

PT-2025-24436 · Unknown +1 · Wilderforge +1

Name of the Vulnerable Software and Affected Versions: WilderForge affected versions not specified Description: A critical issue has been identified in the WilderForge organization, stemming from the unsafe use of user-controlled variables, such as $ github.event.review.body , directly inside she...

SCGAgent: Recreating the Benefits of Reasoning Models for Secure Code Generation with Agentic Workflows

Large language models LLMs have seen widespread success in code generation tasks for different scenarios, both everyday and professional. However current LLMs, despite producing functional code, do not prioritize security and may generate code with exploitable vulnerabilities. In this work, we...

Inclusive, Differentially Private Federated Learning for Clinical Data

Federated Learning FL offers a promising approach for training clinical AI models without centralizing sensitive patient data. However, its real-world adoption is hindered by challenges related to privacy, resource constraints, and compliance. Existing Differential Privacy DP approaches often app...

Chances and Challenges of the Model Context Protocol in Digital Forensics and Incident Response

Large language models hold considerable promise for supporting forensic investigations, but their widespread adoption is hindered by a lack of transparency, explainability, and reproducibility. This paper explores how the emerging Model Context Protocol can address these challenges and support th...

CVE-2024-52799

Argo Workflows Chart is used to set up argo and its needed dependencies through one command. Prior to 0.44.0, the workflow-role has excessive privileges, the worst being create pods/exec, which will allow kubectl exec into any Pod in the same namespace, i.e. arbitrary code execution within those...

CVE-2024-45919

A security flaw has been discovered in Solvait version 24.4.2 that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in /AssignToMe/SetAction, an attacker can bypass approval workflows leading to unauthorized access to sensitive information ...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...

CVE-2023-34063

Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access to remote organizations and workflows...

CVE-2023-6804

Improper privilege management allowed arbitrary workflows to be committed and run using an improperly scoped PAT. To exploit this, a workflow must have already existed in the target repo. This vulnerability affected all versions of GitHub Enterprise Server since 3.8 and was fixed in version 3.8.1...

CVE-2023-24029

In Progress WSFTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface due to insufficient authorization controls applied on user modification workflows...

CVE-2021-32724

check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the check-spelling action enabled that triggers on pullrequesttarget or schedule, an attacker can send a crafted Pull Request that causes a GITHUBTOKEN to be exposed. With the...

CVE-2009-1078

Sun Java System Identity Manager IdM 7.0 through 8.0 does not enforce the expected privilege requirements for 1 deleting audit policies and 2 modifying workflows, which allows remote authenticated users to have an unspecified impact...

Securing CI/CD workflows with Wazuh

Continuous Integration and Continuous Delivery/Deployment CI/CD refers to practices that automate how code is developed and released to different environments. CI/CD pipelines are fundamental in modern software development, ensuring code is consistently tested, built, and deployed quickly and...