Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline (pkg.go.dev)
Tekton Pipelines VolumeMount path restriction bypass via missing filepath.Clean in github.com/tektoncd/pipeline
Security
Go security advisories and CVEs.
Vulnerability disclosures, CVEs, security advisories, and patched releases.
3,874
Stories indexed
31
Live sources
55 issue
Latest digest
22h 25m 06:30 CET
Next digest in
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline (pkg.go.dev)
Tekton Pipelines has VerificationPolicy regex pattern bypass via substring matching in github.com/tektoncd/pipeline
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline (pkg.go.dev)
Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline (pkg.go.dev)
Tekton Pipelines git resolver revision parameter argument injection in github.com/tektoncd/pipeline
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline (pkg.go.dev)
Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun in github.com/tektoncd/pipeline
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline (pkg.go.dev)
Path traversal in Tekton Pipelines git resolver in github.com/tektoncd/pipeline
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline (pkg.go.dev)
Tekton Pipelines git resolver leaks API token to user-controlled serverURL in github.com/tektoncd/pipeline
Insecure enrollment token TTL in nebula-mesh in github.com/forgekeep/nebula-mesh (pkg.go.dev)
The nebula-mesh Web UI host creation ignores the configured enrollment token TTL and instead mints 24-hour bearer enrollment tokens. This can lead to tokens remaining valid for longer than intended, i
Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh (pkg.go.dev)
When OIDC is enabled, the login endpoint is reachable without authentication and is registered outside the rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it
Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph (pkg.go.dev)
The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gai
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma (pkg.go.dev)
Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdmin in github.com/kumahq/kuma. NOTE: The source advisory for this report contains additional versions that could not be
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma (pkg.go.dev)
kuma-dp connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma. NOTE: The source advisory for this report contains additional versions that coul
kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma (pkg.go.dev)
kumactl connects to control plane without verifying TLS certificate when no CA is configured in github.com/kumahq/kuma. NOTE: The source advisory for this report contains additional versions that coul
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads in gitea.dev (pkg.go.dev)
Gitea: Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads in gitea.dev
Gitea: Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents in gitea.dev (pkg.go.dev)
Gitea: Personal access token scope enforcement bypass on the repository home page ( ) discloses private repository contents in gitea.dev
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea (pkg.go.dev)
Gitea Docker image: default lets any source IP impersonate any user via in code.gitea.io/gitea
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) in gitea.dev (pkg.go.dev)
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) in gitea.dev
Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints in gitea.dev (pkg.go.dev)
Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints in gitea.dev
Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev (pkg.go.dev)
Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content in gitea.dev
Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) in gitea.dev (pkg.go.dev)
Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of 37698) in gitea.dev