Open Source Vulnerabilities

argo-workflows, argo-workflows, argo-workflows, argo-workflows

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript

argo-workflows, argo-workflows, argo-workflows, argo-workflows

interpretation-conflict (CWE-436) vulnerability in node-forge versions 1

argo-workflows, argo-workflows, argo-workflows, argo-workflows

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

argo-workflows, argo-workflows, argo-workflows, argo-workflows

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

argo-workflows, argo-workflows, argo-workflows, argo-workflows

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects

argo-workflows, argo-workflows, argo-workflows, argo-workflows

NPM package `micromatch` prior to 4

argo-workflows, argo-workflows, argo-workflows, argo-workflows

Lodash versions 4

argo-workflows, argo-workflows, argo-workflows

linkify-it is a links recognition library with full Unicode support

argo-workflows, argo-workflows, argo-workflows, argo-workflows

linkify-it is a links recognition library with full Unicode support

argo-workflows, argo-workflows, argo-workflows, argo-workflows

launch-editor allows users to open files with line numbers in editor from Node

argo-workflows, argo-workflows, argo-workflows, argo-workflows

launch-editor allows users to open files with line numbers in editor from Node

argo-workflows, argo-workflows, argo-workflows, argo-workflows

js-yaml is a JavaScript YAML parser and dumper

argo-workflows, argo-workflows, argo-workflows

Immutable

argo-workflows, argo-workflows, argo-workflows

Immutable

argo-workflows, argo-workflows, argo-workflows, argo-workflows

Immutable

argo-workflows, argo-workflows, argo-workflows, argo-workflows

http-proxy-middleware is node

argo-workflows, argo-workflows, argo-workflows, argo-workflows

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP)

argo-workflows, argo-workflows, argo-workflows, argo-workflows

flatted is a circular JSON parser

argo-workflows, argo-workflows, argo-workflows, argo-workflows

flatted is a circular JSON parser

argo-workflows, argo-workflows, argo-workflows, argo-workflows

fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization

argo-workflows, argo-workflows, argo-workflows, argo-workflows

fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions

datadog-agent-fips-7.85-core-integrations

datadog-agent-fips-7.85-core-integrations

Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace

Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate

tigera-operator-fips

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

tigera-operator-fips

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

tigera-operator-fips

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

tigera-operator-fips

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

tigera-operator-fips

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

tigera-operator-fips

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

tigera-operator-fips

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

argo-workflows, argo-workflows, argo-workflows, argo-workflows

form-data is a library for creating readable multipart/form-data streams

argo-workflows, argo-workflows, argo-workflows, argo-workflows

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (

langfuse-worker, langfuse-worker

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree

argo-workflows, argo-workflows, argo-workflows, argo-workflows

Impact: Lodash versions 4

argo-workflows, argo-workflows, argo-workflows, argo-workflows

Impact: The fix for CVE-2021-23337 (https://github

opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, rancher-agent, rancher-agent, rancher-agent, ollama, ollama, ollama-fips, ollama-fips

malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, rancher-agent, atlantis-fips, rancher-agent, rancher-agent, ollama, ollama, ollama-fips, ollama-fips

malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

ollama, ollama

TIFF decoder can panic when decoding an invalid image with an out-of-bounds strip offset

ollama, ollama

maliciously crafted TIFF file can cause image decoding to attempt to allocate up 4GiB of memory, causing either excessive resource consumption or an out-of-memory error

ollama, ollama

TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption

Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line

ollama, ollama

webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size

thingsboard, thingsboard, thingsboard, thingsboard, thingsboard, thingsboard

Security fix for GHSA-52cp-r559-cp3m applied in: thingsboard 4.3.1.3-r3, thingsboard 4.3.1.3-r4, thingsboard 4.3.1.3-r5

argo-workflows, argo-workflows, argo-workflows, thingsboard, thingsboard, thingsboard, thingsboard, thingsboard, thingsboard

js-yaml is a JavaScript YAML parser and dumper

datadog-cluster-agent-7.85

datadog-cluster-agent-7.85

datadog-agent-fips-7.85-fakeintake