A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.

▾ Twilightcri-o · github.com/cri-o/cri-oEPSS 1.4%via NVD

CVE-2024-32476Medium· 6.5

2y ago

Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences

▾ Sunlitargoproj · github.com/argoproj/argo-cd/v2EPSS 1.0%via OSV

CVE-2020-8559Medium· 6.8PoC

2y ago

Privilege Escalation in Kubernetes

▾ Twilightapimachinery · k8s.io/apimachineryEPSS 6.1%via OSV

CVE-2021-36775High· 8.0

2y ago

Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication

▾ Twilightrancher · github.com/rancher/rancherEPSS 0.97%via OSV

CVE-2021-31999High· 8.8

2y ago

Rancher Privilege escalation vulnerability via malicious "Connection" header

▾ Twilightrancher · github.com/rancher/rancherEPSS 1.1%via OSV

CVE-2021-25318High· 8.8

2y ago

Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources

▾ Twilightrancher · github.com/rancher/rancherEPSS 1.1%via OSV

CVE-2024-32880Critical· 9.1

2y ago

pyLoad allows upload to arbitrary folder lead to RCE

▾ Midnightpyload-ng · pyload-ngEPSS 1.4%via OSV

CVE-2024-32879Medium· 4.9

2y ago

social-auth-app-django affected by Improper Handling of Case Sensitivity

▾ Sunlitsocial-auth-app-django · social-auth-app-djangoEPSS 0.58%via OSV

CVE-2024-31208Medium· 6.5

2y ago

Synapse V2 state resolution weakness allows Denial of Service (DoS)

▾ Sunlitmatrix-synapse · matrix-synapseEPSS 1.5%via OSV

CVE-2022-24769Medium· 5.9

2y ago

Moby (Docker Engine) started with non-empty inheritable Linux process capabilities

▾ Sunlitmoby · github.com/moby/mobyEPSS 0.49%via OSV

Tagged “osv”

Ryu Infinite Loop vulnerability

Ryu Infinite Loop vulnerability

Ryu Infinite Loop vulnerability

Gradio's Component Server does not properly consider` _is_server_fn` for functions

sagemaker-python-sdk vulnerable to Deserialization of Untrusted Data

changedetection.io Cross-site Scripting vulnerability

tqdm CLI arguments injection attack

sagemaker-python-sdk Command Injection vulnerability

aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests

kubevirt allows a local attacker to execute arbitrary code via a crafted command

pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload

pgAdmin is affected by a multi-factor authentication bypass vulnerability

Navidrome Parameter Tampering vulnerability

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

nautobot has reflected Cross-site Scripting potential in all object list views

Calico privilege escalation vulnerability

Buffer Overflow vulnerability in osrg gobgp

PyPXE Buffer Overflow vulnerability

dcnnt-py is vulnerable to command injection via Notification Handler

python-jose algorithm confusion with OpenSSH ECDSA keys

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation

Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences

Privilege Escalation in Kubernetes

Rancher's Failure to delete orphaned role bindings does not revoke project level access from group based authentication

Rancher Privilege escalation vulnerability via malicious "Connection" header

Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources

pyLoad allows upload to arbitrary folder lead to RCE

social-auth-app-django affected by Improper Handling of Case Sensitivity

Synapse V2 state resolution weakness allows Denial of Service (DoS)

Moby (Docker Engine) started with non-empty inheritable Linux process capabilities