Ecosystem
Wolfi
8,498 known vulnerabilities.
Most affected packages
811 results · Clear filters · Feed
-
Critical 9.0
ASP.NET Core Elevation of Privilege Vulnerability
Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
-
Critical 9.1
Kyverno 1.18.0 before 1.19.2 verifyImages Cache Signature Verification Bypass
Kyverno 1.18.0 before 1.19.2 contains a signature verification bypass in verifyImages because cached verification results are keyed by the image reference string (such as a tag) rather than bound to the verified digest, so cache hits skip signature and attest…
-
Critical 9.9
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy
Kyverno from 1.17.0 before 1.19.2 contains a privilege escalation vulnerability that allows namespace-scoped tenants to modify resources in other namespaces through NamespacedMutatingPolicy targetMatchConstraints.expression CEL output lacking namespace checks…
-
Critical 9.9
Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument
Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get() and resource.post(), allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. seg…
-
Critical 9.9
Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath
Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind # …
-
Critical 9.9
Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced Cleanup…
-
Critical 9.9
Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy
Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CE…
-
Critical 9.8
Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check
Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespa…
-
Critical 9.6
Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbi…
-
Critical 9.6
Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code o…
-
Critical 9.6
Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineerin…
-
Critical 9.6
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arb…
-
Critical 9.6
Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineer…
-
Critical 9.6
Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…
-
Critical 9.6
Incorrect reference resolution in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging…
-
Critical 9.6
Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to pote…
-
Critical 9.6
Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering…
-
Critical 9.6
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging soci…
-
Critical 9.6
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging soci…
-
Critical 9.6
Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code ou…
-
Critical 9.6
Use after free in Navigation in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potenti…
-
Critical 9.6
Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute ar…
-
Critical 9.6
Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code …
-
Critical 9.6
Use after free in WebGPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbit…
-
Critical 9.6
Use after free in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code out…
-
Critical 9.6
Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engine…
-
Critical 9.6
Buffer overflow in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code out…
-
Critical 9.6
Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineerin…
-
Critical 9.6
Use after free in PictureInPicture in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social …
-
Critical 9.6
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging soci…
-
Critical 9.6
Memory corruption in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially…
-
Critical 9.6
Use after free in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitra…
-
Critical 9.6
Buffer overflow in Dawn in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially …
-
Critical 9.6
Use after free in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…
-
Critical 9.6
Buffer overflow in Dawn in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitr…
-
Critical 9.6
Use after free in WebGL in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially …
-
Critical 9.6
Memory corruption in ANGLE in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potential…
-
Critical 9.3
kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential helper github.com/chrismellard/docker-credential-acr-env, which…
-
Critical 9.5
Unauthenticated RCE vulnerability against ClickHouse Server
An issue has been discovered in ClickHouse Server that, under certain conditions, could allow an unauthenticated user with network access to execute arbitrary code on the ClickHouse Server.
-
Critical 9.1
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an…