backstage

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry.

An integer overflow flaw was found in the Linux kernel's create_elf_tables() function.

A Remote Code Execution (RCE) vulnerability has been identified in the Kedro ShelveStore class (version 0.19.8).

Dragonfly is an open source P2P-based file distribution and image acceleration system.

Authentication vulnerability in MOSN v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as r…

Podman Desktop is a graphical tool for developing on containers and Kubernetes.

Podman Desktop is a graphical tool for developing on containers and Kubernetes.

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification.

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.

In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.

EVerest is an EV charging software stack.

Dex is an identity service that uses OpenID Connect to drive authentication for other apps.

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system.

containerd is an open source container runtime.

EVerest is an EV charging software stack.

Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences,…

In kedro-org/kedro version 0.19.8, the `pull_package()` API function allows users to download and extract micro packages from the Internet.

A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar file…

oras-go is a Go library for managing OCI artifacts.

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines.

Vitess is a database clustering system for horizontal scaling of MySQL.

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system.

EVerest is an EV charging software stack.