Search results

Cosign CLI wrapper uses temp files and exec without input validation

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#106 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 23, 2025

Plugin-run executes a mock WASM payload instead of selected artifact

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#105 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 23, 2025

[security] - WASM upload reads entire file into memory without explicit service-level caps

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#102 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[security] - Plugin Registry publish/run endpoints lack authentication

Status: Open.

#101 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[security] - Continuous Auth scorer ships with hardcoded HMAC key

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#100 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[security] - Locator token issuance open to unauthenticated clients

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#99 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[securit] - CDEFNET accepts any bearer token

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#98 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[security] - Autoheal incident API unauthenticated

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#97 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[security] - Admin Marketplace unauthenticated mutation APIs

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#96 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[security] - Database restore command injection via <code>sh -c</code>

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#95 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[security] Auth Service login accepts any credentials

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#94 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025

[security] Firecracker sandbox executes payload on host shell

help wantedExtra attention is neededExtra attention is needed

securitysystem security vulnerabilitiessystem security vulnerabilities

Status: Open.

#93 In shieldx-bot/shieldx;

· shieldx-bot opened on Oct 14, 2025