Vulnerabilities and supply chain incidents

We cover vulnerabilities and supply chain incidents that reach software builds: libraries, runtimes, base images, package registries and CI components. An entry gets written when the issue is exploited, in the CISA KEV catalog, rated critical with broad use, or a compromise of a widely used package, and when we can verify it in primary sources. Each entry says who is affected, which versions fix it and how to check your builds, and it is updated as the facts change.

For the bigger picture, see CVE publication trends. For the method behind every entry, read are we affected? how to assess a new CVE across your builds. To handle the volume, see vulnerability management automation. RSS feed