Mindersec Minder vulnerabilities

• mindersec minder Minder does not sandbox http.send in Rego programs CVE-2025-65109 Fix available 8.5 HighNovember 20, 2025
• mindersec minder Denial of service from maliciously configured Git repository in Minder CVE-2024-37904 Fix available 5.7 MediumJune 18, 2024
• mindersec minder Denial of service of Minder Server from maliciously crafted GitHub attestations CVE-2024-35238 Fix available 5.3 MediumMay 27, 2024
• mindersec minder Stacklok Minder vulnerable to denial of service from maliciously crafted templates CVE-2024-35194 Fix available 5.3 MediumMay 20, 2024
• mindersec minder Denial of service of Minder Server with attacker-controlled REST endpoint CVE-2024-35185 Fix available 5.3 MediumMay 16, 2024
• mindersec minder Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests CVE-2024-34084 Fix available 7.5 HighMay 7, 2024
• mindersec minder Minder GetRepositoryByName data leak CVE-2024-31455 Fix available 4.3 MediumApril 9, 2024
• lfprojects minder `GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user CVE-2024-27916 Fix available 7.1 HighMarch 5, 2024
• lfprojects minder Minder trusts client-provided mapping from repo name to upstream ID CVE-2024-27093 Fix available 4.6 MediumFebruary 26, 2024