Hashicorp's Vault is a secure, open-source secrets management tool that stores and provides access to sensitive information like API keys, passwords, and certificates. The Oxeye AppSec platform automatically found a vulnerability in Hashicorp's Vault project without any manual input. In certain conditions, it allows attackers to execute code remotely on the target system through an SQL injection attack.

The Oxeye research team has found a critical vulnerability in Spotify’s open source, CNCF-incubated project — Backstage. We reported this via Spotify’s bug bounty program and it was rapidly patched in version 1.5.1. It ranked this critical vulnerability with a CVSS score of 9.8.

The Oxeye research team has found a critical remote code execution vulnerability in the popular sandbox library VM2 - CVE-2022-36067

The Oxeye research team recently found several high severity insecure direct object reference (IDOR) vulnerabilities in Harbor – a CNCF-graduated, open source artifact registry.

Oxeye’s security research team has found a security vulnerability in Golang-based applications. Under certain conditions, it lets a threat actor bypass validations based on HTTP request parameters due to the use of unsafe URL parsing.