GO-2025-4096 vulnerabilities

Vulnerabilities for packages: kubernetes, grafana-alloy, node-feature-discovery, k3s, nvidia-container-toolkit, sriov-network-device-plugin, podman, buildah, falco-no-driver...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, argocd-image-updater, ip-masq-agent, spark-operator, cri-tools, kubeflow-pipelines, kubernetes-dns-node-cache, k8s-device-plugin, local-static-provisioner, kubernetes-csi-driver-hostpath...

GO-2024-3286 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, argocd-image-updater, ip-masq-agent, kubeflow-pipelines, kubernetes-dns-node-cache, k8s-device-plugin, local-static-provisioner...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: nodetaint, aws-efs-csi-driver, ip-masq-agent, kubernetes-dns-node-cache, prometheus-adapter, spark-operator...

GO-2024-3302 vulnerabilities

Vulnerabilities for packages: q, spegel, caddy, buf, cloudflared, k3s, kubernetes-dns-node-cache, frp...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: q, k8sgateway, spegel, seaweedfs, traefik, kubo, caddy, buf, kubernetes-dns-node-cache, ipfs-cluster, dkron, k3s, kargo, frp...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: minio, prometheus-operator, node-problem-detector, datadog-agent, istio, mc, certificate-transparency, prometheus, keda, grafana, jaeger, prometheus-pushgateway, opentelemetry-collector, tempo, trillian, karma, aws-otel-collector, fluent-bit-plugin-loki,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: metacontroller, spqr, dbmate, authservice, container-object-storage-interface, hubble-ui, tofu-controller, crossplane-provider-aws-lambda, goreleaser, opencost, crossplane-provider-aws-firehose, nri-postgresql, terraform, nri-redis,...

PT-2026-76555

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...

PT-2026-75931

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

Linux Distros Unpatched Vulnerability : CVE-2026-73566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an...

Malicious code in node-config-svg-contract (npm)

Source: amazon-inspector f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1 The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtime from fragmented constants protocol, subdomain, domain,...

CVE-2026-73665

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

Malicious code in node-config-svg-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1 The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtim...

MAL-2026-13985 Malicious code in node-config-svg-contract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1 The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtim...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

CVE-2026-13460 affects IBM Storage Scale GUI, with versions 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 containing a hardcoded token in the GUI source used for inter-node cluster communication and REST API authentication. The security bulletin indicates fixes in 5.2.3.9 or later and 6.0.1.1 or later. Rem...

CVE-2026-13460 The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

EUVD-2026-58361

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...