GO-2026-5676 vulnerabilities

Vulnerabilities for packages: jitsucom-bulker, k8sgateway, kyverno-policy-reporter-ui, q, spegel, kube-metrics-adapter, kyverno-policy-reporter, opentelemetry-operator, kubo, traefik, coredns, kubernetes-dns-node-cache, ipfs-cluster, dkron, k3s, teleport, kargo, frp...

GO-2026-6000 vulnerabilities

Vulnerabilities for packages: datadog-agent, datadog-operator, vitess, kubernetes-dns-node-cache...

GO-2025-3942 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway, cloudflared, kubernetes-dns-node-cache...

GO-2024-2785 vulnerabilities

Vulnerabilities for packages: juicefs, cloudflared, kubernetes-dns-node-cache...

GO-2025-4017 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-ui, k8sgateway, q, spegel, traefik, kubo, caddy, kubernetes-dns-node-cache, k3s, ipfs-cluster, dkron, kargo, frp...

GO-2026-5761 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, node-feature-discovery, k8s-device-plugin, cadvisor, nvidia-container-toolkit, sriov-network-device-plugin, podman, buildah, falco-no-driver...

GO-2025-4096 vulnerabilities

Vulnerabilities for packages: kubernetes, grafana-alloy, node-feature-discovery, k3s, nvidia-container-toolkit, sriov-network-device-plugin, podman, buildah, falco-no-driver...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, argocd-image-updater, ip-masq-agent, spark-operator, cri-tools, kubeflow-pipelines, kubernetes-dns-node-cache, k8s-device-plugin, local-static-provisioner, kubernetes-csi-driver-hostpath...

GO-2024-3286 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, nodetaint, argocd-image-updater, ip-masq-agent, kubeflow-pipelines, kubernetes-dns-node-cache, k8s-device-plugin, local-static-provisioner...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: nodetaint, aws-efs-csi-driver, ip-masq-agent, kubernetes-dns-node-cache, prometheus-adapter, spark-operator...

GO-2024-3302 vulnerabilities

Vulnerabilities for packages: q, spegel, caddy, buf, cloudflared, k3s, kubernetes-dns-node-cache, frp...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: q, k8sgateway, spegel, seaweedfs, traefik, kubo, caddy, buf, kubernetes-dns-node-cache, ipfs-cluster, dkron, k3s, kargo, frp...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: minio, prometheus-operator, node-problem-detector, datadog-agent, istio, mc, certificate-transparency, prometheus, keda, grafana, jaeger, prometheus-pushgateway, opentelemetry-collector, tempo, trillian, karma, aws-otel-collector, fluent-bit-plugin-loki,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: metacontroller, spqr, dbmate, authservice, container-object-storage-interface, hubble-ui, tofu-controller, crossplane-provider-aws-lambda, goreleaser, opencost, crossplane-provider-aws-firehose, nri-postgresql, terraform, nri-redis,...

PT-2026-76555

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.41.3 Description Authenticated users can perform server-side requests to internal services and cloud metadata. This occurs because automation steps for outgoing webhooks, Zapier, n8n, Slack, and Discord use...

PT-2026-75931

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

Linux Distros Unpatched Vulnerability : CVE-2026-73566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an...

Malicious code in node-config-svg-contract (npm)

Source: amazon-inspector f73906b728364e1fa1f870bd746a0bec46ed3937ff42eef10bea8389729a86c1 The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtime from fragmented constants protocol, subdomain, domain,...

CVE-2026-73665

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...

CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.usecheckAuth in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not...