GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kapp-controller, azcopy, terraform-provider-azurerm, crossplane-provider-aws-elasticache, crossplane-provider-aws-kms, paranoia, cloud-provider-azure, aws-node-termination-handler, crossplane-provider-aws-sns, tofu-controller, sftpgo-plugin-pubsub, consul-k8s,...

GO-2023-1754 vulnerabilities

Vulnerabilities for packages: aactl, ko, apko...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: thanos-operator, gke-gcloud-auth-plugin, src, terraform, secrets-store-csi-driver, kubernetes-dashboard-metrics-scraper, rqlite, dex, kubewatch, k3s, pulumi-language-dotnet, kpt, nodetaint, crossplane-provider-azure, prometheus-operator, kubeflow,...

GO-2026-4354 vulnerabilities

Vulnerabilities for packages: witness, tflint, skaffold, tekton-chains, neuvector-sigstore-interface, goreleaser, policy-controller, vexctl, teleport, cosign, falcoctl, slsa-verifier, trivy, ratify, zarf, buildkitd, tkn, kubescape, gh, spire-server, zot, flux-source-controller, ko, trivy-operator...

GO-2025-3563 vulnerabilities

Vulnerabilities for packages: thanos-operator, sealed-secrets, newrelic-nri-statsd, amass, goreleaser, linkerd2-proxy-init, dex, render-template, crossplane-provider-azure, aws-signer-notation-plugin, cert-exporter, ksops, spegel, cert-manager-cmctl, gatus, velero-plugin-for-csi, chartmuseum, ste...

GO-2025-3595 vulnerabilities

Vulnerabilities for packages: terraform-provider-azurerm, thanos-operator, crossplane-provider-aws-sns, sealed-secrets, newrelic-nri-statsd, amass, goreleaser, dex, hubble, crossplane-provider-azure, cert-exporter, ksops, crossplane-provider-aws, spegel, cert-manager-cmctl, gatus,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kapp-controller, thanos-operator, libnvidia-container, src, terraform, kor, nri-redis, dex, cluster-api-provider-vsphere, headlamp, portieris, k3s, kpt, nri-mysql, render-template, nodetaint, hubble, prometheus-operator, ratify, k8sgpt, polaris, harbor-registry,...

GO-2024-3106 vulnerabilities

Vulnerabilities for packages: terraform-provider-azurerm, thanos-operator, crossplane-provider-aws-sns, kustomize, amass, goreleaser, newrelic-nri-statsd, mockery, dex, rook, render-template, hubble, crossplane-provider-azure, cert-exporter, ksops, crossplane-provider-aws, spegel,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: azcopy, rclone, terraform-provider-azurerm, argo-workflows, kine, actions-runner-controller, secrets-store-csi-driver-provider-azure, skaffold, flux-image-reflector-controller, tekton-chains, kots, goreleaser, policy-controller, scorecard, vexctl, terraform, flyte,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: skaffold, tekton-chains, neuvector-sigstore-interface, goreleaser, policy-controller, vexctl, falcoctl, wolfictl, slsa-verifier, zarf, apko, tkn, kubescape, spire-server, zot, flux-source-controller, ko, gitsign, melange, aactl...

SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:3604-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3604-1 advisory. This update for kubevirt fixes the following issue: - CVE-2026-13622: virt-handler migration proxy follows symlinks, allowing container esca...

CVE-2026-47766: UNIX Symbolic Link (Symlink) Following

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

USN-8529-2 linux-azure, linux-gcp, linux-hwe, linux-oracle vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8529-2: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8548-2 linux, linux-aws, linux-kvm vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8548-2: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8530-2 linux-aws-hwe vulnerabilities

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker...

USN-8530-2: Linux kernel (HWE) vulnerabilities

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker...

CVE-2026-73419 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, langfuse...

UBUNTU-CVE-2026-19730

The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt fails common on non-reflink-capable filesystems including many RHEL default XFS configurations, the fallback in ReflinkOrCopy uses io.Cop...