298 matches found
CVE-2026-27143 vulnerabilities
Vulnerabilities for packages: gitaly, kubernetes-csi-external-attacher, nats-top, delve, kubernetes-csi-node-driver-registrar, coredns, mattermost, renovate, istio, nri-consul, opentelemetry-operator, percona-server-mongodb-operator, newrelic-nri-statsd, kubernetes, prometheus-operator, xcover,...
GHSA-CFP9-33RC-J74F vulnerabilities
Vulnerabilities for packages: gitaly, kubernetes-csi-external-attacher, nats-top, delve, kubernetes-csi-node-driver-registrar, coredns, mattermost, renovate, istio, nri-consul, opentelemetry-operator, percona-server-mongodb-operator, newrelic-nri-statsd, kubernetes, prometheus-operator, xcover,...
GHSA-CQRX-3M42-5P5W vulnerabilities
Vulnerabilities for packages: gitaly, kubernetes-csi-external-attacher, nats-top, delve, kubernetes-csi-node-driver-registrar, coredns, mattermost, renovate, istio, nri-consul, opentelemetry-operator, percona-server-mongodb-operator, newrelic-nri-statsd, kubernetes, prometheus-operator, xcover,...
CVE-2026-27144 vulnerabilities
Vulnerabilities for packages: gitaly, kubernetes-csi-external-attacher, nats-top, delve, kubernetes-csi-node-driver-registrar, coredns, mattermost, renovate, istio, nri-consul, opentelemetry-operator, percona-server-mongodb-operator, newrelic-nri-statsd, kubernetes, prometheus-operator, xcover,...
GHSA-CFP9-33RC-J74F vulnerabilities
Vulnerabilities for packages: neuvector-fips, flux-source-controller-fips, azuredisk-csi, docker-cli-fips, aws-flb-kinesis-fips, beats, tigera-operator-fips, gatekeeper-fips, vault-k8s, spilo, zabbix-agent2, hey, dataplaneapi-fips, istio, external-dns-fips, helm-fips, consul-fips,...
CVE-2026-27143 vulnerabilities
Vulnerabilities for packages: neuvector-fips, flux-source-controller-fips, azuredisk-csi, docker-cli-fips, aws-flb-kinesis-fips, beats, tigera-operator-fips, gatekeeper-fips, vault-k8s, spilo, zabbix-agent2, hey, dataplaneapi-fips, istio, external-dns-fips, helm-fips, consul-fips,...
GHSA-CQRX-3M42-5P5W vulnerabilities
Vulnerabilities for packages: neuvector-fips, flux-source-controller-fips, azuredisk-csi, docker-cli-fips, aws-flb-kinesis-fips, beats, tigera-operator-fips, gatekeeper-fips, vault-k8s, spilo, zabbix-agent2, hey, dataplaneapi-fips, istio, external-dns-fips, helm-fips, consul-fips,...
CVE-2026-27144 vulnerabilities
Vulnerabilities for packages: neuvector-fips, flux-source-controller-fips, azuredisk-csi, docker-cli-fips, aws-flb-kinesis-fips, beats, tigera-operator-fips, gatekeeper-fips, vault-k8s, spilo, zabbix-agent2, hey, dataplaneapi-fips, istio, external-dns-fips, helm-fips, consul-fips,...
BIT-APISIX-2026-31924 Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
BIT-APISIX-2026-31923 Apache APISIX: Openid-connect `tls_verify` field is disabled by default
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
BIT-APISIX-2026-31908 Apache APISIX: forward auth plugin allows header injection
Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31908
Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31908
Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31924
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31923
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
EUVD-2026-22239
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
CVE-2026-31923
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
CVE-2026-31923 Apache APISIX: Openid-connect `tls_verify` field is disabled by default
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...
CVE-2026-31923
CVE-2026-31923 affects Apache APISIX (0.7–3.15.0) due to openid-connect plugin tls_verify/ssl_verify being disabled by default, enabling cleartext transmission of sensitive information. The CVSSv3.1 base score is 7.5 (Network attack, Low attack complexity, no privileges or user interaction, Confi...
CVE-2026-31923 Apache APISIX: Openid-connect `tls_verify` field is disabled by default
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. This can occur due to sslverify in openid-connect plugin configuration being set to false by default. This issue affects Apache APISIX: from 0.7 through 3.15.0. Users are recommended to upgrade to version 3.16.0, whic...