GO-2025-3525 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent, nats, kubeflow-pipelines, opentelemetry-collector, argo-rollouts, opentelemetry-collector-contrib, kargo, k8sgpt, argo-workflows, grafana-alloy, splunk-otel-collector...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53, crossplane-provider-aws-s3, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-family-azure, datadog-agent, crossplane-provider-aws-sns, crossplane-provider-azure-authorization, crossplane-provider-aws-dynamodb,...

GO-2024-3311 vulnerabilities

Vulnerabilities for packages: pulumi, amazon-cloudwatch-agent-operator, promxy...

GO-2024-3305 vulnerabilities

Vulnerabilities for packages: pulumi, rancher-agent, k3s, amazon-cloudwatch-agent-operator, kubevela, promxy...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: istio, amazon-cloudwatch-agent-operator, metrics-server, prometheus, fluent-bit-plugin-loki, grafana, keda, prometheus-pushgateway, splunk-otel-collector, datadog-agent, minio, opentelemetry-collector, loki, prometheus-operator, certificate-transparency,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: chezmoi, fulcio, timestamp-authority, zot, druid, argo-events, step-ca, trivy, tekton-chains, fluent-bit-plugin-loki, ksops, zarf, grafana-mimir, buildkitd, pulumi, flux, opentelemetry-collector, flux-kustomize-controller, falcoctl, kubescape, rclone,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: k3s, flannel, undock, hubble-ui, terraform-mcp-server, timoni, sriov-network-device-plugin, flux-notification-controller, dex, k3d, podinfo, s5cmd, kubeflow, falcosidekick, gogatekeeper, slsa-verifier, git-sync, kustomize, neuvector-sigstore-interface, nri-redis,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: k3s, undock, zot, terraform-mcp-server, dex, k3d, glow, cluster-api-helm-controller, neuvector-sigstore-interface, nri-redis, buildkitd, nginx-prometheus-exporter, rabbitmq-cluster-operator, rabbitmq-messaging-topology-operator, grafana-rollout-operator,...

JLSEC-2026-1327 In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to...

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension...

MazeRunner: Nonlinear Task and Clue Orchestration for LLM-Driven Black-Box Automated Penetration Testing

Penetration testing is essential yet resource-intensive. Although large language models LLMs show promise for automating security auditing, existing agents mainly execute end-to-end workflows in simplified linear scenarios. Real-world black-box testing is fundamentally nonlinear: the attack graph...

CVE-2026-73678: Improper Control of Generation of Code

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent...

PT-2026-80569

In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended to occur only locally, including operations that add tokens or use keys. This is caused by misinteraction between agent locking and the [email protected] extension...

Oracle Enterprise Manager Base Platform Full Control

The vulnerability of the Agent Next Gen component of the Oracle Enterprise Manager Base Platform software platform is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTPS protocol...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-72849

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

Incorrect Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Incorrect Authorization in the Agent Builder due to improper verification of user ownership when determining access to private...

Information Exposure

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Information Exposure via the agent listing. An attacker can obtain sensitive Elasticsearch API key values by crafting specific...

Missing Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization in the Agent Builder. An attacker can gain unauthorized access to sensitive information and escalate...

CVE-2026-72681

Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information th...