PT-2026-84583

Applications built on the legacy Azure SDK for Rust azure core 0.21.0 and earlier write the value of the outgoing authorization header to their logs whenever debug-level logging is enabled, and in every affected version also at trace level. The leaked values are live credentials — Microsoft Entra...

GO-2025-3521 vulnerabilities

Vulnerabilities for packages: longhorn-manager-fips, vcluster, azure-container-networking, longhorn-share-manager, longhorn-manager, spark-operator-fips, kubernetes, argo-cd-fips, rke2-runtime-fips, longhorn-share-manager-fips, harvester-fips, harvester...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, crossplane-provider-aws-ssm-fips, crossplane-provider-aws-route53, crossplane-provider-gcp-fips, crossplane-provider-aws-eks-fips, crossplane-provider-aws-elbv2, crossplane-provider-aws-ssm, crossplane-provider-aws-elbv2-fips,...

GO-2026-5052 vulnerabilities

Vulnerabilities for packages: goreleaser, crossplane-provider-azure-authorization, nfpm, cert-manager, crossplane-provider-azure-storage, grafana, nuclei, splunk-otel-collector, telegraf, external-secrets-operator, crossplane-provider-azure-sql, x509-certificate-exporter,...

GO-2026-5224 vulnerabilities

Vulnerabilities for packages: azure-service-operator, rancher-agent, rancher...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: docker, rootlesskit, kuma, k3s, podman, nerdctl, datadog-agent, calico, containerd, multus-cni, flannel, azure-ipam, buildkitd, istio, buildah...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: zot, flux-source-controller, pulumi, falcoctl, kubescape, thanos, timestamp-authority, druid, flux-image-reflector-controller, buildkitd, argo-workflows, trivy, wal-g, chezmoi, flux-kustomize-controller, fluent-bit-plugin-loki, opentelemetry-collector, cosign, fulcio...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: calico, thanos, kubernetes-csi-external-snapshotter, kubernetes-csi-external-attacher, descheduler, dynamic-localpv-provisioner, fulcio, podman, scorecard, vault-secrets-webhook, grpcurl, openfga, rqlite, crossplane-provider-sql, snyk-cli, trillian, tfsec,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, paranoia, addon-resizer, terraform-provider-acme, temporal-server, calico, rancher-fleet, grafana-alloy, temporal-ui-server, cluster-proportional-autoscaler, glab, dgraph, litestream, descheduler, dynamic-localpv-provisioner,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: temporal-server, gitness, crossplane-provider-azure, crossplane-provider-aws, temporal-ui-server, dgraph, dynamic-localpv-provisioner, gh, fulcio, gitsign, scorecard, vexctl, spark-operator, cloudflared, nfs-subdir-external-provisioner, rqlite, sigstore-scaffolding,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, terraform-provider-acme, glab, chezmoi, crossplane-provider-aws-rds, gh, opentelemetry-collector, fscrypt, fulcio, podman, traefik, scorecard, cloudflared, cloud-provider-aws, snyk-cli, syft, terraform-provider-tls, gitlab-runner,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: chisel, osv-scanner, yunikorn-k8shim, paranoia, s5cmd, calico, gitness, influx, git-sync, temporal-ui-server, hey, doppler-kubernetes-operator, kubernetes-csi-external-attacher, litestream, descheduler, dynamic-localpv-provisioner, crossplane-provider-aws-rds, swagge...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: yunikorn-k8shim, kind, grafana-alloy, kubernetes-csi-external-health-monitor, dgraph, mockgen, nova, swagger, ipfs-cluster, fulcio, docker-credential-gcr, envconsul, spark-operator, portieris, rabbitmq-cluster-operator, aws-application-networking-k8s, docker-cli,...

GO-2025-4135 vulnerabilities

Vulnerabilities for packages: oras, mailpit, temporal-server, calico, thanos, crossplane-provider-azure, timestamp-authority, crossplane-provider-aws, rancher-fleet, temporal-ui-server, vault-env, kubernetes-csi-external-health-monitor, glab, dgraph, kubernetes-csi-external-attacher, age, chezmoi...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: zot, crossplane-provider-azure-storage, terraform, k3s, flux-source-controller, pulumi, falcoctl, kubescape, timestamp-authority, crossplane-provider-azure, crossplane-provider-family-azure, flux-image-reflector-controller, buildkitd, glab, flux-kustomize-controller,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: oras, addon-resizer, thanos, crossplane-provider-azure, chezmoi, descheduler, dynamic-localpv-provisioner, fulcio, scorecard, grpcurl, cert-exporter, nfs-subdir-external-provisioner, snyk-cli, trillian, kyverno-policy-reporter-ui, crane, tfsec, govulncheck,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: oras, addon-resizer, temporal-server, thanos, crossplane-provider-azure, chezmoi, dynamic-localpv-provisioner, fulcio, scorecard, grpcurl, cert-exporter, nfs-subdir-external-provisioner, rqlite, trillian, kyverno-policy-reporter-ui, crane, tfsec, govulncheck,...

Security Updates for Azure CycleCloud < 8.9.2 (August 2026)

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities: - Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. CVE-2026-70340 - Missing authorization in Azure CycleCloud allows...

The vulnerability of Azure’s Application Insights Profiler, a cloud-based tool for analyzing web application performance, stems from an incorrect path name limitation in the catalog. This allows attackers to escalate their privileges.

The vulnerability of Azure’s Application Insights Profiler, a cloud-based tool for analyzing web application performance, is related to an incorrect path name limitation. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

The vulnerability of Azure cloud services for managing geospatial data with the Microsoft Planetary Computer Pro lies in the lack of authentication for a critical function, allowing attackers to escalate their privileges.

The vulnerability of Azure cloud services for managing geospatial data with the Microsoft Planetary Computer Pro is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...