CVE-2025-64518

CVE-2025-64518 affects CycloneDX core (Java). From 2.1.0 up to but excluding 11.0.1, the XML Validator in cyclonedx-core-java was insecurely configured, enabling XML External Entity (XXE) injection. The issue is tied to incomplete mitigation that fixed parsing but not validation (GHSA-683x-4444-j...

CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity XXE injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation. Patches The...

GHSA-6FHJ-VR9J-G45R CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection

Impact The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity XXE injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation. Patches The...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, nodetaint, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, kubelet-csr-approver, sealed-secrets, velero, s5cmd, prometheus-adapter, rancher-telemetry, kubernetes-csi-node-driver-registrar, otel-cli, dockerize, octo-sts, delve, vertical-pod-autoscaler, kpt, cfssl, grafana-pyroscope, k3d, mage, rancher-hel...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: coredns, velero, prometheus-adapter, kpt, k3d, mockgen, metrics-server, pvc-autoresizer, secrets-store-csi-driver-provider-gcp, go-licenses, helm-mapkubeapis, yunikorn-web, cluster-api-gcp-controller, neuvector-sigstore-interface, flannel, nova, docker-credential-gcr...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: kiam, kubescape-operator-fips, prometheus-process-exporter, gosu, sonobuoy-fips, xcaddy, kwok, kbld, cert-exporter-fips, wavefront-collector-for-kubernetes, crossplane-function-go-templating, secrets-store-csi-driver-provider-aws, mockery, kube-state-metrics-fips,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: kiam, kubescape-operator-fips, prometheus-process-exporter, gosu, sonobuoy-fips, xcaddy, kwok, kbld, cert-exporter-fips, wavefront-collector-for-kubernetes, crossplane-function-go-templating, secrets-store-csi-driver-provider-aws, mockery, kube-state-metrics-fips,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: kiam, kubescape-operator-fips, prometheus-process-exporter, gosu, sonobuoy-fips, xcaddy, kwok, kbld, cert-exporter-fips, wavefront-collector-for-kubernetes, crossplane-function-go-templating, secrets-store-csi-driver-provider-aws, mockery, kube-state-metrics-fips,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: kiam, kubescape-operator-fips, prometheus-process-exporter, gosu, sonobuoy-fips, xcaddy, kwok, kbld, cert-exporter-fips, wavefront-collector-for-kubernetes, crossplane-function-go-templating, secrets-store-csi-driver-provider-aws, mockery, kube-state-metrics-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: kiam, kubescape-operator-fips, prometheus-process-exporter, gosu, sonobuoy-fips, xcaddy, kwok, kbld, cert-exporter-fips, wavefront-collector-for-kubernetes, crossplane-function-go-templating, secrets-store-csi-driver-provider-aws, mockery, kube-state-metrics-fips,...