GHSA-XV7V-HW45-9JGW vulnerabilities

Vulnerabilities for packages: jenkins...

GHSA-8394-6F8R-WHXG Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

EUVD-2026-60205

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

CVE-2026-71566

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

CVE-2026-71566

FakeFish passes credentials to scripts for real hardware BMC validation, but the KubeVirt backend ignores them entirely, relying on a mounted KUBECONFIG file. This lets any cluster user control, power-cycle, and attach arbitrary CD images to VMs owned by other users. CVSS 9.3 (Critical). No patch...

CVE-2026-71566 KubeVirt backend is not authenticated

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

BIT-GITLAB-2026-12436 Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

PT-2026-73291

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user to modify CI/CD configuration belonging to another user due to improper validation of...

CVE-2026-71566: Missing Authentication for Critical Function

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: terraform-provider-google, cyberark-secrets-provider-for-k8s, prometheus-node-exporter-fips, step-kms-plugin, gitlab-kas-fips, trino, kuberay-apiserver, kuberay-operator, rancher-loglevel, s5cmd-fips, crossplane-provider-aws-ce,...

CVE-2026-22555

A flaw was found in Gitea. An API Application Programming Interface endpoint responsible for forking repositories into an organization failed to properly check if a user had the necessary permissions to create repositories within that organization. This allowed a read-only organization member to...

GO-2026-5486 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains-fips, tkn-fips, tekton-pipelines-fips, tekton-chains, tekton-pipelines...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: kube-arangodb, trivy-fips, manifest-tool, drone, gitlab-operator-fips, kubescape-server-fips, cloudbeat, chaos-mesh-fips, consul-k8s, cloudbeat-fips, rancher-agent, kube-mgmt-fips, rancher-fleet-fips, argocd-image-updater-fips, envoy-gateway, ocm-cli, opentofu-fips,...

GO-2025-3521 vulnerabilities

Vulnerabilities for packages: longhorn-share-manager, harvester-fips, rke2-runtime-fips, longhorn-manager, kubernetes, vcluster, longhorn-manager-fips, azure-container-networking, argo-cd-fips, spark-operator-fips, harvester, longhorn-share-manager-fips...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: rancher-system-agent, longhorn-share-manager, harvester-fips, rke2-runtime-fips, azurefile-csi, azuredisk-csi, longhorn-manager, longhorn-manager-fips, cluster-autoscaler-fips, azurefile-csi-fips, argo-cd-fips, eks-distro, kubernetes-csi-driver-hostpath, harvester,...

GO-2026-4678 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines, argo-workflows-fips...

GO-2026-5418 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater, argo-cd...

GO-2026-5618 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater, argo-cd...

GO-2026-5693 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, terragrunt, kyverno, argo-cd, upwind-agent, grafana-fips, gitaly, gitlab-rails-ce, external-secrets-operator, grafana, nemo, argo-cd-fips, teleport, terragrunt-fips, guac, external-secrets-operator-fips, flux-fips, flux...