GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: cert-exporter-fips, backup-restore-operator, gcp-compute-persistent-disk-csi-driver, tekton-chains-fips, nfs-subdir-external-provisioner-fips, wazero-fips, openbao, volcano-fips, cadence, yace, oras, zot, goose, tigera-operator-fips, kserve-rest-proxy, kpt, wave,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: aws-node-termination-handler, cert-exporter-fips, knative-storage-migrate, addon-resizer, lvm-driver-fips, neuvector, backup-restore-operator, boring-registry, gcp-compute-persistent-disk-csi-driver, kyverno-policy-reporter-plugins-trivy,...

[SECURITY] Fedora 44 Update: containernetworking-plugins-1.9.1-1.fc44

Reference and example networking plugins, maintained by the CNI team. The CNI Container Network Interface project consists of a specification and libraries for writing plugins to configure network interfaces in Linux containers, along with a number of supported plugins. CNI concerns itself only...

CVE-2025-58190 affecting package cni-plugins for versions less than 1.4.0-5

CVE-2025-58190 affecting package cni-plugins for versions less than 1.4.0-5. A patched version of the package is available...

CVE-2025-47911 affecting package cni for versions less than 1.1.2-5

CVE-2025-47911 affecting package cni for versions less than 1.1.2-5. A patched version of the package is available...

GHSA-PH5J-38MG-J6HP vulnerabilities

Vulnerabilities for packages: steampipe, dkron, aws-ebs-csi-driver-fips, amazon-k8s-cni-fips, grafana-operator-fips, terragrunt, flux-source-controller, podinfo, omnictl-multiarch, flux-source-watcher, metacontroller, pgwatch, temporal-fips, victorialogs-fips, victoriametrics-cluster-fips,...

GHSA-7HFW-R8QC-89V4 vulnerabilities

Vulnerabilities for packages: steampipe, dkron, aws-ebs-csi-driver-fips, amazon-k8s-cni-fips, grafana-operator-fips, terragrunt, flux-source-controller, podinfo, omnictl-multiarch, flux-source-watcher, metacontroller, pgwatch, temporal-fips, victorialogs-fips, victoriametrics-cluster-fips,...

CVE-2026-27137 vulnerabilities

Vulnerabilities for packages: steampipe, dkron, aws-ebs-csi-driver-fips, amazon-k8s-cni-fips, grafana-operator-fips, terragrunt, flux-source-controller, podinfo, omnictl-multiarch, flux-source-watcher, metacontroller, pgwatch, temporal-fips, victorialogs-fips, victoriametrics-cluster-fips,...

CVE-2025-58190 affecting package cni-plugins for versions less than 1.3.0-11

CVE-2025-58190 affecting package cni-plugins for versions less than 1.3.0-11. A patched version of the package is available...

CVE-2025-47911 affecting package cni for versions less than 1.0.1-21

CVE-2025-47911 affecting package cni for versions less than 1.0.1-21. A patched version of the package is available...

CVE-2025-47911 affecting package cni-plugins for versions less than 1.3.0-11

CVE-2025-47911 affecting package cni-plugins for versions less than 1.3.0-11. A patched version of the package is available...

Missing Encryption of Sensitive Data

Overview github.com/rancher/rancher/pkg/controllers/management/node is a complete container management platform Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data in the cluster creation using RKE templates with Weave CNI, where the WEAVEPASSWORD is not set,...

Rancher's weave CNI password is not configured when a cluster is created from an RKE template

Impact This vulnerability only affects customers using Weave CNI Container Network Interface when configured through RKE templates. A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.13 and from 2.6.0 up to and including 2.6.4, where a UI user interface issue with RKE...

ROS-20260209-73-0042

Vulnerability in cni-plugins related to lack of protection of proprietary data. Exploitation of the vulnerability may allow a remote intruder to gain unauthorized access to protected information...

AZL-76901 CVE-2025-58190 affecting package cni-plugins 1.4.0-4

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76839 CVE-2025-58190 affecting package cni-plugins for versions less than 1.3.0-11

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76895 CVE-2025-47911 affecting package cni 1.1.2-4

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76898 CVE-2025-47911 affecting package cni-plugins 1.4.0-4

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76836 CVE-2025-47911 affecting package cni-plugins for versions less than 1.3.0-11

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

Amazon Linux 2 : cni-plugins, --advisory ALAS2-2026-3134 (ALAS-2026-3134)

The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3134 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary...