CVE-2026-3234 Mod_proxy_cluster: mod_proxy_cluster: response body corruption via crlf injection

A flaw was found in modproxycluster. This vulnerability, a Carriage Return Line Feed CRLF injection in the decodeenc function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO endpoin...

BIT-NGINX-INGRESS-CONTROLLER-2026-3288 ingress-nginx rewrite-target nginx configuration injection

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible t...

PT-2026-24940

A flaw was found in mod proxy cluster. This vulnerability, a Carriage Return Line Feed CRLF injection in the decodeenc function, allows a remote attacker to bypass input validation. By injecting CRLF sequences into the cluster configuration, an attacker can corrupt the response body of INFO...

CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

BIT-PARSE-2026-30835 Parse Server: Malformed `$regex` query leaks database error details in API response

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0, malformed $regex query parameter e.g. abc causes the database to return a structured error object that is passed unsanitized through the API response. This...

CVE-2026-28229

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

CVE-2026-28229 Argo Workflows has unauthorized access to Argo Workflows Template

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the workflowtemplateserver and clusterworkflowtemplateserver components. An attacker can obtain sensitive information, such as embedded secrets and resource manifests, by sending unauthorized requests with a...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the workflowtemplateserver and clusterworkflowtemplateserver components. An attacker can obtain sensitive information, such as embedded secrets and resource manifests, by sending unauthorized requests with a...

GHSA-56PX-HM34-XQJ5 Unauthorized access to Argo Workflows Template

Summary Workflow templates endpoints allow any client to retrieve WorkflowTemplates and ClusterWorkflowTemplates. Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. Details...

CVE-2026-3288

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/rewrite-target Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible t...

GO-2026-4565 Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations in github.com/bitnami-labs/sealed-secrets

Sealed Secrets for Kubernetes: Rotate API Allows Scope Widening from Strict/Namespace-Wide to Cluster-Wide via Untrusted Template Annotations in github.com/bitnami-labs/sealed-secrets...

CVE-2026-30887

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: volume-modifier-for-k8s, kubernetes-csi-node-driver-registrar, k8sgpt, rancher-helm, azurefile-csi, skopeo, spiffe-helper, containerd, flux-source-controller, kubernetes-csi-external-snapshotter, kubernetes-dashboard-auth, cluster-api-aws-controller, snyk-cli,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: volume-modifier-for-k8s, kubernetes-csi-node-driver-registrar, k8sgpt, rancher-helm, azurefile-csi, skopeo, spiffe-helper, containerd, flux-source-controller, kubernetes-csi-external-snapshotter, kubernetes-dashboard-auth, cluster-api-aws-controller, snyk-cli,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: rancher-helm, k8sgpt, kubeflow, rancher-telemetry, flux-source-controller, rancher-security-scan, cerbos, neuvector-dbgen, kyverno-policy-reporter-kyverno-plugin, azuredisk-csi, timestamp-authority, nri-apache, tofu-controller, metrics-agent, portieris, spark-operato...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: rancher-helm, k8sgpt, kubeflow, rancher-telemetry, flux-source-controller, rancher-security-scan, cerbos, neuvector-dbgen, kyverno-policy-reporter-kyverno-plugin, azuredisk-csi, timestamp-authority, nri-apache, tofu-controller, metrics-agent, portieris, spark-operato...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: rancher-helm, k8sgpt, kubeflow, rancher-telemetry, flux-source-controller, rancher-security-scan, cerbos, neuvector-dbgen, kyverno-policy-reporter-kyverno-plugin, azuredisk-csi, timestamp-authority, nri-apache, tofu-controller, metrics-agent, portieris, spark-operato...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: prometheus-beat-exporter-fips, openfga, prometheus-operator, kepler, spire-controller-manager-fips, metallb-fips, local-path-provisioner-fips, conftest, libnvidia-container, prometheus-podman-exporter, bank-vaults, docker-compose, tfsec, verticadb-operator,...