GO-2024-2598 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, hello-world-golang, actions-runner-controller, k3d, sbom-scorecard, rqlite, kubeflow-pipelines, kubernetes-event-exporter, yam, nuclei, prometheus-adapter, oras, kwok, cass-operator, stakater-reloader, kubebuilder,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: libssh, skopeo, actions-runner-controller, terraform-provider-sendgrid, k3d, rqlite, kubeflow-pipelines, kubernetes-event-exporter, kubernetes, prometheus-adapter, oauth2-proxy, certificate-transparency, atlantis, cloudflared, nsc, ko,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: skopeo, actions-runner-controller, kiali, kubeflow-pipelines, kubernetes-event-exporter, kubernetes, kubernetes-csi-external-snapshotter, omnibump, prometheus-adapter, argocd-image-updater, crossplane-provider-aws-firehose, cass-operator, stakater-reloader, atlantis,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, headlamp, actions-runner-controller, k3d, tfsec, kubeflow-pipelines, kubernetes-event-exporter, langfuse, crossplane-provider-sql, crossplane-provider-aws-firehose, cass-operator, stakater-reloader, kyverno-policy-reporter-ui, govulncheck,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: headlamp, k3d, nuclei, oauth2-proxy, kubernetes-dashboard-web, timescaledb-tune, ko, fzf, hubble, step-kms-plugin, lazydocker, cloud-provider-gcp-cloud-controller-manager, containerd, helm-push, opa, caddy, migrate, cluster-api-provider-vsphere, azure-service-operato...

GO-2024-2825 vulnerabilities

Vulnerabilities for packages: newrelic-fluent-bit-output, hello-world-golang, skopeo, k3d, tfsec, prometheus-adapter, oauth2-proxy, kwok, oras, certificate-transparency, atlantis, cloudflared, kubebuilder, ko, kyverno-policy-reporter-ui, secrets-store-csi-driver-provider-azure, govulncheck,...

EUVD-2026-58506

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

Oracle Linux 9 : iscsi-initiator-utils (ELSA-2026-53844)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-53844 advisory. - fix CVE-2026-44943: path traversal via IQN names in discovery - fix CVE-2026-44944: iscsiuio socket credential verification bypass - fix...

OpenStack Keystone: OpenStack Keystone: Unauthorized cross-project access due to improper validation in EC2 credential creation

A flaw was found in OpenStack Keystone. An attacker holding an unrestricted application credential could exploit a vulnerability in the POST /v3/credentials endpoint where the caller-supplied projectid for an EC2-type credential was not validated against the project of the authenticating...

openstack-keystone: OpenStack Keystone: Privilege escalation through EC2 credential creation

A flaw was found in OpenStack Keystone. An authenticated user with a reader role can exploit a vulnerability in the EC2 credential creation endpoint. By using a restricted application credential to call the EC2 credential creation API, the user may obtain EC2/S3 credentials that carry the full se...

CVE-2026-73304

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...

CVE-2026-72857

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857

Budibase before 3.40.0 has a credential exposure weakness: it does not redact credentials stored in STRING fields, enabling authenticated users with table read permissions to read MongoDB connection strings and Firebase private keys via the read API, effectively exposing live backend credentials ...

CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

CVE-2026-72857 Budibase before 3.40.0 Credential Exposure via STRING Fields

Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to...

Security Bulletin: Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit the...

MAL-2026-14007 Malicious code in react-shield (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 407d23edc671619cbd75b7d6ba9aa57d1d7a591669dac19d1c2413a78e586362 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-8715

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

CVE-2026-18741

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...

EUVD-2026-58471

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset...