GO-2026-5381 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, opentelemetry-collector, mc, k8sgpt, opentelemetry-collector-contrib, istio, loki, minio-object-browser, node-problem-detector, tempo, jaeger, trillian, certificate-transparency, prometheus-pushgateway, minio-operator, keda,...

GO-2026-5764 vulnerabilities

Vulnerabilities for packages: kaniko, percona-server-mongodb-operator, xeol, gitaly, crossplane-provider-aws-cloudformation, aws-s3-controller, gitlab-runner, steampipe, bank-vaults, flux-kustomize-controller, weaviate, boring-registry, crossplane-provider-aws-kinesis,...

GO-2026-4887 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, envoy-gateway, docker-credential-gcr, gatekeeper, neuvector-scanner, nerdctl, k8sgpt, opentelemetry-collector-contrib, pulumi, rancher, rancher-agent, podman, nuclei, newrelic-infrastructure-agent, traefik, ko, amazon-cloudwatch-agent-operato...

GO-2026-4883 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, envoy-gateway, docker-credential-gcr, gatekeeper, neuvector-scanner, nerdctl, k8sgpt, opentelemetry-collector-contrib, pulumi, rancher, rancher-agent, podman, nuclei, newrelic-infrastructure-agent, traefik, ko, amazon-cloudwatch-agent-operato...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: fulcio, conjur-cli, helm-push, cri-tools, kbld, kube-state-metrics, promxy, kubernetes-csi-node-driver-registrar, terraform-provider-kubernetes, crossplane, ghaudit, docker-machine-driver-harvester, hivemind, otel-cli, aws-s3-controller, render-template,...

GO-2026-5074 vulnerabilities

Vulnerabilities for packages: act, witness, kaniko, cerbos, skaffold, crossplane, xeol, gitaly, syft, dagger, argo-cd, scorecard, gitlab-runner, flux-image-automation-controller, nfpm, steampipe, kubevela, terragrunt, teleport, gomplate, pulumi, kubescape, gptscript, bom, argo-workflows, nuclei,...

GO-2026-4869 vulnerabilities

Vulnerabilities for packages: act, helm-push, kbld, coredns, kubernetes-csi-node-driver-registrar, crossplane, cert-manager, k3s, xeol, gitaly, grafana-operator, caddy, licenseclassifier, weaviate, dex, malcontent, kubernetes-csi-driver-nfs, fuse-overlayfs-snapshotter, crane, nats-server, ko, kot...

GO-2026-5023 vulnerabilities

Vulnerabilities for packages: skaffold, gitlab-kas, opentelemetry-collector, cert-manager, k3s, kubernetes, nerdctl, helm, cilium-cli, flux-image-automation-controller, kubernetes-dashboard, istio, loki, rancher, kubescape, prometheus, cilium, mattermost, chisel, cloud-provider-aws,...

GO-2026-5506 vulnerabilities

Vulnerabilities for packages: act, promxy, cri-tools, step, kubernetes-csi-node-driver-registrar, crossplane-provider-aws-cloudformation, docker-machine-driver-harvester, envoy-ratelimit, gitlab-runner, kserve, node-problem-detector, k3d, dex, knative-client, kubernetes-csi-driver-nfs,...

GO-2026-4339 vulnerabilities

Vulnerabilities for packages: k3s, local-static-provisioner, bank-vaults, nri-nagios, kubernetes-csi-driver-hostpath, grafana-rollout-operator, crossplane-provider-aws-dynamodb, crossplane-provider-aws-cloudfront, kube-bench, kubo, git-sync, crossplane-provider-sql, ytt, kubernetes-replicator,...

GO-2024-3005 vulnerabilities

Vulnerabilities for packages: cosign, kaniko, helm-push, cri-tools, skaffold, opentelemetry-collector, crossplane, gh, docker-credential-gcr, k3s, neuvector-scanner, nerdctl, syft, policy-controller, docker-compose, dagger, helm, k8sgpt, dagdotdev, scorecard, cilium-cli, up,...

GO-2024-3105 vulnerabilities

Vulnerabilities for packages: nri-elasticsearch, fulcio, kaniko, q, k3s, local-static-provisioner, kserve, bank-vaults, weaviate, logstash-exporter, nri-nagios, kubernetes-csi-driver-hostpath, cadvisor, crossplane-provider-aws-dynamodb, crossplane-provider-aws-cloudfront, glow, kube-bench, mailpi...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: skaffold, policy-controller, neuvector-sigstore-interface, kubescape, ko, tkn, spire-server, falcoctl, wolfictl, flux-source-controller, melange, tekton-chains, aactl, vexctl, goreleaser, slsa-verifier, apko, gitsign, zarf, zot...

ROOT-APP-NPM-CVE-2026-67214 CVE-2026-67214 in nanoid - Patched by Root

Root has patched CVE-2026-67214 in the nanoid package for Root:npm. Multiple fixed versions available...

UBUNTU-CVE-2026-6470

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL...

Malicious code in check-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723c3dbef875102d9d461c655737b930ea9f58f2a5555bd254d954d7003eacf5 [email protected] is an otherwise empty package no author, no description, no meaningful code whose only effect on install is to pull a dependency...

MAL-2026-13976 Malicious code in check-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723c3dbef875102d9d461c655737b930ea9f58f2a5555bd254d954d7003eacf5 [email protected] is an otherwise empty package no author, no description, no meaningful code whose only effect on install is to pull a dependency...

MAL-2026-13977 Malicious code in cspell-esm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e857800f57969e257ed22cd056f2e4a4395de09ac9b69becd0c7c2b931314ab Package name resembles the widely-used 'cspell' library but its main entry index.js exports an empty object and provides no functionality. Its...

Malicious code in napi-raw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d002132bfd19338c8fbc1cc3775c1c8b7be3d059c642881c4dd92be67bf7c895 [email protected] is a near-empty wrapper main exports , no lifecycle scripts whose only effect on install is to declare ltidisafe as a dependency...

MAL-2026-13984 Malicious code in napi-raw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d002132bfd19338c8fbc1cc3775c1c8b7be3d059c642881c4dd92be67bf7c895 [email protected] is a near-empty wrapper main exports , no lifecycle scripts whose only effect on install is to declare ltidisafe as a dependency...