GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: docker, upwind-agent, commercial-expanso-edge, gitlab-rails-ce, omnictl-multiarch-fips, podman-fips, docker-cli-buildx-fips, pulumi-language-yaml, traefik, tekton-pipelines, longhorn-cli, amazon-ssm-agent, skaffold, terraform, gomplate-fips, grype,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: k9s, tkn, pulumi-language-yaml, pulumi, nuclei, cosign, splunk-otel-collector, containerd, external-secrets-operator, opentofu, terraform-provider-azapi, traefik, skaffold, terraform-provider-azurerm, crossplane-provider-aws-kinesis, kargo, witness, melange, tw,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: istio, k3s, k9s, spire-server, gitea, gitlab-kas, zarf, prometheus-operator, fscrypt, flux, containerd, trivy, prometheus, knative-serving, kubernetes-dashboard, nerdctl, argocd-image-updater, zot, external-dns, skaffold, kubescape, chisel, snyk-cli, rancher,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: k9s, tkn, pulumi-language-yaml, pulumi, nuclei, cosign, splunk-otel-collector, containerd, external-secrets-operator, opentofu, skaffold, terraform-provider-azurerm, kargo, witness, melange, dagger, loki, pulumi-kubernetes-operator, wolfictl,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: k9s, tkn, pulumi-language-yaml, pulumi, nuclei, cosign, splunk-otel-collector, containerd, external-secrets-operator, opentofu, terraform-provider-azapi, traefik, skaffold, terraform-provider-azurerm, crossplane-provider-aws-kinesis, kargo, witness, melange, tw,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: k9s, pulumi-language-yaml, pulumi, nuclei, containerd, external-secrets-operator, opentofu, skaffold, witness, melange, dagger, loki, pulumi-kubernetes-operator, wolfictl, kubernetes, pulumi-language-java, opentelemetry-collector, telegraf,...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: gomplate, istio, k3s, k9s, spire-server, gitea, pulumi-language-yaml, apko, gitlab-kas, syft, prometheus-operator, zarf, fscrypt, nuclei, flux, pulumi, splunk-otel-collector, containerd, trivy, prometheus, external-secrets-operator, knative-serving, opentofu,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: istio, k3s, spire-server, gitlab-kas, prometheus-operator, fscrypt, flux, containerd, prometheus, knative-serving, kubernetes-dashboard, nerdctl, zot, external-dns, snyk-cli, rancher, cloud-provider-aws, loki, cilium, kyverno, cilium-cli, cert-manager,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: istio, k3s, k9s, spire-server, gitea, gitlab-kas, zarf, prometheus-operator, fscrypt, flux, containerd, trivy, prometheus, knative-serving, kubernetes-dashboard, nerdctl, argocd-image-updater, zot, external-dns, skaffold, kubescape, chisel, snyk-cli, rancher,...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: restic, cert-manager-openshift-routes-fips, crossplane-provider-aws-opensearch-fips, dex, kubernetes-csi-driver-nfs, crossplane-provider-azure-security, secrets-store-csi-driver-provider-azure-fips, linkerd2, steampipe, gomplate-fips, kubernetes-csi-external-resizer,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: restic, cert-manager-openshift-routes-fips, crossplane-provider-aws-opensearch-fips, dex, kubernetes-csi-driver-nfs, crossplane-provider-azure-security, secrets-store-csi-driver-provider-azure-fips, linkerd2, steampipe, gomplate-fips, kubernetes-csi-external-resizer,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: azure-workload-identity-webhook, descheduler, k9s, kserve-modelmesh-serving, gatekeeper, kyverno-notation-aws, tkn, dkron, cert-manager-csi-driver, nuclei, haproxy-ingress, containerd, external-secrets-operator, temporal-server, kube-vip-cloud-provider, opentofu,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: azure-workload-identity-webhook, descheduler, k9s, kserve-modelmesh-serving, gatekeeper, kyverno-notation-aws, tkn, dkron, cert-manager-csi-driver, nuclei, haproxy-ingress, containerd, external-secrets-operator, temporal-server, kube-vip-cloud-provider, opentofu,...

UBUNTU-CVE-2026-41842

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

EUVD-2026-35342

Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

CVE-2026-41842 Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

EUVD-2026-35330

Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48...

CVE-2026-41842

The CVE-2026-41842 entry affects Spring Framework in Spring MVC and WebFlux, reporting a Denial of Service (DoS) when resolving static resources. Affected versions are Spring Framework 7.0.0–7.0.7; 6.2.0–6.2.18; 6.1.0–6.1.27; 5.3.0–5.3.48. The description in both records states the DoS vulnerabil...

CVE-2026-41840

Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. Affected versions: Spring Framework 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, 5.3.0 through 5.3.48...