GO-2026-5094 vulnerabilities

Vulnerabilities for packages: portieris, gitlab-rails-ce, gitlab-rails-ce-fips, argocd-image-updater-fips, kots, gitness, envoy-gateway-fips, zot, argocd-image-updater, portieris-fips, envoy-gateway...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: portieris, gitlab-rails-ce, gitlab-rails-ce-fips, argocd-image-updater-fips, kots, gitness, envoy-gateway-fips, zot, argocd-image-updater, portieris-fips, envoy-gateway...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: chaos-mesh, drone-fips, eksctl, helm-exporter, consul-k8s, zarf-fips, redpanda-operator, tigera-operator-fips, cloudbeat-fips, argocd-image-updater-fips, chaos-mesh-fips, kyverno, trivy, k9s-fips, trivy-fips, tigera-operator, jfrog-cli, steampipe, vcluster-fips,...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: grafana-alloy, kubescape-operator, rancher-fleet, zarf, vcluster, tflint, filebrowser, undock, terragrunt, trivy, terraform, opentofu, steampipe, trivy-operator, k9s, zot, gitness, guac, xeol, trufflehog, nsc, podman, envoy-gateway, gitleaks, nuclei, gptscript...

GO-2025-3418 vulnerabilities

Vulnerabilities for packages: envoy-gateway...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: kots, kine, envoy-gateway, spire-server, k3s...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: rancher-fleet, pluto, zarf, flux-helm-controller, helm-operator, helm-push, trivy, istio, chartmuseum, kots, helm-docs, k9s, flux-source-controller, zot, linkerd2, k8sgpt, tw, envoy-gateway, rancher-helm, cerbos, eksctl, cilium-cli, k8ssandra-client, kargo,...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: kots, portieris, envoy-gateway, zot, gitness, argocd-image-updater...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: kots, portieris, envoy-gateway, zot, gitness, argocd-image-updater...

WordPress Payment Gateway for PayPal on WooCommerce plugin < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability

Unauthenticated Payment Bypass via PayPal Advanced Return Handler vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Payment Gateway for PayPal on WooCommerce versions 9.2.1...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843

OpenChoreo is vulnerable prior to versions 1.0.2 and 1.1.2 due to unauthenticated access in internal/cluster-gateway/server.go that exposed caller-facing management APIs on the external agent listener. This allows network-reachable attackers to invoke /api/proxy/ and /api/exec/, proxy the data-pl...

CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73842

OpenChoreo OpenKubernetes platform vulnerability CVE-2026-73842 affects cluster-gateway internal proxy. Before versions 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certifica...

CVE-2026-73564 frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...

CVE-2026-73564 frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...

CVE-2026-73564

The CVE affects frp (frps) with the SSH Tunnel Gateway enabled. A root cause was an integer overflow in parsing an SSH exec channel: the code adds 4 to an attacker-controlled 4-byte length, and 0xFFFFFFFF wraps to 3, causing a bounds check bypass and a panic in TunnelServer.handleNewChannel. When...