GO-2026-6865 vulnerabilities

Vulnerabilities for packages: step, wolfictl, knative-serving, sqlexporter, step-ca, vendir, terraform, k3d, kubevela, policy-controller, vault-secrets-webhook, tailscale, osv-scanner, kpt, kubescape, minio-object-browser, ferretdb, trivy, kubeflow-katib, crossplane, datadog-operator,...

CVE-2026-116591 vulnerabilities

Vulnerabilities for packages: step, wolfictl, knative-serving, sqlexporter, step-ca, vendir, terraform, k3d, kubevela, policy-controller, vault-secrets-webhook, tailscale, osv-scanner, kpt, kubescape, minio-object-browser, ferretdb, trivy, kubeflow-katib, crossplane, datadog-operator,...

GHSA-FPMH-FRQ8-7RJ8 vulnerabilities

Vulnerabilities for packages: step, wolfictl, knative-serving, sqlexporter, step-ca, vendir, terraform, k3d, kubevela, policy-controller, vault-secrets-webhook, tailscale, osv-scanner, kpt, kubescape, minio-object-browser, ferretdb, trivy, kubeflow-katib, crossplane, datadog-operator,...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, kyverno-policy-reporter, openbao, rancher-agent, step, aactl, cert-manager-webhook-pdns, loki, chartmuseum, renovate, argo-cd, cloudprober, filebrowser, rancher, flux-source-controller, grafana, falco-no-driver, juicefs, gitlab-pages, terragrunt,...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, kyverno-policy-reporter, openbao, rancher-agent, step, aactl, cert-manager-webhook-pdns, loki, chartmuseum, renovate, argo-cd, cloudprober, filebrowser, rancher, flux-source-controller, grafana, falco-no-driver, juicefs, gitlab-pages, terragrunt,...

GO-2026-6506 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache-fips, eks-distro, kubernetes-dns-node-cache, k8sgateway...

GO-2026-6506 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache, k8sgateway...

GO-2026-6507 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache-fips, eks-distro, kubernetes-dns-node-cache, k8sgateway...

GO-2026-6507 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache, k8sgateway...

CVE-2026-82399 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache-fips, eks-distro, kubernetes-dns-node-cache, k8sgateway...

GHSA-9GM5-9RFH-M6VX vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache-fips, eks-distro, kubernetes-dns-node-cache, k8sgateway...

CVE-2026-86003 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache-fips, eks-distro, kubernetes-dns-node-cache, k8sgateway...

GHSA-MRG3-QVQR-JW29 vulnerabilities

Vulnerabilities for packages: juicefs, k8sgateway-fips, eks-distro-fips, kubernetes-dns-node-cache-fips, eks-distro, kubernetes-dns-node-cache, k8sgateway...

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

EUVD-2026-63899

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763

JuiceFS filestore backend (pkg/object/file.go) contains a path traversal vulnerability. The path(key) function joined object keys onto the storage root using filepath.Join or filepath.Clean without verifying the resolved path remained beneath the root. All operations—Put, Get, Head, Delete, Chmod...