EUVD-2025-12401

Malicious code in bioql PyPI...

EUVD-2023-2553

Malicious code in bioql PyPI...

EUVD-2023-2541

Malicious code in bioql PyPI...

Malicious code in xray-k3s-project (npm)

The package xray-k3s-project was found to contain malicious code...

MAL-2025-39951 Malicious code in xray-k3s-project (npm)

The package xray-k3s-project was found to contain malicious code...

Running Serverless Wasm Functions on the Edge with k3s and SpinKube

...

CVE-2025-49140 vulnerabilities

Vulnerabilities for packages: k3s...

GHSA-F26W-GH5M-QQ77 vulnerabilities

Vulnerabilities for packages: k3s...

CVE-2023-32187

An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supervisor port TCP 6443 cause denial of service. This issue affects k3s: from v1.24.0 before v1.24.17+k3s1, from v1.25.0 before v1.25.13+k3s1, from v1.26.0...

GHSA-CXFP-7PVR-95FF vulnerabilities

Vulnerabilities for packages: wolfictl, cg, k3s, melange, zot...

GHSA-HCG3-Q754-CR77 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, policy-controller, gcsfuse, swagger, cortex, tailscale, kaf, kargo, kube-state-metrics, kubernetes-dashboard-auth, terraform-provider-google, spire-server, docker-compose, vendir, kserve-modelmesh-serving,...

GO-2025-3646 CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s

CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

Authentication Bypass

github.com/k3s-io/k3s is vulnerable to unintended unauthenticated access. The vulnerability is due to a Kubernetes kubelet configuration change that, in some cases, sets ReadOnlyPort to 10255, allowing unauthenticated access and potential exposure of credentials...

CVE-2025-46599 vulnerabilities

Vulnerabilities for packages: k3s...

GHSA-864F-7XJM-2JP2 vulnerabilities

Vulnerabilities for packages: k3s...

GHSA-864F-7XJM-2JP2 vulnerabilities

Vulnerabilities for packages: rke2-runtime-fips, rke2-runtime, k3s...

CVE-2025-46599 vulnerabilities

Vulnerabilities for packages: rke2-runtime-fips, rke2-runtime, k3s...

CVE-2025-46599

CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...

GHSA-864F-7XJM-2JP2 CNCF K3s Kubernetes kubelet configuration exposes credentials

CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...

CNCF K3s Kubernetes kubelet configuration exposes credentials

CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...