PT-2025-34183

Name of the Vulnerable Software and Affected Versions: Cockroach Labs cockroach-k8s-request-cert affected versions not specified Description: The cockroach-k8s-request-cert component is susceptible to an authentication bypass due to an empty root password. This allows unauthorized access...

MAL-2025-17054 Malicious code in cisco-k8s (npm)

The package cisco-k8s was found to contain malicious code...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, cluster-api-gcp-controller, gpu-operator, kyverno-fips, nvidia-nsight-compute-12.9, beats, caddy, cloud-provider-aws-fips, docker-cli-buildx, sqlexporter, flux-helm-controller, certificate-transparency, supercronic, falcoctl-fips,...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23260

CVE-2025-23260 involves NVIDIA AIStore’s AIS Operator. The Red Hat and NVIDIA-NS docs describe an issue where a user can gain elevated access to a Kubernetes cluster by abusing the ServiceAccount bound to the ClusterRole, potentially leading to information disclosure. Affected component is the AI...

CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

PT-2025-26762

Name of the Vulnerable Software and Affected Versions: NVIDIA AIStore versions prior to 2.3.0 Description: The issue is related to a vulnerability in the AIS Operator of NVIDIA AIStore, where a user can gain elevated access to the k8s cluster by using the ServiceAccount attached to the ClusterRol...

CVE-2025-50182 vulnerabilities

Vulnerabilities for packages: az, dask-kubernetes, py3-pipenv, pypy-3.10, ggshield, kubeflow-katib, dask-gateway, reflex, k8s-sidecar, jupyter-base-notebook, jupyter-docker-stacks, py3-pip, airflow, kserve, jwt-tool, mlflow, superset, confluent-docker-utils, kubeflow-pipelines, pypy-3.11,...

CVE-2025-50181 vulnerabilities

Vulnerabilities for packages: az, dask-kubernetes, py3-pipenv, pypy-3.10, ggshield, kubeflow-katib, dask-gateway, k8s-sidecar, jupyter-base-notebook, jupyter-docker-stacks, py3-pip, airflow, kserve, jwt-tool, mlflow, superset, confluent-docker-utils, kubeflow-pipelines, datadog-agent, pypy-3.11,...

GHSA-48P4-8XCF-VXJ5 vulnerabilities

Vulnerabilities for packages: az, dask-kubernetes, py3-pipenv, pypy-3.10, ggshield, kubeflow-katib, dask-gateway, reflex, k8s-sidecar, jupyter-base-notebook, jupyter-docker-stacks, py3-pip, airflow, kserve, jwt-tool, mlflow, superset, confluent-docker-utils, kubeflow-pipelines, pypy-3.11,...

GHSA-PQ67-6M6Q-MJ2V vulnerabilities

Vulnerabilities for packages: az, dask-kubernetes, py3-pipenv, pypy-3.10, ggshield, kubeflow-katib, dask-gateway, k8s-sidecar, jupyter-base-notebook, jupyter-docker-stacks, py3-pip, airflow, kserve, jwt-tool, mlflow, superset, confluent-docker-utils, kubeflow-pipelines, datadog-agent, pypy-3.11,...

MAL-2025-4566 Malicious code in k8s-lint-action (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b445cff5be01caddf1be7a89f1cea09fce4135e635b83655ff150c35b8940e86 Any computer that has this package installed or running should be considered...

CVE-2025-46342

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selectors in their match statements are mistakenly not applied during admission review request processing due to a missing error...

CVE-2025-46342

Kyverno CVE-2025-46342 affects policy rules using namespace selectors in match statements. Prior to versions 1.13.5 and 1.14.0, a missing error propagation in GetNamespaceSelectorsFromNamespaceLister (pkg/utils/engine/labels.go) may cause those rules to be ignored during admission review, bypassi...

CVE-2025-46342: Improper Validation of Specified Type of Input

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selectors in their match statements are mistakenly not applied during admission review request processing due to a missing error...

GHSA-JRR2-X33P-6HVC Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Summary Due to a missing error propagation in function GetNamespaceSelectorsFromNamespaceLister in pkg/utils/engine/labels.go it may happen that policy rules using namespace selectors in their match statements are mistakenly not applied during admission review request processing. As a consequence...

PT-2025-18296

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.13.5 and 1.14.0 Description The issue concerns a policy engine where policy rules using namespace selectors in their match statements may not be applied correctly due to a missing error propagation in the...

GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: rootlesskit, pulumi-kubernetes-operator, cni-plugins, grafana-alloy, weaviate, skopeo, flux-helm-controller, kserve-modelmesh-serving, minio, newrelic-nri-kube-events, k8sgpt, terraform-provider-sendgrid, yunikorn-k8shim, aws-s3-controller, kuberlr, redis-operator,...

GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: flux-source-controller, k8sgpt-operator, gpu-operator, kyverno-fips, terraform-provider-time-fips, external-secrets-fips, cluster-proportional-autoscaler-fips, caddy, terraform-provider-azurerm-fips, secrets-store-csi-driver-provider-aws-fips,...

CVE-2025-24375

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...