CVE-2026-53572

KEDA (Kubernetes-based Event Driven Autoscaling) is affected by a PostgreSQL connection string parameter injection in pkg/scalers/postgresql_scaler.go prior to version 2.20.0 . The root cause is that escapePostgreConnectionParameter() only quotes values containing a literal space, leaving tabs, n...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cert-manager, kubernetes-csi-external-attacher, k8ssandra-client, kube-vip-cloud-provider, kwok, cass-operator, flux-notification-controller, openbao, cluster-api-gcp-controller, pulumi-kubernetes-operator, kube-metrics-adapter, azure-service-operator,...

CVE-2026-73500 affecting package keda for versions less than 2.14.1-17

CVE-2026-73500 affecting package keda for versions less than 2.14.1-17. A patched version of the package is available...

GO-2026-5940 vulnerabilities

Vulnerabilities for packages: keda-http-add-on-fips, keda-http-add-on...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, mcp-grafana, splunk-otel-collector, istio, tempo, grafana-pyroscope, minio-object-browser, karma, jaeger, prometheus-pushgateway, aws-otel-collector, telegraf, trillian, keda, datadog-agent, mc, loki, minio-operator, minio, certificate-transparency...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy, amazon-cloudwatch-agent-operator, splunk-otel-collector, istio, prometheus-operator, k8sgpt, tempo, karma, prometheus, jaeger, prometheus-pushgateway, metrics-server, opentelemetry-collector, grafana, node-problem-detector, aws-otel-collector,...

CLEANSTART-2026-RF73854 Security fixes in keda 2.18.3-r0

Package keda version 2.18.3-r0 fixes 6 vulnerabilities: CVE-2026-26958, CVE-2025-68156, CVE-2026-24051, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr...

CLEANSTART-2026-TO27266 Security fixes in keda 2.18.3-r1

Package keda version 2.18.3-r1 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-XA68717 Security fixes in keda 2.19.0-r2

Package keda version 2.19.0-r2 fixes 1 vulnerabilities: CVE-2026-34986...

CVE-2026-56852 affecting package keda for versions less than 2.14.1-16

CVE-2026-56852 affecting package keda for versions less than 2.14.1-16. A patched version of the package is available...

GO-2026-5940 KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping in github.com/kedacore/keda

KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping in github.com/kedacore/keda...

GHSA-6W3M-4HHP-775Q vulnerabilities

Vulnerabilities for packages: keda-http-add-on-fips, keda-http-add-on...

CVE-2026-53572 vulnerabilities

Vulnerabilities for packages: keda-http-add-on-fips, keda-http-add-on...

CVE-2026-42502 affecting package keda for versions less than 2.14.1-14

CVE-2026-42502 affecting package keda for versions less than 2.14.1-14. A patched version of the package is available...

CVE-2026-25681 affecting package keda for versions less than 2.14.1-14

CVE-2026-25681 affecting package keda for versions less than 2.14.1-14. A patched version of the package is available...

CVE-2026-25680 affecting package keda for versions less than 2.14.1-14

CVE-2026-25680 affecting package keda for versions less than 2.14.1-14. A patched version of the package is available...

CVE-2026-53572

creationtimestamp| type| source ---|---|--- 2026-07-08 00:35:03+00:00| published-proof-of-concept| https://github.com/kedacore/keda/security/advisories/GHSA-6w3m-4hhp-775q...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the escapePostgreConnectionParameter function. An attacker can inject arbitrary PostgreSQL connection parameters by supplying specially crafted values containing non-space whitespace or backslash characters, which are...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the escapePostgreConnectionParameter function. An attacker can inject arbitrary PostgreSQL connection parameters by supplying specially crafted values containing non-space whitespace or backslash characters, which are...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: omnictl-multiarch, flux-source-controller-fips, kine, kubernetes-dashboard, frankenphp-8.2, coder-fips, gatekeeper-fips, zarf-fips, cilium-cli, istio, frankenphp-8.5, minio-fips, etcd-fips, skaffold-fips, external-secrets-operator-fips, omnictl-multiarch-fips,...