188 matches found
GHSA-6C5V-HQJR-5XXP vulnerabilities
Vulnerabilities for packages: dapr-fips, opentelemetry-collector-contrib, opentelemetry-collector-contrib-fips, nuclio-controller, keda-fips, argo-events-fips, trufflehog-fips, bento-fips, telegraf, keda, sftpgo-plugin-pubsub, trufflehog, argo-events, guac, versitygw-fips, bento, minio-fips,...
GHSA-6C5V-HQJR-5XXP vulnerabilities
Vulnerabilities for packages: dapr, argo-events, falcosidekick, opentelemetry-collector-contrib, minio, sftpgo-plugin-pubsub, keda, bento, guac, telegraf, trufflehog...
Important: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-3 This version is a rebuild of 2.19.0 using a newer base image, Go modules and Go compiler, and two bug fixes. See the release notes for more information.
Custom Metrics Autoscaler Operator for Red Hat OpenShift updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...
AZL-99243 CVE-2026-84304 affecting package keda 2.14.1-18
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
CLEANSTART-2026-DC71490 Security fixes in keda 2.20.2-r1
Package keda version 2.20.2-r1 fixes 1 vulnerabilities: ghsa-gcjh-h69q-9w9g...
CVE-2026-53572
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
AZL-96989 CVE-2026-53572 affecting package keda 2.14.1-18
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
EUVD-2026-64131
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572
KEDA (Kubernetes-based Event Driven Autoscaling) is affected by a PostgreSQL connection string parameter injection in pkg/scalers/postgresql_scaler.go prior to version 2.20.0 . The root cause is that escapePostgreConnectionParameter() only quotes values containing a literal space, leaving tabs, n...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: cloud-provider-azure, vcluster, fluent-operator, azure-service-operator, apisix-ingress-controller, cloud-provider-gcp-cloud-controller-manager, cilium, openfga, cluster-api-aws-controller, kyverno-notation-aws, kubernetes-csi-external-attacher,...
CVE-2026-73500 affecting package keda for versions less than 2.14.1-17
CVE-2026-73500 affecting package keda for versions less than 2.14.1-17. A patched version of the package is available...
GO-2026-5940 vulnerabilities
Vulnerabilities for packages: keda-http-add-on, keda-http-add-on-fips...
GO-2026-5662 vulnerabilities
Vulnerabilities for packages: karma, mc, minio, prometheus-pushgateway, aws-otel-collector, cloud-sql-proxy, certificate-transparency, minio-operator, jaeger, datadog-agent, mcp-grafana, tempo, keda, grafana-pyroscope, trillian, minio-object-browser, istio, splunk-otel-collector, loki, telegraf...
GO-2026-5264 vulnerabilities
Vulnerabilities for packages: karma, mc, metrics-server, minio, prometheus-operator, prometheus-pushgateway, aws-otel-collector, cloud-sql-proxy, node-problem-detector, certificate-transparency, minio-operator, jaeger, fluent-bit-plugin-loki, opentelemetry-collector, datadog-agent, grafana,...
CLEANSTART-2026-AT48963 Security fixes in keda-fips 2.19.0-r2
Package keda-fips version 2.19.0-r2 fixes 8 vulnerabilities: CVE-2026-42151, CVE-2026-42154, CVE-2026-40179, CVE-2026-44903, ghsa-8rm2-7qqf-34qm...
CLEANSTART-2026-HA77289 Security fixes in keda-fips 2.19.0-r1
Package keda-fips version 2.19.0-r1 fixes 8 vulnerabilities: CVE-2026-42151, CVE-2026-42154, CVE-2026-40179, CVE-2026-44903, ghsa-8rm2-7qqf-34qm...
AZL-95931 CVE-2026-73500 affecting package keda for versions less than 2.14.1-18
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...