CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: x509-certificate-exporter, docker-credential-gcr, spire-controller-manager, ytt, cert-manager-istio-csr, sftpgo-plugin-auth, hubble, headlamp, stakater-reloader, kubeflow, podinfo, blobfuse2, src, vale, secrets-store-csi-driver-provider-aws, vault-secrets-webhook,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, spqr, x509-certificate-exporter, docker-credential-gcr, flux-kustomize-controller, kubo, fuse-overlayfs-snapshotter, spire-controller-manager, goreleaser, octo-sts, gcp-compute-persistent-disk-csi-driver, go-licenses, dask-gateway,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: x509-certificate-exporter, docker-credential-gcr, spire-controller-manager, ytt, cert-manager-istio-csr, sftpgo-plugin-auth, hubble, headlamp, stakater-reloader, kubeflow, podinfo, blobfuse2, src, vale, secrets-store-csi-driver-provider-aws, vault-secrets-webhook,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, spqr, x509-certificate-exporter, docker-credential-gcr, flux-kustomize-controller, kubo, fuse-overlayfs-snapshotter, spire-controller-manager, goreleaser, octo-sts, gcp-compute-persistent-disk-csi-driver, go-licenses, dask-gateway,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: x509-certificate-exporter, docker-credential-gcr, spire-controller-manager, ytt, cert-manager-istio-csr, sftpgo-plugin-auth, hubble, headlamp, stakater-reloader, kubeflow, podinfo, blobfuse2, src, vale, secrets-store-csi-driver-provider-aws, vault-secrets-webhook,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, spqr, x509-certificate-exporter, docker-credential-gcr, flux-kustomize-controller, kubo, fuse-overlayfs-snapshotter, spire-controller-manager, goreleaser, octo-sts, gcp-compute-persistent-disk-csi-driver, go-licenses, dask-gateway,...

AZL-75440 CVE-2025-11065 affecting package keda for versions less than 2.14.1-11

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75488 CVE-2025-11065 affecting package keda for versions less than 2.4.0-32

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

Azure Linux 3.0 Security Update: keda (CVE-2021-32923)

The version of keda installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-32923 advisory. - HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret...

Azure Linux 3.0 Security Update: keda (CVE-2021-42836)

The version of keda installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-42836 advisory. - GJSON before 1.9.3 allows a ReDoS regular expression denial of service attack. CVE-2021-42836 Note that Nessus...

Azure Linux 3.0 Security Update: cni / containernetworking-plugins / keda / multus (CVE-2021-38561)

The version of cni / containernetworking-plugins / keda / multus installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-38561 advisory. - golang.org/x/text/language in golang.org/x/text before 0.3.7 can...

Azure Linux 3.0 Security Update: keda (CVE-2025-29923)

The version of keda installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-29923 advisory. - go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7....

CVE-2025-68476 affecting package keda for versions less than 2.14.1-9

CVE-2025-68476 affecting package keda for versions less than 2.14.1-9. A patched version of the package is available...

GO-2025-4257 KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential in github.com/kedacore/keda

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential in github.com/kedacore/keda...

CVE-2025-68156 affecting package keda for versions less than 2.14.1-8

CVE-2025-68156 affecting package keda for versions less than 2.14.1-8. A patched version of the package is available...

AZL-72868 CVE-2025-68476 affecting package keda for versions less than 2.14.1-9

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The...

CVE-2025-68476

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The...

EUVD-2025-204753

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The...

KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

Impact An Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account...

PT-2025-52724

Name of the Vulnerable Software and Affected Versions KEDA versions prior to 2.17.3 KEDA versions prior to 2.18.3 Description KEDA is a Kubernetes-based Event Driven Autoscaling component. A flaw exists in KEDA that could allow an attacker with permissions to create or modify a...