OpenShift KMS Plugin for Key Vault server request forgery vulnerability

Version 3 of the OpenShift KMS Plugin for Key Vault contains a server-side request forgery vulnerability. This vulnerability arises because the Kroxylicious Azure Key Vault KMS provider fails to validate the format of vaultName values extracted from network-reassembled EDEK bytes. As a result,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis, pulumi-language-java, terraform-provider-azapi, trivy, nerdctl, teleport, crossplane-provider-aws-firehose, crossplane-provider-aws-iam, rancher-agent, crossplane-provider-aws-sqs, opentelemetry-collector, step-issuer,...

GO-2026-4503 vulnerabilities

Vulnerabilities for packages: argo-workflows, tailscale, jitsucom-bulker, sops, dbmate, trufflehog, nuclei, witness, hydra, sftpgo, spire-server, temporal, kyverno-policy-reporter, k3s, step-kms-plugin, dex, step, mariadb-operator, ksops, fulcio, timestamp-authority, cerbos, caddy, nri-mysql,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, crossplane-provider-aws-kinesis, go-licenses, paranoia, azcopy, dbmate, dkron, cass-operator, cert-manager-istio-csr, pgtimetable, nerdctl, hydra, kuberlr, k8sgateway, yace, crossplane-provider-aws-firehose,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi, trivy, kind, kuberlr, k8sgateway, lazydocker, kubernetes-csi-external-health-monitor, cis-operator, kubeflow-katib, steampipe, opa, cluster-api-azure-controller, rclone, aactl, rabbitmq-cluster-operator, helm-push, cloud-provider-vsphere,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: argo-workflows, tailscale, jitsucom-bulker, sops, dbmate, trufflehog, nuclei, witness, hydra, sftpgo, spire-server, temporal, kyverno-policy-reporter, k3s, step-kms-plugin, dex, step, mariadb-operator, ksops, fulcio, timestamp-authority, cerbos, caddy, nri-mysql,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: kubescape-operator, neuvector-dbgen, trivy, yace, kuberlr, temporal, lazydocker, http-echo, kubernetes-csi-external-health-monitor, petname, cert-manager-webhook-pdns, terraform-provider-sendgrid, kapp, kubernetes-csi-external-attacher, mc, mongo-tools,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

GHSA-7WWX-XJ66-R44X vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, kubescape-operator, neuvector-dbgen, go-licenses, terraform-provider-azapi, dbmate, kubevela, task, kind, hydra, kuberlr, nerdctl, vt-cli, lazydocker, cadvisor, http-echo, gostatsd, kubernetes-csi-external-health-monitor, petname...