CLEANSTART-2026-YZ58775 KEDA is a Kubernetes-based Event Driven Autoscaling component

CVE-2026-77524 affects multiple packages. KEDA is a Kubernetes-based Event Driven Autoscaling component. See references for individual vulnerability details...

CLEANSTART-2026-PW30520 KEDA is a Kubernetes-based Event Driven Autoscaling component

CVE-2026-53572 affects multiple packages. KEDA is a Kubernetes-based Event Driven Autoscaling component. See references for individual vulnerability details...

CLEANSTART-2026-KX96717 Security fix for GHSA-8rm2-7qqf-34qm applied in: amazon-cloudwatch-agent 1.300065.0-r1, metrics-server-fips 0.8.1-r2, node-problem-detector 1.35.2-r1, keda-fips 2.19.0-r1, trillian 1.7.3-r1, elastic-beats 8.19.14-r0

GHSA-8rm2-7qqf-34qm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IY18121 Security fix for GHSA-wg65-39gg-5wfj applied in: amazon-cloudwatch-agent 1.300065.0-r1, metrics-server-fips 0.8.1-r2, keda-fips 2.19.0-r1, trillian 1.7.3-r1, elastic-beats 8.19.14-r0

GHSA-wg65-39gg-5wfj affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MO57700 Security fix for GHSA-fw8g-cg8f-9j28 applied in: amazon-cloudwatch-agent 1.300065.0-r1, metrics-server-fips 0.8.1-r2, trillian-fips 1.7.3-r1, node-problem-detector 1.35.2-r1, keda-fips 2.19.0-r1, trillian 1.7.3-r1, elastic-beats 8.19.14-r0

GHSA-fw8g-cg8f-9j28 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OJ05849 Security fix for GHSA-259r-337f-4rfw applied in: loki 3.7.1-r2, keda 2.20.2-r0, knative-serving 1.21.3-r0, velero 1.16.2-r15, velero 1.16.2-r8, prometheus 3.5.3-r12, prometheus 3.5.3-r8, temporal-server 1.30.6-r1, temporal-server 1.30.6-r2, temporal-server 1.30.8-r1, temporal-server-fips 1.31.4-r1, mongodb 8.1.3-r2, weaviate-fips 1.36.23-r2, kubernetes-event-exporter 1.4-r0, rancher-fleet-agent 0.13.16-r1, thanos 0.40.1-r3, thanos 0.41.0-r2, prometheus 3.5.3-r9, thanos 0.39.2-r4, cadvisor 0.55.1-r3, step-issuer 0.10.2-r3

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GA30680 Security fix for GO-2026-4950 applied in: keda 2.20.2-r0, traefik 3.6.25-r1

GO-2026-4950 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SS11228 amqp091-go is a Go AMQP 0

Security vulnerability affects the keda package. amqp091-go is a Go AMQP 0...

CLEANSTART-2026-CD71740 KEDA is a Kubernetes-based Event Driven Autoscaling component

Security vulnerability affects the kedacore-http-add-on package. KEDA is a Kubernetes-based Event Driven Autoscaling component...

CLEANSTART-2026-PE79543 KEDA is a Kubernetes-based Event Driven Autoscaling component

Security vulnerability affects the kedacore-http-add-on package. KEDA is a Kubernetes-based Event Driven Autoscaling component...

ROOT-APP-GOBINARY-CVE-2026-77524 CVE-2026-77524 in github.com/kedacore/keda/v2 - Patched by Root

Root has patched CVE-2026-77524 in the github.com/kedacore/keda/v2 package for Root:Go. Multiple fixed versions available...

AZL-112013 CVE-2026-97045 affecting package keda 2.14.1-19

In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace such as or fostered under ,...

AZL-112004 CVE-2026-78661 affecting package keda 2.14.1-19

When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation n.Data += text reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags such as "a" caused...

AZL-112010 CVE-2026-116591 affecting package keda 2.14.1-19

compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768. The wrapped count allows buildDtable ...

AZL-112001 CVE-2026-116586 affecting package keda 2.14.1-19

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. Prior to 4.1.5, parsing attacker-controlled JSON through go-jose allows deeply nested...

PT-2026-134703

Security vulnerability affects the keda package. amqp091-go is a Go AMQP 0...

GO-2026-6776 vulnerabilities

Vulnerabilities for packages: k8sgpt, kserve-localmodelnode-agent-fips, kserve-localmodelnode-agent, keda-http-add-on-fips, kserve, keda-http-add-on, kserve-fips...

GO-2026-6700 vulnerabilities

Vulnerabilities for packages: bento-fips, falcosidekick, bento, keda, argo-events-fips, krakend, dapr, trufflehog, trufflehog-fips, falcosidekick-fips, krakend-fips, guac, telegraf, keda-fips, dapr-fips, argo-events...

GO-2026-6700 vulnerabilities

Vulnerabilities for packages: guac, telegraf, argo-events, trufflehog, keda, bento, falcosidekick...

GO-2026-6776 KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication in github.com/kedacore/keda...