182 matches found
CVE-2026-53572
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
AZL-96989 CVE-2026-53572 affecting package keda 2.14.1-16
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...
CVE-2026-53572
KEDA (Kubernetes-based Event Driven Autoscaling) is affected by a PostgreSQL connection string parameter injection in pkg/scalers/postgresql_scaler.go prior to version 2.20.0 . The root cause is that escapePostgreConnectionParameter() only quotes values containing a literal space, leaving tabs, n...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: cilium, spqr, helm-operator, cluster-autoscaler, flux-helm-controller, datadog-operator, kube-vip-cloud-provider, kubernetes-csi-external-snapshotter, flux-kustomize-controller, cass-operator, cert-manager-istio-csr, openbao, kots, keda, rancher-agent,...
CVE-2026-73500 affecting package keda for versions less than 2.14.1-17
CVE-2026-73500 affecting package keda for versions less than 2.14.1-17. A patched version of the package is available...
GO-2026-5940 vulnerabilities
Vulnerabilities for packages: keda-http-add-on, keda-http-add-on-fips...
GO-2026-5662 vulnerabilities
Vulnerabilities for packages: trillian, telegraf, splunk-otel-collector, mcp-grafana, aws-otel-collector, grafana-pyroscope, minio-operator, jaeger, minio, certificate-transparency, keda, istio, cloud-sql-proxy, prometheus-pushgateway, loki, mc, datadog-agent, minio-object-browser, karma, tempo...
GO-2026-5264 vulnerabilities
Vulnerabilities for packages: trillian, splunk-otel-collector, aws-otel-collector, node-problem-detector, minio-operator, prometheus, jaeger, grafana, k8sgpt, minio, certificate-transparency, keda, istio, cloud-sql-proxy, prometheus-operator, prometheus-pushgateway, loki,...
CLEANSTART-2026-AT48963 Security fixes in keda-fips 2.19.0-r2
Package keda-fips version 2.19.0-r2 fixes 8 vulnerabilities: CVE-2026-42151, CVE-2026-42154, CVE-2026-40179, CVE-2026-44903, ghsa-8rm2-7qqf-34qm...
CLEANSTART-2026-HA77289 Security fixes in keda-fips 2.19.0-r1
Package keda-fips version 2.19.0-r1 fixes 8 vulnerabilities: CVE-2026-42151, CVE-2026-42154, CVE-2026-40179, CVE-2026-44903, ghsa-8rm2-7qqf-34qm...
AZL-95931 CVE-2026-73500 affecting package keda 2.14.1-16
etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...
CLEANSTART-2026-RF73854 Security fixes in keda 2.18.3-r0
Package keda version 2.18.3-r0 fixes 6 vulnerabilities: CVE-2026-26958, CVE-2025-68156, CVE-2026-24051, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr...
CLEANSTART-2026-TO27266 Security fixes in keda 2.18.3-r1
Package keda version 2.18.3-r1 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...
CLEANSTART-2026-XA68717 Security fixes in keda 2.19.0-r2
Package keda version 2.19.0-r2 fixes 1 vulnerabilities: CVE-2026-34986...
CVE-2026-56852 affecting package keda for versions less than 2.14.1-16
CVE-2026-56852 affecting package keda for versions less than 2.14.1-16. A patched version of the package is available...
AZL-93216 CVE-2026-56852 affecting package keda for versions less than 2.14.1-16
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
GO-2026-5940 KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping in github.com/kedacore/keda
KEDA has PostgreSQL connection string parameter injection via incomplete whitespace escaping in github.com/kedacore/keda...