CVE-2022-3162 affecting package keda for versions less than 2.4.0-28

CVE-2022-3162 affecting package keda for versions less than 2.4.0-28. A patched version of the package is available...

CVE-2025-29786 vulnerabilities

Vulnerabilities for packages: argo-rollouts, keda, nats, amazon-cloudwatch-agent, argo-cd-fips, opentelemetry-collector-contrib-fips, eks-distro-fips, amazon-cloudwatch-agent-fips, argo-rollouts-fips, kargo, argo-workflows-fips, splunk-otel-collector, opentelemetry-collector-contrib,...

GHSA-93MQ-9FFX-83M2 vulnerabilities

Vulnerabilities for packages: argo-rollouts, keda, nats, amazon-cloudwatch-agent, argo-cd-fips, opentelemetry-collector-contrib-fips, eks-distro-fips, amazon-cloudwatch-agent-fips, argo-rollouts-fips, kargo, argo-workflows-fips, splunk-otel-collector, opentelemetry-collector-contrib,...

AZL-58861 CVE-2025-29786 affecting package keda for versions less than 2.14.1-5

Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if the Expr expression parser is given an unbounded input string, it will attempt to compile the entire string and generate an Abstract Syntax Tree AST node for each part of the expression. In scenarios wher...

CVE-2025-22868 affecting package keda for versions less than 2.14.1-3

CVE-2025-22868 affecting package keda for versions less than 2.14.1-3. A patched version of the package is available...

CVE-2025-27144 affecting package keda for versions less than 2.14.1-3

CVE-2025-27144 affecting package keda for versions less than 2.14.1-3. A patched version of the package is available...

AZL-58438 CVE-2025-22870 affecting package keda for versions less than 2.4.0-29

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

AZL-58455 CVE-2025-22870 affecting package keda for versions less than 2.14.1-7

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NOPROXY environment variable is set to ".example.com", a request to "::1%25.example.com:80 will incorrectly match and not be proxied...

CVE-2025-27144 affecting package keda for versions less than 2.4.0-27

CVE-2025-27144 affecting package keda for versions less than 2.4.0-27. A patched version of the package is available...

AZL-57344 CVE-2025-22868 affecting package keda for versions less than 2.14.1-3

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

AZL-57165 CVE-2025-27144 affecting package keda for versions less than 2.14.1-3

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

AZL-57138 CVE-2025-27144 affecting package keda for versions less than 2.4.0-27

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

Azure Linux 3.0 Security Update: cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter (CVE-2022-3162)

The version of cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3162 advisory. - Users authorized to list or watch one type of...

CVE-2024-28180 affecting package keda for versions less than 2.4.0-26

CVE-2024-28180 affecting package keda for versions less than 2.4.0-26. A patched version of the package is available...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cf-cli / cni / containerized-data-importer / containernetworking-plugins / gh / keda / kubevirt (CVE-2022-32149)

The version of application-gateway-kubernetes-ingress / cf-cli / cni / containerized-data-importer / containernetworking-plugins / gh / keda / kubevirt installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the...

Azure Linux 3.0 Security Update: cert-manager / influxdb / keda / libcontainers-common / packer (CVE-2024-6104)

The version of cert-manager / influxdb / keda / libcontainers-common / packer installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6104 advisory. - go-retryablehttp prior to 0.7.7 did not sanitize urls...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cf-cli / cri-o / csi-driver-lvm / golang / keda / moby-engine / node-problem-detector (CVE-2021-44716)

The version of application-gateway-kubernetes-ingress / cf-cli / cri-o / csi-driver-lvm / golang / keda / moby-engine / node-problem-detector installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-44716...

CVE-2024-45338 affecting package keda for versions less than 2.14.1-2

CVE-2024-45338 affecting package keda for versions less than 2.14.1-2. A patched version of the package is available...

CVE-2024-45338 affecting package keda for versions less than 2.4.0-25

CVE-2024-45338 affecting package keda for versions less than 2.4.0-25. A patched version of the package is available...

AZL-54562 CVE-2024-45338 affecting package keda for versions less than 2.4.0-25

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...