CLEANSTART-2026-AP95632 Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33186, CVE-2026-33811, CVE-2026-33814, CVE-2026-33815, CVE-2026-33816, CVE-2026-34986, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-39882, CVE-2026-39883, CVE-2026-40179, CVE-2026-41889, CVE-2026-42151, CVE-2026-42154, CVE-2026-42499, CVE-2026-42501, CVE-2026-44903, ghsa-78h2-9frx-2jm8, ghsa-8rm2-7qqf-34qm, ghsa-9jj7-4m8r-rfcm, ghsa-fw8g-cg8f-9j28, ghsa-hfvc-g4fc-pqhx, ghsa-j88v-2chj-qfwx, ghsa-p77j-4mvh-x3m3, ghsa-vffh-x6r8-xx99, ghsa-w8rr-5gcm-pp58, ghsa-wg65-39gg-5wfj, ghsa-xmrv-pmrh-hhx2 applied in versions: 2.18.3-r3

Multiple security vulnerabilities affect the keda-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: openfga, ory-kratos, ldap2pg, falcosidekick, hydra, temporal-server, peerdb-flow, cloudnative-pg-fips, kube-bench, cerbos, caddy, gitaly-fips, cloudprober, cloudnative-pg, temporal-server-fips, bento-fips, openfga-fips, cloudprober-fips, vault-fips, step, step-ca-fip...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider, telegraf, timescaledb-parallel-copy, grafana, cerbos, kubeflow-pipelines, kuma, certificate-transparency, falcosidekick, kube-bench, argo-workflows, juicefs, spire-server, src, ferretdb, sftpgo-plugin-eventstore, amass, envoy-gateway,...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: openfga, ory-kratos, ldap2pg, falcosidekick, hydra, temporal-server, peerdb-flow, cloudnative-pg-fips, kube-bench, cerbos, caddy, gitaly-fips, cloudprober, cloudnative-pg, temporal-server-fips, bento-fips, openfga-fips, cloudprober-fips, vault-fips, step, step-ca-fip...

AZL-85679 CVE-2026-35469 affecting package keda for versions less than 2.14.1-13

spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame parser does not validate attacker-controlled counts and lengths before allocating memory. Three allocation paths are affected: the SETTINGS frame entry count, the header count ...

CLEANSTART-2026-OW78143 Security fixes for CVE-2025-68156, CVE-2026-24051, CVE-2026-26958, CVE-2026-33186, ghsa-9h8m-3fm2-qjrq, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr, ghsa-p77j-4mvh-x3m3 applied in versions: 2.18.3-r0, 2.18.3-r1

Multiple security vulnerabilities affect the keda package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JF28061 Security fixes for CVE-2026-24051, CVE-2026-26958, CVE-2026-33186, ghsa-9h8m-3fm2-qjrq, ghsa-fw7p-63qq-7hpr, ghsa-p77j-4mvh-x3m3 applied in versions: 2.19.0-r0, 2.19.0-r1

Multiple security vulnerabilities affect the keda package. These issues are resolved in later releases. See references for individual vulnerability details...

Arbitrary File Read

github.com/kedacore/keda is vulnerable to Arbitrary File Read. The vulnerability is due to insufficient path validation when loading the Service Account Token from spec.hashiCorpVault.credential.serviceAccount, which allows an attacker with permission to create or modify a TriggerAuthentication...

CVE-2025-11065 affecting package keda for versions less than 2.14.1-11

CVE-2025-11065 affecting package keda for versions less than 2.14.1-11. A patched version of the package is available...

CVE-2026-2303 affecting package keda for versions less than 2.14.1-11

CVE-2026-2303 affecting package keda for versions less than 2.14.1-11. A patched version of the package is available...

CVE-2025-47911 affecting package keda for versions less than 2.14.1-11

CVE-2025-47911 affecting package keda for versions less than 2.14.1-11. A patched version of the package is available...

CVE-2025-58190 affecting package keda for versions less than 2.14.1-11

CVE-2025-58190 affecting package keda for versions less than 2.14.1-11. A patched version of the package is available...

CVE-2025-11065 affecting package keda for versions less than 2.4.0-32

CVE-2025-11065 affecting package keda for versions less than 2.4.0-32. A patched version of the package is available...

CVE-2025-47911 affecting package keda for versions less than 2.4.0-32

CVE-2025-47911 affecting package keda for versions less than 2.4.0-32. A patched version of the package is available...

CVE-2025-30204 affecting package keda for versions less than 2.4.0-32

CVE-2025-30204 affecting package keda for versions less than 2.4.0-32. A patched version of the package is available...

AZL-78123 CVE-2026-26958 affecting package keda 2.14.1-11

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographic primitives. In versions 1.1.0 and earlier, MultiScalarMult produces invalid results or undefined behavior if the receiver is not the identity point. If Point.MultiScalarMult i...

Important: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.18.1-2 Update

Custom Metrics Autoscaler Operator for Red Hat OpenShift updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...

AZL-77000 CVE-2025-58190 affecting package keda for versions less than 2.14.1-11

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76935 CVE-2025-47911 affecting package keda for versions less than 2.4.0-32

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-77004 CVE-2025-47911 affecting package keda for versions less than 2.14.1-11

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...