198 matches found
GHSA-XVQR-69V8-F3GV vulnerabilities
Vulnerabilities for packages: dbmate, git-sync, falcosidekick, mockgen, kube-logging-operator, crossplane-provider-azure-sql, vault-benchmark, ip-masq-agent, step, extism, kubeflow-katib, kyverno-policy-reporter-ui, lvm-driver, terraform, terraform-provider-pagerduty,...
GHSA-GM9R-Q53W-2GH4 vulnerabilities
Vulnerabilities for packages: dkron, policy-controller, dbmate, git-sync, azure-workload-identity-webhook, falcosidekick, minio, influx, src, crossplane-provider-azure-sql, custom-pod-autoscaler, minio-object-browser, crossplane-provider-aws-lambda, hubble-ui, ip-masq-agent, nri-postgresql, extis...
AZL-75440 CVE-2025-11065 affecting package keda for versions less than 2.14.1-11
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...
AZL-75488 CVE-2025-11065 affecting package keda for versions less than 2.4.0-32
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...
Azure Linux 3.0 Security Update: keda (CVE-2021-32923)
The version of keda installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-32923 advisory. - HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret...
Azure Linux 3.0 Security Update: keda (CVE-2021-42836)
The version of keda installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-42836 advisory. - GJSON before 1.9.3 allows a ReDoS regular expression denial of service attack. CVE-2021-42836 Note that Nessus...
Azure Linux 3.0 Security Update: keda (CVE-2025-29923)
The version of keda installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-29923 advisory. - go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7....
Azure Linux 3.0 Security Update: cni / containernetworking-plugins / keda / multus (CVE-2021-38561)
The version of cni / containernetworking-plugins / keda / multus installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2021-38561 advisory. - golang.org/x/text/language in golang.org/x/text before 0.3.7 can...
CVE-2025-68476 affecting package keda for versions less than 2.14.1-9
CVE-2025-68476 affecting package keda for versions less than 2.14.1-9. A patched version of the package is available...
GO-2025-4257 KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential in github.com/kedacore/keda
KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential in github.com/kedacore/keda...
CVE-2025-68156 affecting package keda for versions less than 2.14.1-8
CVE-2025-68156 affecting package keda for versions less than 2.14.1-8. A patched version of the package is available...
CVE-2025-68476
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The...
AZL-72868 CVE-2025-68476 affecting package keda for versions less than 2.14.1-9
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The...
EUVD-2025-204753
KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The...
KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential
Impact An Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The vulnerability stems from an incorrect or insufficient path validation when loading the Service Account...
PT-2025-52724
Name of the Vulnerable Software and Affected Versions KEDA versions prior to 2.17.3 KEDA versions prior to 2.18.3 Description KEDA is a Kubernetes-based Event Driven Autoscaling component. A flaw exists in KEDA that could allow an attacker with permissions to create or modify a...
AZL-72736 CVE-2025-68156 affecting package keda for versions less than 2.14.1-9
Expr is an expression language and expression evaluation for Go. Prior to version 1.17.7, several builtin functions in Expr, including flatten, min, max, mean, and median, perform recursive traversal over user-provided data structures without enforcing a maximum recursion depth. If the evaluation...
Moderate: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.17.2-1 Update
Custom Metrics Autoscaler Operator for Red Hat OpenShift updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...