Traefik injection vulnerability

Traefik is an open-source reverse proxy and load balancing tool developed by Traefik. Versions prior to Traefik 3.6.11 and 3.7.0-ea.2 contained a vulnerability related to injection attacks. This vulnerability stemmed from Knative-enabled programs that inserted user-controlled values into rule...

CVE-2021-0341 vulnerabilities

Vulnerabilities for packages: s3proxy-fips, s3proxy...

GHSA-3CQM-MF7H-PRRJ vulnerabilities

Vulnerabilities for packages: s3proxy-fips, s3proxy...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: rekor-fips, sqlexporter-fips, cloud-provider-aws-fips, newrelic-infrastructure-agent-fips, kubernetes-csi-external-provisioner-fips, nri-apache, distribution-fips, sonobuoy-fips, argo-rollouts-fips, mongo-tools-fips, portieris-fips,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, dgraph, spiffe-helper, rekor-fips, sqlexporter-fips, chainctl, kubernetes-csi-external-provisioner, cloud-provider-aws-fips, newrelic-infrastructure-agent-fips, kubernetes-csi-external-provisioner-fips, nri-apache, distribution-fips, sonobuoy-fip...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, dgraph, spiffe-helper, rekor-fips, sqlexporter-fips, chainctl, kubernetes-csi-external-provisioner, cloud-provider-aws-fips, newrelic-infrastructure-agent-fips, kubernetes-csi-external-provisioner-fips, nri-apache, distribution-fips, sonobuoy-fip...

EUVD-2023-3019

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: dgraph, prometheus-operator, rclone, dex, harbor-cli, aactl, cluster-api-provider-vsphere, terraform-mcp-server, linkerd2-cni-plugin, tkn, nri-apache, clickhouse-operator, rancher, plugin-barman-cloud, nri-mysql, amazon-cloudwatch-agent-operator, glow, kubecolor,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, local-path-provisioner, nemo, modelmesh-runtime-adapter, cloud-provider-aws-fips, nvidia-nsight-compute-13.1, newrelic-fluent-bit-output, gcp-compute-persistent-disk-csi-driver-fips, kube-logging-operator-custom-runner-fips, blob-csi-fips,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, local-path-provisioner, nemo, modelmesh-runtime-adapter, cloud-provider-aws-fips, nvidia-nsight-compute-13.1, newrelic-fluent-bit-output, gcp-compute-persistent-disk-csi-driver-fips, kube-logging-operator-custom-runner-fips, blob-csi-fips,...

org.apache.eventmesh:eventmesh-connector-knative (>=1.7.0-release, <=1.8.0-release), org.apache.eventmesh:eventmesh-starter (>=1.6.0-release, <=1.11.0-release) potentially affected by CVE-2024-39954 via org.apache.eventmesh:eventmesh-runtime (>=1.6.0-release, <=1.11.0-release)

org.apache.eventmesh:eventmesh-runtime MAVEN version =1.6.0-release, =1.7.0-release, =1.6.0-release, =1.11.0-release Source cves: CVE-2024-39954 Source advisory: SNYK:JAVA-ORGAPACHEEVENTMESH-12028708...

org.apache.eventmesh:eventmesh-connector-knative (>=1.7.0-release, <=1.8.0-release), org.apache.eventmesh:eventmesh-starter (>=1.6.0-release, <=1.11.0-release) potentially affected by CVE-2024-39954 via org.apache.eventmesh:eventmesh-runtime (>=1.6.0-release, <=1.11.0-release)

org.apache.eventmesh:eventmesh-runtime MAVEN version =1.6.0-release, =1.7.0-release, =1.6.0-release, =1.11.0-release Source cves: CVE-2024-39954 Source advisory: OSV:GHSA-HF86-8X8V-H7VC...

org.apache.eventmesh:eventmesh-connector-knative (>=1.7.0-release, <=1.8.0-release), org.apache.eventmesh:eventmesh-starter (>=1.6.0-release, <=1.11.0-release) potentially affected by CVE-2024-39954 via org.apache.eventmesh:eventmesh-runtime (>=1.6.0-release, <=1.11.0-release)

org.apache.eventmesh:eventmesh-runtime MAVEN version =1.6.0-release, =1.7.0-release, =1.6.0-release, =1.11.0-release Source cves: CVE-2024-39954 Source advisory: GHSA-HF86-8X8V-H7VC...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: dgraph, spiffe-helper, rekor-fips, sqlexporter-fips, chainctl, kubernetes-csi-external-provisioner, cloudnative-pg, gosu, kubernetes-csi-external-provisioner-fips, prometheus-stackdriver-exporter, sonobuoy-fips, argo-rollouts-fips, verticadb-operator-fips, kubecolor,...

GO-2023-2355 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving

Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler in knative.dev/serving...

GHSA-99JV-8292-2HPM eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations

Impact The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...

eventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operations

Impact The eventing-gitlab cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...

Denial Of Service (DoS)

github.com/knative-extensions/eventing-github/ is vulnerable to Denial Of Service DoS. The vulnerability is caused due to missing ReadHeaderTimeout‬‭ setting in the server. This could lead to a DDoS attack, where a large number of users send requests causing it to hang...

eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations

Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...

GHSA-V7HC-87JC-QRRR eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations

Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout‬‭ which could lead do a DDoS‬ ‭attack, where a large group of users send requests to the server causing the server to hang‬ ‭for long enough to deny it from being available to other users, also know as a Slowloris‬...