GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: aws-signer-notation-plugin-fips, amazon-ecs-agent, kubevirt-cdi-uploadserver-fips, age, yunikorn-web, k8s-device-plugin-fips, aws-fsx-csi-driver-fips, ytt-fips, external-dns, jitsucom-bulker, langfuse, thanos-receive-controller, aws-load-balancer-controller, opa-envo...

CVE-2026-34940 KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript function in internal/modelcontroller/engineollama.go constructs a shell command string using fmt.Sprintf with unsanitized model URL components ref, modelParam. This shell command is executed via bash ...

CLEANSTART-2026-CK42797 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-1229, CVE-2026-25679, CVE-2026-25934, CVE-2026-27139, CVE-2026-27142, ghsa-37cx-329c-33x3 applied in versions: 0.18.0-r1, 1.16.0-r0

Multiple security vulnerabilities affect the pulumi-kubernetes-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JK84667 Security fixes for CVE-2025-0913, CVE-2025-4673, CVE-2025-47907, CVE-2025-47911, CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-58190, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 2.7.0-r7, 2.7.0-r8

Multiple security vulnerabilities affect the opensearch-k8s-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2025-12805

CVE-2025-12805 describes a flaw in Red Hat OpenShift AI (RHOAI) llama-stack-operator where Llama Stack services deployed in different namespaces can be accessed via direct network requests because no NetworkPolicy restricts the llama-stack service endpoint. This allows a user in one namespace to ...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: datadog-agent, hydra, gitlab-runner, pulumi-language-java, atlantis, pulumi-language-yaml, gitness, goreleaser, flux-notification-controller, argo-events, xeol, k9s, flux-kustomize-controller, helm, q, witness, apko, boring-registry, opentofu, cert-manager-cmctl,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: datadog-agent, hydra, gitlab-runner, pulumi-language-java, atlantis, pulumi-language-yaml, gitness, goreleaser, flux-notification-controller, argo-events, xeol, k9s, flux-kustomize-controller, helm, q, witness, apko, boring-registry, opentofu, cert-manager-cmctl,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: commercial-grafana, guac, openbao-fips, kyverno-notation-aws, flux-helm-controller-fips, grafana-alloy, crossplane-provider-azure-sql, openbao, crossplane-provider-aws-firehose-fips, crossplane-provider-aws-sqs-fips, rclone, crossplane-provider-aws-dynamodb,...

CLEANSTART-2026-IL55587 Cancelling a query (e

Multiple security vulnerabilities affect the opensearch-k8s-operator-fips package. Cancelling a query e. See references for individual vulnerability details...

Important: Red Hat Security Advisory: VolSync v0.14 security fixes and container updates

VolSync v0.14 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2021-41254

kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could...

Moderate: Red Hat Security Advisory: Submariner v0.22 security fixes and container updates

Submariner v0.22 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

vmalert-operator

VMAlert Operator ⚠️ Proof of Concept Bridge Grafana Aler...

EUVD-2021-2283

Malware in sbrugna...

EUVD-2020-28853

Malware in sbrugna...

EUVD-2024-2861

Malicious code in bioql PyPI...

EUVD-2024-1788

Malicious code in bioql PyPI...

EUVD-2023-12491

Malicious code in bioql PyPI...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: git-lfs, vexctl, terraform-provider-time, k8sgpt-operator, newrelic-fluent-bit-output, ctop, sftpgo-plugin-pubsub, container-object-storage-interface, lvm-driver, rancher-machine, mongodb-kubernetes-operator, kube-vip-cloud-provider, gostatsd, vault-benchmark,...