10619 matches found
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the EnvoyExtensionPolicy resource. An attacker can execute arbitrary commands and access sensitive credentials by injecting malicious Lua scripts. This can lead to privilege escalation, theft of secrets, and...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the EnvoyExtensionPolicy resource. An attacker can execute arbitrary commands and access sensitive credentials by injecting malicious Lua scripts. This can lead to privilege escalation, theft of secrets, and...
Important: Red Hat Security Advisory: VolSync v0.14 security fixes and container updates
VolSync v0.14 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...
CVE-2025-52881 affecting package kubernetes for versions less than 1.30.10-18
CVE-2025-52881 affecting package kubernetes for versions less than 1.30.10-18. A patched version of the package is available...
CVE-2025-13281 affecting package kubernetes for versions less than 1.30.10-18
CVE-2025-13281 affecting package kubernetes for versions less than 1.30.10-18. A patched version of the package is available...
CVE-2025-65637 affecting package kubernetes for versions less than 1.30.10-18
CVE-2025-65637 affecting package kubernetes for versions less than 1.30.10-18. A patched version of the package is available...
CVE-2022-31677
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor before v0.19.0. A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow...
CVE-2022-26311
Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes environments...
CVE-2025-23047
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who...
CVE-2021-41254
kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could...
CVE-2021-41137
Minio is a Kubernetes native application for cloud storage. All users on release RELEASE.2021-10-10T16-53-30Z are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid should return owner true for rootCreds. In the affected version, poli...
CVE-2022-23509
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a local S3 bucket which it uses for synchronizing files that are later applied against a Kubernetes cluster. The communication between GitOps...
CVE-2022-35930
PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are ...
CVE-2024-39690
Capsule is a multi-tenancy and policy-based framework for Kubernetes. In Capsule v0.7.0 and earlier, the tenant-owner can patch any arbitrary namespace that has not been taken over by a tenant i.e., namespaces without the ownerReference field, thereby gaining control of that namespace. Version...
The vulnerability of the child_process function in the MCP-server for managing clusters of virtual machines in Kubernetes allows a attacker to execute arbitrary commands.
The vulnerability of the childprocess function in the MCP-server for managing clusters of virtual machines in Kubernetes is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2025-69224 vulnerabilities
Vulnerabilities for packages: py3-cassandra-medusa, checkov, airflow, kserve, dask-kubernetes, open-webui, kubeflow-pipelines-visualization-server...
CVE-2025-69225 vulnerabilities
Vulnerabilities for packages: py3-cassandra-medusa, checkov, airflow, kserve, dask-kubernetes, open-webui, kubeflow-pipelines-visualization-server...
CVE-2025-69228 vulnerabilities
Vulnerabilities for packages: py3-cassandra-medusa, checkov, airflow, kserve, dask-kubernetes, open-webui, kubeflow-pipelines-visualization-server...