SUSE-SU-2025:4380-1 Security update for kubernetes-client

This update for kubernetes client rebuilds it against current the go release to fix bugs and security issues in the go stdlib...

React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation

The U.S. Cybersecurity and Infrastructure Security Agency CISA has urged federal agencies to patch the recent React2Shell vulnerability by December 12, 2025, amid reports of widespread exploitation. The critical vulnerability, tracked as CVE-2025-55182 CVSS score: 10.0, affects the React Server...

Improper Permission Assignment

Strimzi is vulnerable to Improper Permission Assignment. The vulnerability is due to Strimzi creating an incorrect Kubernetes Role that grants Kafka Connect and MirrorMaker 2 operands GET access to all Secrets in the namespace, allowing these components to read sensitive data they should not have...

GHSA-JV3W-X3R3-G6RM vulnerabilities

Vulnerabilities for packages: kuma, multus-cni, istio, multus-cni-fips, buildah, datadog-agent-fips, flannel-fips, calico, calico-fips, containerd, istio-fips, k3s, rootlesskit, rootlesskit-fips, containerd-fips, docker-fips, podman, buildkitd, nerdctl, amazon-k8s-cni-fips, rke2-runtime,...

Webinar: How Attackers Exploit Cloud Misconfigurations Across AWS, AI Models, and Kubernetes

Cloud security is changing. Attackers are no longer just breaking down the door; they are finding unlocked windows in your configurations, your identities, and your code. Standard security tools often miss these threats because they look like normal activity. To stop them, you need to see exactly...

Exploit for CVE-2025-1974

CVE-2025-1974-PoC-exploit Kubernetes Ingress-nginx RCE Ingres...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to inverted logic in the InsecureSkipVerify field when processing the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. An attacker can intercept and read sensitive data by performing...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.8.1 release.

Red Hat Developer Hub 1.8.1 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

traefik -- Inverted TLS Verification Logic in Kubernetes NGINX Provider

The traefik project reports: There is a potential vulnerability in Traefik NGINX provider managing the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. The provider inverts the semantics of the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" intendi...

GHSA-4F99-4Q7P-P3GH vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter-fips, kubeflow, wavefront-collector-for-kubernetes, terraform-provider-google, kubeflow-fips, aws-flb-cloudwatch, newrelic-nri-statsd, consul-fips, docker-credential-gcr, aws-flb-kinesis, aws-flb-cloudwatch-fips, sonobuoy, php-fpmexporter,...

CVE-2025-65637 vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter-fips, kubeflow, wavefront-collector-for-kubernetes, terraform-provider-google, kubeflow-fips, aws-flb-cloudwatch, newrelic-nri-statsd, consul-fips, docker-credential-gcr, aws-flb-kinesis, aws-flb-cloudwatch-fips, sonobuoy, php-fpmexporter,...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.2, frp, nemo, opentelemetry-collector, terraform-ls, k8ssandra-client-fips, opa, rancher-helm, cloud-provider-azure-fips, contour-fips, cert-manager-fips, sftpgo-plugin-eventsearch, karma-fips, paranoia, pgtimetable-fips,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.2, frp, nemo, opentelemetry-collector, terraform-ls, k8ssandra-client-fips, opa, rancher-helm, cloud-provider-azure-fips, contour-fips, cert-manager-fips, sftpgo-plugin-eventsearch, karma-fips, paranoia, pgtimetable-fips,...

CVE-2025-66623

A flaw was found in Strimzi. This vulnerability allows unauthorized GET access to all Kubernetes K8s Secrets that exist in the given Kubernetes K8s namespace via incorrect Kubernetes K8s Role creation. Mitigation Mitigation for this issue is either not available or the currently available options...

EUVD-2025-201497

Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands...

CVE-2025-66623

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands th...

CVE-2025-66623 Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior to 0.49.1, in some situations, Strimzi creates an incorrect Kubernetes Role which grants the Apache Kafka Connect and Apache Kafka MirrorMaker 2 operands th...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.2, azure-container-networking, secrets-store-csi-driver-provider-gcp, frp, nemo, opentelemetry-collector, terraform-ls, k8ssandra-client-fips, secrets-store-csi-driver-fips, cert-manager-istio-csr-fips, opa, rancher-helm,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.2, azure-container-networking, secrets-store-csi-driver-provider-gcp, frp, nemo, opentelemetry-collector, terraform-ls, k8ssandra-client-fips, secrets-store-csi-driver-fips, cert-manager-istio-csr-fips, opa, rancher-helm,...

PT-2025-49308

Name of the Vulnerable Software and Affected Versions Strimzi versions 0.47.0 through 0.49.0 Description Strimzi allows running an Apache Kafka cluster on Kubernetes or OpenShift. Versions from 0.47.0 up to 0.49.0 incorrectly create a Kubernetes Role. This role grants Apache Kafka Connect and...