GHSA-W7R3-MGWF-4MQQ vulnerabilities

Vulnerabilities for packages: kubernetes-reflector...

[SECURITY] Fedora 42 Update: checkpointctl-1.4.0-3.fc42

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

[SECURITY] Fedora 43 Update: checkpointctl-1.4.0-3.fc43

The checkpointctl command can be used for in-depth analysis of container checkpoints created with Podman and Kubernetes...

CVE-2025-9708 vulnerabilities

Vulnerabilities for packages: kubernetes-reflector...

GHSA-W7R3-MGWF-4MQQ vulnerabilities

Vulnerabilities for packages: kubernetes-reflector...

Privilege Escalation

Kubernetes is vulnerable to Privilege Escalation. The vulnerability is due to improper access control because node users can patch their node object with an OwnerReference to a cluster-scoped resource, leading to unintended node deletion via garbage collection...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: bank-vaults, vault-k8s, confluent-common-docker, custom-pod-autoscaler-operator, k8sgpt-operator, pvc-autoresizer, octo-sts, blobfuse2, checksec, cloud-provider-aws, kserve-rest-proxy, ctop, git-lfs, kube-vip-cloud-provider, dagdotdev, kubeflow-katib, kuberay-operato...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: bank-vaults, vault-k8s, confluent-common-docker, custom-pod-autoscaler-operator, k8sgpt-operator, pvc-autoresizer, octo-sts, blobfuse2, checksec, cloud-provider-aws, kserve-rest-proxy, ctop, git-lfs, kube-vip-cloud-provider, dagdotdev, kubeflow-katib, kuberay-operato...

GHSA-C2F4-JGMC-Q2R5 vulnerabilities

Vulnerabilities for packages: jruby, kube-fluentd-operator...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-12.9, knative-eventing-fips, karma-fips, local-path-provisioner, docker-credential-ecr-login, prometheus-bind-exporter, octo-sts, hivemind, addon-resizer, vault-benchmark, dagdotdev, knative-serving, karpenter-fips, checksec,...

weblogic-monitoring-exporter

This is a Java-based project for exporting metrics from WebLogic Server WLS instances to Prometheus. The project is available in two forms: a web application and a separate process. The web application is deployed to the server from which metrics are to be extracted, while the separate process is...

OESA-2025-2318 kubernetes security update

Container cluster management. Security Fixes: A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference...

SUSE CVE-2025-7445

Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs...

CVE-2025-9708

A vulnerability exists in the Kubernetes C client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority CA without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially...

GO-2025-3915 Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes

Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes...

Kubernetes Trust Management Issues Vulnerabilities

Kubernetes K8s is an open source system of Kubernetes open source for automating the deployment, scaling, and management of containerized applications. Kubernetes suffers from a trust management issue vulnerability that stems from the certificate validation logic not properly validating the chain...

SUSE CVE-2025-9708

A vulnerability exists in the Kubernetes C client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority CA without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially...

GO-2025-3939 secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller

secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller...

CVE-2025-59377

feiskyer mcp-kubernetes-server through 0.1.11 allows OS command injection, even in read-only mode, via /mcp/kubectl because shell=True is used. NOTE: this is unrelated to mcp-server-kubernetes and CVE-2025-53355...

CVE-2025-59376

feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows a "kubectl version; kubectl delete pod" command because the first word i.e., "version" is not a write or delete operation...