CVE-2026-39819 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, nginx-prometheus-exporter-fips, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, dive, argocd-image-updater-fips, gotrue,...

GHSA-497X-JCXF-M478 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, gotrue, argocd-image-updater-fips, rabbitmq-messaging-topology-operator-fips,...

CVE-2026-39817 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, nginx-prometheus-exporter-fips, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, dive, argocd-image-updater-fips, gotrue,...

GHSA-QF3Q-3H68-MMH2 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, nginx-prometheus-exporter-fips, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, dive, argocd-image-updater-fips, gotrue,...

GHSA-5M4P-2GJX-P2G8 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, nginx-prometheus-exporter-fips, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, dive, argocd-image-updater-fips, gotrue,...

CVE-2026-39836 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, nginx-prometheus-exporter-fips, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, dive, argocd-image-updater-fips, gotrue,...

GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, nginx-prometheus-exporter-fips, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, dive, argocd-image-updater-fips, gotrue,...

CVE-2026-42501 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, nginx-prometheus-exporter-fips, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, dive, argocd-image-updater-fips, gotrue,...

CVE-2026-33811 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, nvidia-nsight-compute-13.2, gitlab-pages, terraform-docs-fips, crossplane-provider-aws-firehose-fips, crossplane-provider-azure-signalrservice, gotrue, argocd-image-updater-fips, rabbitmq-messaging-topology-operator-fips,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, crossplane-provider-aws-appflow, mods, seaweedfs-rocksdb, terragrunt-fips, crossplane-provider-azure-alertsmanagement, ld-relay-fips, velero, neuvector-dbgen-fips, azure-ipam, vault-k8s-fips, go, lvm-driver-fips, helm-fips, perses-fips,...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017342)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017342 advisory. A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 4.0.0 to 4.0.5 of Argo Workflows had a security vulnerability. This vulnerability stemmed from the ConfigMap-backed provider in the Sync Service not performing authorization checks...

Argo Workflows 安全漏洞

Argo Workflows is an open-source container-native workflow engine for Kubernetes, part of the Argo project. Versions 4.0.0 to 4.0.5 of Argo Workflows had a security vulnerability. This vulnerability stemmed from the fact that the workflow executor recorded all workpiece repository credentials in...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017390)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017390 advisory. The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0...

Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-016823)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016823 advisory. A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching...

Quasar Linux RAT Steals Developer Credentials for Software Supply Chain Compromise

A previously undocumented Linux implant codenamed Quasar Linux RAT QLNX is targeting developers' systems to establish a silent foothold as well as facilitate a broad range of post-compromise functionality, such as credential harvesting, keylogging, file manipulation, clipboard monitoring, and...

Dirty-Frag-Kubernetes-PoC

Dirty Frag CVE-2026-43284 — Kubernetes Container Escape PoC...

📄 Apache Airflow Databricks Provider Certificate Verification Bypass

The Apache Airflow Databricks Provider package disables TLS certificate verification when communicating with the Kubernetes API server during federated token exchange. Both the synchronous and asynchronous code paths use verify=False / ssl=False, allowing any attacker with network access within t...

CVE-2026-42880

CVE-2026-42880 (Argo CD) : A missing authorization/data-masking gap in Argo CD’s ServerSideDiff endpoint allows an attacker with read-only access to extract plaintext Secret data from etcd via the Kubernetes API server’s Server-Side Apply dry-run. Affected versions are 3.2.0–3.2.10 and 3.3.0–3.3....

CVE-2026-42880 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an attacker with read-only access to extract plaintext...