CVE-2024-56331

CVE-2024-56331 Uptime-Kuma : Inclusión de Archivos Locales LFI mediante Manejo Incorrecto de URL en el monitor Real-Browser Resumen Una Vulnerabilidad de Manejo Incorrecto de URL permite a un atacante acceder a archivos locales sensibles en el servidor explotando el protocolo file:///. Esta...

Uptime-Kuma < v1.23.0 - Improper Access Control

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

CVE-2026-52724

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-50166

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166

Kuma (an Envoy-based service mesh) is affected in kumactl , its CLI tool. When an operator configures an HTTPS control plane profile without --ca-cert-file, kumactl disables TLS peer verification and transmits API tokens over the unverified connection. An attacker positioned on the network path c...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-52724

Kuma is an Envoy-based service mesh. In Universal mode , when kuma-dp connects to an HTTPS control plane without a CA certificate (--ca-cert-file unset and KUMA_CONTROL_PLANE_CA_CERT unset), TLS peer verification is disabled . An on-path attacker can intercept the dataplane authentication token, ...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-api-provider-vsphere, rancher-agent, tetragon, kubernetes-csi-external-health-monitor, cilium, keda, kube-state-metrics, external-secrets-operator, cluster-api-gcp-controller, fluent-operator, kyverno-notation-aws, grafana, node-feature-discovery, telegraf,...

CVE-2026-10722 vulnerabilities

Vulnerabilities for packages: containerd, k3s, falcoctl, hubble, nerdctl, witness, cilium, gitaly, kubescape, kuma, runc, delve, vitess, hubble-ui, splunk-otel-collector, kubescape-operator, docker...

GHSA-XHGW-QWWF-PG32 vulnerabilities

Vulnerabilities for packages: containerd, k3s, falcoctl, hubble, nerdctl, witness, cilium, gitaly, kubescape, kuma, runc, delve, vitess, hubble-ui, splunk-otel-collector, kubescape-operator, docker...

CVE-2026-18674

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

PT-2026-76636

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

GO-2026-5102 vulnerabilities

Vulnerabilities for packages: kuma...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: flux-source-controller, harbor, envoy-gateway-fips, rancher-fleet, flux-fips, linkerd2-fips, helm-operator, consul-k8s-fips, zarf, chart-testing, eksctl, consul-k8s, flux, helm-docs, rancher-helm, flux-helm-controller-fips, cerbos-fips, cluster-api-helm-controller,...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: flux-source-controller, harbor, flux-fips, helm-operator, consul-k8s-fips, zarf, chart-testing, eksctl, consul-k8s, flux, helm-docs, rancher-helm, flux-helm-controller-fips, cluster-api-helm-controller, cert-manager-cmctl, trivy-fips, tw, zot, kubescape, pluto, trivy...

GO-2026-5435 vulnerabilities

Vulnerabilities for packages: flux-source-controller, harbor, envoy-gateway-fips, rancher-fleet, flux-fips, linkerd2-fips, helm-operator, nova, chaos-mesh-fips, consul-k8s-fips, zarf, tigera-operator, chart-testing, headlamp-fips, headlamp, eksctl, nova-fips, consul-k8s, helm, flux, zarf-fips,...

GO-2025-3601 vulnerabilities

Vulnerabilities for packages: flux-source-controller, harbor, flux-fips, helm-operator, consul-k8s-fips, zarf, chart-testing, eksctl, consul-k8s, flux, helm-docs, rancher-helm, flux-helm-controller-fips, cluster-api-helm-controller, cert-manager-cmctl, trivy-fips, tw, zot, kubescape, pluto, trivy...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: nerdctl-fips, amazon-k8s-cni-fips, calico-fips, calico, istio-fips, rootlesskit-fips, containerd-fips, datadog-agent, buildkitd, buildah, containerd, multus-cni, buildkitd-fips, datadog-agent-fips, multus-cni-fips, docker, flannel, k3s, azure-ipam, rootlesskit, podma...