GHSA-WG65-39GG-5WFJ vulnerabilities

Vulnerabilities for packages: prometheus-pushgateway, trillian, minio, datadog-agent, metrics-server, k8sgpt, cloud-sql-proxy, fluent-bit-plugin-loki, prometheus-operator, istio, tempo, loki, aws-otel-collector, amazon-cloudwatch-agent-operator, certificate-transparency, jaeger,...

CVE-2026-42151 vulnerabilities

Vulnerabilities for packages: grafana-fips, ld-relay, tempo-fips, cloud-sql-proxy-fips, k8sgpt, cloud-sql-proxy, karma-fips, keda, nrdot-collector-k8s, prometheus, trillian-fips, commercial-grafana, cloudzero-agent, beats-fips, datadog-agent, agentbeat, istio, telegraf, trillian,...

GHSA-WG65-39GG-5WFJ vulnerabilities

Vulnerabilities for packages: grafana-fips, ld-relay, tempo-fips, cloud-sql-proxy-fips, k8sgpt, cloud-sql-proxy, karma-fips, keda, nrdot-collector-k8s, prometheus, trillian-fips, commercial-grafana, cloudzero-agent, beats-fips, datadog-agent, agentbeat, istio, telegraf, trillian,...

Malicious code in noteparse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 270d4c797fe34bc0b9598608f45add8721f1fa80d1488e4fae750e3a7b38419e noteparse 1.1.27 ships live MinIO credentials in configReader.py endpoint uicfile.uniview.com, accesskey 'uicpro', secretkey 'uicpropass123' that are...

MAL-2026-4813 Malicious code in noteparse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 270d4c797fe34bc0b9598608f45add8721f1fa80d1488e4fae750e3a7b38419e noteparse 1.1.27 ships live MinIO credentials in configReader.py endpoint uicfile.uniview.com, accesskey 'uicpro', secretkey 'uicpropass123' that are...

CVE-2026-42154 vulnerabilities

Vulnerabilities for packages: grafana, prometheus-pushgateway, trillian, minio, datadog-agent, metrics-server, k8sgpt, cloud-sql-proxy, fluent-bit-plugin-loki, prometheus-operator, splunk-otel-collector, istio, tempo, loki, aws-otel-collector, amazon-cloudwatch-agent-operator,...

GHSA-8RM2-7QQF-34QM vulnerabilities

Vulnerabilities for packages: grafana, prometheus-pushgateway, trillian, minio, datadog-agent, metrics-server, k8sgpt, cloud-sql-proxy, fluent-bit-plugin-loki, prometheus-operator, splunk-otel-collector, istio, tempo, loki, aws-otel-collector, amazon-cloudwatch-agent-operator,...

GHSA-XH8F-G2QW-GCM7 vulnerabilities

Vulnerabilities for packages: minio...

CVE-2026-42600 vulnerabilities

Vulnerabilities for packages: minio...

CVE-2026-42154 vulnerabilities

Vulnerabilities for packages: grafana-fips, ld-relay, tempo-fips, cloud-sql-proxy-fips, k8sgpt, cloud-sql-proxy, karma-fips, keda, nrdot-collector-k8s, prometheus, trillian-fips, commercial-grafana, cloudzero-agent, beats-fips, datadog-agent, agentbeat, istio, telegraf, splunk-otel-collector,...

GHSA-8RM2-7QQF-34QM vulnerabilities

Vulnerabilities for packages: grafana-fips, ld-relay, tempo-fips, cloud-sql-proxy-fips, k8sgpt, cloud-sql-proxy, karma-fips, keda, nrdot-collector-k8s, prometheus, trillian-fips, commercial-grafana, cloudzero-agent, beats-fips, datadog-agent, agentbeat, istio, telegraf, splunk-otel-collector,...

CVE-2026-42600 vulnerabilities

Vulnerabilities for packages: minio, minio-fips...

GHSA-XH8F-G2QW-GCM7 vulnerabilities

Vulnerabilities for packages: minio, minio-fips...

CLEANSTART-2026-SE34232 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-40179, CVE-2026-42499, CVE-2026-42501, ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x, ghsa-p436-gjf2-799p applied in versions: 7.1.1-r10, 7.1.1-r7, 7.1.1-r8, 7.1.1-r9

Multiple security vulnerabilities affect the minio-operator-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

Authentication Bypass

MinIO is vulnerable to Authentication Bypass. The vulnerability is due to missing signature verification for authTypeStreamingUnsignedTrailer requests in the Snowball auto-extract handler, which allows an attacker with knowledge of a valid access key to upload arbitrary objects without providing ...

Missing Authorization

github.com/minio/minio is vulnerable to IMissing Authorization. The vulnerability is due to insufficient validation of user-supplied X-Minio-Replication- headers in the extractMetadataFromMime function, which allows an authenticated attacker with s3:PutObject permissions to inject internal...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: prometheus-pushgateway, trillian, minio, datadog-agent, metrics-server, k8sgpt, cloud-sql-proxy, fluent-bit-plugin-loki, telegraf, opentelemetry-collector-contrib, splunk-otel-collector, opentelemetry-operator, istio, tempo, minio-object-browser, loki,...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: ld-relay, tempo-fips, mcp-grafana, opentelemetry-collector-contrib-fips, cloud-sql-proxy-fips, k8sgpt, cloud-sql-proxy, karma-fips, keda, nrdot-collector-k8s, prometheus, minio-object-browser-fips, trillian-fips, cloudzero-agent, beats-fips, datadog-agent, agentbeat,...

BIT-MINIO-2026-42600 MinIO: Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

MinIO is a high-performance object storage system. From 2022.07.24 to before 2026.04.14, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configured drive roots, bounded only by the...

CVE-2026-31216

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API. The DELETE /storage/objectname:path endpoint lacks authentication, authorization, and input validation mechanisms. Unauthenticated remote attackers can send craft...