29 matches found
EUVD-2026-46433
Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...
CVE-2026-63140
CVE-2026-63140 describes a Reachable Assertion (CWE-617) in Elasticsearch that can cause denial of service. A specially crafted search containing a null value in a specific query clause triggers an internal assertion during query parsing, which Elasticsearch treats as a fatal error and terminates...
CVE-2026-63140 Reachable Assertion in Elasticsearch Leading to Denial of Service
Reachable Assertion CWE-617 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats...
PT-2026-62116
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An issue exists where a specially crafted search request containing a null value in a specific query clause triggers an internal assertion during query parsing. Since assertion failures...
CVE-2026-59892
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: crossplane-function-patch-and-transform-fips, dive, crossplane-provider-aws-wafv2, openbao-fips, thanos-receive-controller-fips, cortex, terraform-provider-databricks, kargo, fleet-server-fips, argo-events-fips, net-kourier, kong-ingress-controller, cloudflared,...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: crossplane-function-patch-and-transform-fips, dive, crossplane-provider-aws-wafv2, openbao-fips, thanos-receive-controller-fips, cortex, terraform-provider-databricks, kargo, fleet-server-fips, argo-events-fips, net-kourier, kong-ingress-controller, cloudflared,...
CVE-2026-33814 vulnerabilities
Vulnerabilities for packages: chartmuseum, kube-logging-operator, fuse-overlayfs-snapshotter, karpenter, kuberlr, azurefile-csi, cilium, local-static-provisioner, kargo, redka, crossplane-provider-keycloak, kpt, kube-metrics-adapter, crossplane-provider-aws-cloudformation, azure-service-operator,...
CVE-2026-33814 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-ssm, chainloop-control-plane-fips, terraform-provider-databricks, packer-fips, weaviate, envconsul-fips, cluster-autoscaler, crossplane-provider-aws-emr-fips, kubescape-http-request-fips, k6, aws-application-networking-k8s,...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: argo-cd, envoy-gateway, trivy, vcluster, dynamic-localpv-provisioner, kwok, redis-operator, rancher-fleet, cilium, kiali, kargo, falcoctl, argocd-image-updater, jitsucom-bulker, cert-manager-istio-csr, kpt, argo-workflows, consul-k8s, k3s, sonobuoy,...
CVE-2026-35469 vulnerabilities
Vulnerabilities for packages: argo-cd, envoy-gateway, trivy, vcluster, dynamic-localpv-provisioner, kwok, redis-operator, rancher-fleet, cilium, kiali, kargo, falcoctl, argocd-image-updater, jitsucom-bulker, cert-manager-istio-csr, kpt, argo-workflows, consul-k8s, k3s, sonobuoy,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: chartmuseum, sftpgo-plugin-auth, fuse-overlayfs-snapshotter, karpenter, kuberlr, cilium, aws-sigv4-proxy, kargo, local-static-provisioner, redka, crossplane-provider-keycloak, seaweedfs, kpt, azure-service-operator, libnvidia-container, kubernetes-event-exporter,...
CVE-2026-39883 vulnerabilities
Vulnerabilities for packages: chartmuseum, argo-cd, kube-logging-operator, cloud-provider-vsphere, crossplane-provider-azure-managedidentity, cluster-api-helm-controller, azurefile-csi, cilium, kube-state-metrics, node-problem-detector, aws-otel-collector, crossplane-provider-aws-rds,...
GHSA-HFVC-G4FC-PQHX vulnerabilities
Vulnerabilities for packages: chartmuseum, argo-cd, kube-logging-operator, cloud-provider-vsphere, crossplane-provider-azure-managedidentity, cluster-api-helm-controller, azurefile-csi, cilium, kube-state-metrics, node-problem-detector, aws-otel-collector, crossplane-provider-aws-rds,...
CVE-2026-39883 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-ssm, crossplane-function-patch-and-transform-fips, dive, podinfo-fips, crossplane-provider-aws-wafv2, openbao-fips, thanos-receive-controller-fips, cortex, chainloop-control-plane-fips, terraform-provider-databricks, fleet-server-fips,...
GHSA-WCW9-47FP-RRFR vulnerabilities
Vulnerabilities for packages: chartmuseum, wire-go, helm-set-status, aws-s3-controller, cloud-provider-vsphere, cluster-api-helm-controller, chisel, kuberlr, vendir, kube-state-metrics, aws-sigv4-proxy, cert-exporter, stern, redka, fulcio, go-bindata, kafka-proxy, kpt, spiffe-helper,...
GHSA-FRHW-MQJ2-WXW2 vulnerabilities
Vulnerabilities for packages: chartmuseum, wire-go, kube-logging-operator, cluster-api-helm-controller, kuberlr, aws-sigv4-proxy, redka, kpt, kube-metrics-adapter, src-fingerprint, kubernetes-event-exporter, extism, velero, manifest-tool, yace, rancher-telemetry, kubevela, mesosphere-vsphere-csi,...
GHSA-9GCR-GP5F-JW27 vulnerabilities
Vulnerabilities for packages: chartmuseum, wire-go, helm-set-status, aws-s3-controller, cloud-provider-vsphere, cluster-api-helm-controller, chisel, kuberlr, vendir, kube-state-metrics, aws-sigv4-proxy, cert-exporter, stern, redka, fulcio, go-bindata, kafka-proxy, kpt, spiffe-helper,...
CVE-2025-58185 vulnerabilities
Vulnerabilities for packages: chartmuseum, wire-go, helm-set-status, aws-s3-controller, cloud-provider-vsphere, cluster-api-helm-controller, chisel, kuberlr, vendir, kube-state-metrics, aws-sigv4-proxy, cert-exporter, stern, redka, fulcio, go-bindata, kafka-proxy, kpt, spiffe-helper,...
CVE-2025-47912 vulnerabilities
Vulnerabilities for packages: chartmuseum, wire-go, helm-set-status, aws-s3-controller, cloud-provider-vsphere, cluster-api-helm-controller, chisel, kuberlr, vendir, kube-state-metrics, aws-sigv4-proxy, cert-exporter, stern, redka, fulcio, go-bindata, kafka-proxy, kpt, spiffe-helper,...