GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: k8ssandra-client-fips, tw, kube-arangodb, gitness, trivy, rancher-fleet-fips, kubescape, kube-mgmt-fips, vcluster, drone-fips, kubescape-server, trivy-fips, cloudbeat-fips, rancher-agent, kyverno, maru, steampipe, ratify-fips, k9s, helm-set-status,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: k8ssandra-client-fips, tw, kube-arangodb, gitness, trivy, rancher-fleet-fips, kubescape, kube-mgmt-fips, vcluster, drone-fips, kubescape-server, trivy-fips, cloudbeat-fips, rancher-agent, kyverno, maru, steampipe, ratify-fips, k9s, helm-set-status,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: gatekeeper, rancher-agent, rancher-fleet, cert-manager-cmctl, steampipe, rancher, kyverno-notation-aws, tigera-operator, eksctl, ratify, gogatekeeper, rancher-helm, chartmuseum, kubescape-operator, argocd-image-updater, tw, helm-set-status, k8ssandra-client, trivy,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: gatekeeper, rancher-agent, rancher-fleet, cert-manager-cmctl, steampipe, rancher, kyverno-notation-aws, tigera-operator, eksctl, ratify, gogatekeeper, rancher-helm, chartmuseum, kubescape-operator, argocd-image-updater, tw, helm-set-status, k8ssandra-client, trivy,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: gatekeeper, rancher-agent, rancher-fleet, cert-manager-cmctl, steampipe, rancher, kyverno-notation-aws, tigera-operator, eksctl, ratify, gogatekeeper, rancher-helm, chartmuseum, kubescape-operator, argocd-image-updater, tw, helm-set-status, k8ssandra-client, trivy,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: gatekeeper, rancher-agent, rancher-fleet, cert-manager-cmctl, steampipe, rancher, kyverno-notation-aws, tigera-operator, eksctl, ratify, gogatekeeper, rancher-helm, chartmuseum, kubescape-operator, argocd-image-updater, tw, helm-set-status, k8ssandra-client, trivy,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: gatekeeper, rancher-agent, rancher-fleet, cert-manager-cmctl, steampipe, rancher, kyverno-notation-aws, tigera-operator, eksctl, ratify, gogatekeeper, rancher-helm, chartmuseum, kubescape-operator, argocd-image-updater, tw, helm-set-status, k8ssandra-client, trivy,...

CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: gatekeeper, rancher-agent, rancher-fleet, cert-manager-cmctl, steampipe, rancher, kyverno-notation-aws, tigera-operator, eksctl, ratify, gogatekeeper, rancher-helm, chartmuseum, kubescape-operator, argocd-image-updater, tw, helm-set-status, k8ssandra-client, trivy,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: gatekeeper, rancher-agent, rancher-fleet, cert-manager-cmctl, steampipe, rancher, kyverno-notation-aws, tigera-operator, eksctl, ratify, gogatekeeper, rancher-helm, chartmuseum, kubescape-operator, argocd-image-updater, tw, helm-set-status, k8ssandra-client, trivy,...

PT-2026-54936

Name of the Vulnerable Software and Affected Versions Eclipse Parsson versions prior to 1.1.8 Description The JSON parser does not enforce a default maximum on the number of characters consumed when parsing a single JSON document. This allows an attacker to provide specially crafted JSON document...

qs: qs: Denial of Service via improper input validation in array parsing

A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation e.g., a=value. This bypasses the arrayLimit option, which is designed to limit the size of...

CVE-2026-53426 Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parsedocument/2 accepts a :json, json source. In lib/mdex.ex, the private jsontonode/1 function passes the attacker-controlled nodetype value to Module.concat/1, which calls...

PYSEC-2026-319 Crawl4AI: AST Sandbox Escape via gi_frame.f_back Chain - Pre-Auth RCE in Docker API

Summary The safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT start with underscore, enabling a complete sandbox escape to achieve...

xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

...

GHSA-W6C6-C85G-MMV6 vulnerabilities

Vulnerabilities for packages: teleport, trivy-operator, trivy-operator-fips, kyverno-notation-aws-fips, crossplane, trivy, kubescape, cloudbeat, commercial-chainloop-cli, crossplane-fips, policy-controller-fips, ko-fips, aactl, kubescape-server, kyverno-fips, trivy-fips, cloudbeat-fips, chainctl,...

CVE-2026-39395 vulnerabilities

Vulnerabilities for packages: teleport, trivy-operator, trivy-operator-fips, kyverno-notation-aws-fips, crossplane, trivy, kubescape, cloudbeat, commercial-chainloop-cli, crossplane-fips, policy-controller-fips, ko-fips, aactl, kubescape-server, kyverno-fips, trivy-fips, cloudbeat-fips, chainctl,...

RLSA-2023:6976 Moderate: libfastjson security update

The libfastjson library provides essential JavaScript Object Notation JSON handling functions. The library enables users to construct JSON objects in C, output them as JSON-formatted strings, and convert JSON-formatted strings back to the C representation of JSON objects. Security Fixes: json-c,...

CVE-2026-54350

Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every document of the backing MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body collection and, where the builder has published a PUBLIC write...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: teleport, zarf-fips, spire-server-fips, trivy-operator, tekton-chains, trivy-operator-fips, kyverno-notation-aws-fips, zarf, crossplane, kubescape, cloudbeat, spire-server, crossplane-fips, policy-controller-fips, neuvector-sigstore-interface, ko-fips, aactl, tbot, k...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: teleport, zarf-fips, spire-server-fips, trivy-operator, tekton-chains, trivy-operator-fips, kyverno-notation-aws-fips, zarf, crossplane, kubescape, cloudbeat, spire-server, crossplane-fips, policy-controller-fips, neuvector-sigstore-interface, ko-fips, aactl, tbot, k...