OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: jaeger, opencost, datadog-agent, ferretdb, osv-scanner, glab...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: jaeger, opencost, datadog-agent, ferretdb, osv-scanner, glab...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: jaeger, opencost, datadog-agent, ferretdb, osv-scanner, glab...

GHSA-89XV-2J6F-QHC8 vulnerabilities

Vulnerabilities for packages: jaeger-fips, gitlab-workhorse-ce-fips, flux-operator, ferretdb, glab, opencost-fips, osv-scanner, flux-operator-fips, livekit-cli, opencost, jaeger, datadog-agent, datadog-agent-fips, gitlab-workhorse-ce...

GHSA-Q382-VC8Q-7JHJ vulnerabilities

Vulnerabilities for packages: jaeger-fips, gitlab-workhorse-ce-fips, flux-operator, ferretdb, glab, opencost-fips, osv-scanner, flux-operator-fips, livekit-cli, opencost, jaeger, datadog-agent, datadog-agent-fips, gitlab-workhorse-ce...

CVE-2026-33252 vulnerabilities

Vulnerabilities for packages: jaeger-fips, gitlab-workhorse-ce-fips, flux-operator, ferretdb, glab, opencost-fips, osv-scanner, flux-operator-fips, livekit-cli, opencost, jaeger, datadog-agent, datadog-agent-fips, gitlab-workhorse-ce...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: vault-benchmark, knative-operator, azurefile-csi, terraform-provider-google, telegraf, secrets-store-csi-driver-provider-aws, terraform-provider-pagerduty, authservice, trino, blob-csi, kube-rbac-proxy, kaf, flux-notification-controller, gitlab-pages, boring-registry...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: vault-benchmark, knative-operator, azurefile-csi, terraform-provider-google, telegraf, secrets-store-csi-driver-provider-aws, terraform-provider-pagerduty, authservice, trino, blob-csi, kube-rbac-proxy, kaf, flux-notification-controller, gitlab-pages, boring-registry...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: conjur-cli, azurefile-csi, authservice, trino, oras, dynamic-localpv-provisioner, ytt, litefs, php-fpmexporter, victoriametrics-cluster, rabbitmq-default-user-credential-updater, victoriametrics-operator, rook, k8ssandra-operator, cluster-api-azure-controller,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: conjur-cli, azurefile-csi, authservice, trino, oras, dynamic-localpv-provisioner, ytt, litefs, php-fpmexporter, victoriametrics-cluster, rabbitmq-default-user-credential-updater, victoriametrics-operator, rook, k8ssandra-operator, cluster-api-azure-controller,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: conjur-cli, azurefile-csi, authservice, trino, oras, dynamic-localpv-provisioner, ytt, litefs, php-fpmexporter, victoriametrics-cluster, rabbitmq-default-user-credential-updater, victoriametrics-operator, rook, k8ssandra-operator, cluster-api-azure-controller,...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: conjur-cli, azurefile-csi, authservice, trino, oras, dynamic-localpv-provisioner, ytt, litefs, php-fpmexporter, victoriametrics-cluster, rabbitmq-default-user-credential-updater, victoriametrics-operator, rook, k8ssandra-operator, cluster-api-azure-controller,...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: jaeger-fips, gitlab-workhorse-ce-fips, flux-operator, ferretdb, osv-scanner, opencost-fips, flux-operator-fips, opencost, jaeger, datadog-agent, gptscript, github-mcp-server, datadog-agent-fips, gitlab-workhorse-ce...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: jaeger-fips, gitlab-workhorse-ce-fips, flux-operator, ferretdb, osv-scanner, opencost-fips, flux-operator-fips, opencost, jaeger, datadog-agent, gptscript, github-mcp-server, datadog-agent-fips, gitlab-workhorse-ce...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: mailpit, authservice, trino, oras, dynamic-localpv-provisioner, ytt, litefs, rabbitmq-default-user-credential-updater, kwok, malcontent, jaeger-operator, k6, mage, protoc-gen-go-grpc, wave, cert-manager-cmctl, jitsucom-jitsu, grafana-mimir, task, oauth2-proxy,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: mailpit, authservice, trino, oras, dynamic-localpv-provisioner, ytt, litefs, rabbitmq-default-user-credential-updater, kwok, malcontent, jaeger-operator, k6, mage, protoc-gen-go-grpc, wave, cert-manager-cmctl, jitsucom-jitsu, grafana-mimir, task, oauth2-proxy,...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy-init, yace-fips, hivemind, nri-couchbase, aws-flb-cloudwatch-fips, dex, velero, tkn-fips, aws-signer-notation-plugin-fips, conftest, gke-gcloud-auth-plugin, kaniko-fips, neuvector-dbgen, prometheus-adapter, crossplane, flux-image-reflector-controller,...