CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...

CVE-2026-40089

Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery SSRF vulnerability in its API client apps/dashboard/lib/api.ts. Installations created using the provided install.sh script includi...

GHSA-VFFH-X6R8-XX99 vulnerabilities

Vulnerabilities for packages: agentbeat-fips, minio-operator, nrdot-collector-fips, prometheus-pushgateway, elastic-agent-fips, beats-fips, tempo, datadog-agent-fips, grafana, istio-fips, plutono, jaeger, prometheus-fips, splunk-otel-collector-fips, node-problem-detector,...

CVE-2026-40179 vulnerabilities

Vulnerabilities for packages: agentbeat-fips, minio-operator, nrdot-collector-fips, prometheus-pushgateway, elastic-agent-fips, beats-fips, tempo, datadog-agent-fips, grafana, istio-fips, plutono, jaeger, prometheus-fips, splunk-otel-collector-fips, node-problem-detector,...

CVE-2026-22683

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...

External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

Summary The v2 template engine in runtime/template/v2/template.go imports Sprig’s TxtFuncMap and removes env and expandenv, but leaves getHostByName available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated...

GHSA-R2PG-R6H7-CRF3 External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine

Summary The v2 template engine in runtime/template/v2/template.go imports Sprig’s TxtFuncMap and removes env and expandenv, but leaves getHostByName available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service (CVE-2026-34043)

Summary Node.js module serialize-javascript is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in...

PT-2026-32571

Name of the Vulnerable Software and Affected Versions External Secrets Operator versions prior to 2.3.0 Description The v2 template engine in runtime/template/v2/template.go removes env and expandenv from TxtFuncMap but leaves the getHostByName function accessible to user-controlled templates...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: kots, eksctl, nova, pluto, headlamp, chart-testing, cilium-cli, chartmuseum, kubescape, helm-mapkubeapis, rancher-fleet, helm-docs, linkerd2, cerbos, trivy, helm-push, zot, tw, kube-arangodb, helm-set-status, consul-k8s, trivy-operator, istio, zarf, k9s,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: kots, eksctl, nova, pluto, headlamp, chart-testing, cilium-cli, chartmuseum, kubescape, helm-mapkubeapis, rancher-fleet, helm-docs, linkerd2, cerbos, trivy, helm-push, zot, tw, kube-arangodb, helm-set-status, consul-k8s, trivy-operator, istio, zarf, k9s,...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips, consul-k8s-fips, kube-arangodb-fips, envoy-gateway, chart-testing-fips, helm-operator, zarf, rancher-fleet, cilium-cli, rancher-fleet-fips, helm-exporter-fips, jfrog-cli, flux-source-controller, helm-diff-fips, k9s-fips, cloudbeat,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: stakater-reloader, newrelic-infra-operator, flux-image-automation-controller, kubewatch, sftpgo-plugin-eventsearch, smarter-device-manager, nova, aws-privateca-issuer, oras, pluto, tailscale, fluxcd-kustomize-mutating-webhook, apko, karpenter, grafana-operator,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: kots, kube-fluentd-operator, kine, kubernetes-csi-node-driver-registrar, cert-manager, gitlab-kas, prometheus, aws-flb-firehose, karpenter, redka, gitlab-pages, cilium-cli, external-dns, kubescape, gitaly, aws-flb-kinesis, ingress-nginx-controller, fscrypt, runc,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: aws-s3-controller, nova, amass, spqr, git-sync, rqlite, aws-node-termination-handler, grafana-agent-operator, opentelemetry-collector, php-fpmexporter, tofu-controller, newrelic-nri-statsd, controller-gen, prometheus-adapter, dynamic-localpv-provisioner,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: aws-s3-controller, nova, amass, spqr, git-sync, rqlite, aws-node-termination-handler, grafana-agent-operator, php-fpmexporter, tofu-controller, newrelic-nri-statsd, controller-gen, prometheus-adapter, dynamic-localpv-provisioner, pulumi-language-yaml, migrate, esbuil...