GO-2026-6603 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, terraform-docs, terraform-mcp-server, crossplane-provider-aws-efs-fips, chainloop-cli-fips, osv-scanner, frankenphp-8.5, crossplane-provider-aws-licensemanager-fips, longhorn-manager-fips, aws-eks-pod-identity-agent, velero, monstache,...

CVE-2026-78663 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, terraform-docs, terraform-mcp-server, crossplane-provider-aws-efs-fips, chainloop-cli-fips, osv-scanner, frankenphp-8.5, crossplane-provider-aws-licensemanager-fips, longhorn-manager-fips, aws-eks-pod-identity-agent, velero, monstache,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, terraform-docs, terraform-mcp-server, crossplane-provider-aws-efs-fips, chainloop-cli-fips, osv-scanner, frankenphp-8.5, crossplane-provider-aws-licensemanager-fips, longhorn-manager-fips, aws-eks-pod-identity-agent, velero, monstache,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, terraform-docs, terraform-mcp-server, crossplane-provider-aws-efs-fips, chainloop-cli-fips, osv-scanner, frankenphp-8.5, crossplane-provider-aws-licensemanager-fips, longhorn-manager-fips, aws-eks-pod-identity-agent, velero, monstache,...

CVE-2026-78660 vulnerabilities

Vulnerabilities for packages: helm-push, rancher-system-agent, knative-operator, gitness, tfsec, custom-pod-autoscaler, crossplane-provider-aws-iam, zot, istio, nri-haproxy, certificate-transparency, grpcurl, juicefs-csi-driver, k9s, yunikorn-k8shim, cluster-autoscaler, k8sgpt, temporal, litefs,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: helm-push, rancher-system-agent, knative-operator, gitness, tfsec, custom-pod-autoscaler, crossplane-provider-aws-iam, zot, istio, nri-haproxy, certificate-transparency, grpcurl, juicefs-csi-driver, k9s, yunikorn-k8shim, cluster-autoscaler, k8sgpt, temporal, litefs,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: helm-push, rancher-system-agent, knative-operator, gitness, tfsec, buildah, custom-pod-autoscaler, crossplane-provider-aws-iam, sftpgo-plugin-eventstore, zot, esbuild, istio, certificate-transparency, grpcurl, nri-haproxy, juicefs-csi-driver, k9s, yunikorn-k8shim,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: helm-push, rancher-system-agent, knative-operator, gitness, tfsec, buildah, custom-pod-autoscaler, crossplane-provider-aws-iam, sftpgo-plugin-eventstore, zot, esbuild, istio, certificate-transparency, grpcurl, nri-haproxy, juicefs-csi-driver, k9s, yunikorn-k8shim,...

CVE-2026-73179

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

CVE-2026-106488

A flaw was found in plugin-auth-backend-module-oidc-provider. In deployments using email-based identity resolution with an OpenID Connect OIDC provider that allows unverified email addresses, an authenticated attacker can achieve privilege escalation by assuming another catalog identity. This...

CLEANSTART-2026-ZR95195 Security fix for GHSA-f6x5-jh6r-wnfv applied in: cloud-provider-aws 1.34.1-r1

Security vulnerability affects the cloud-provider-aws package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-LC49486 Security fix for GHSA-j5w8-q4qc-rx2x applied in: gcp-compute-persistent-disk-csi-driver 1.22.3-r1, cloud-provider-aws 1.34.1-r1

GHSA-j5w8-q4qc-rx2x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-73179: Time-of-check Time-of-use (TOCTOU) Race Condition

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic...

AZL-107222 CVE-2026-97032 affecting package cloud-provider-kubevirt 0.5.1-9

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107622 CVE-2026-97032 affecting package kube-vip-cloud-provider 0.0.10-10

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107213 CVE-2026-78669 affecting package cloud-provider-kubevirt 0.5.1-9

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107631 CVE-2026-78669 affecting package kube-vip-cloud-provider 0.0.10-10

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107219 CVE-2026-78663 affecting package cloud-provider-kubevirt 0.5.1-9

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107225 CVE-2026-78660 affecting package cloud-provider-kubevirt 0.5.1-9

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107216 CVE-2026-78659 affecting package cloud-provider-kubevirt 0.5.1-9

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...