CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: capslock, boring-registry, wave, xcaddy, vault-k8s, octo-sts, regclient, juicefs, openbao-k8s, spicedb-operator, gosu, nats, mongodb-kubernetes-operator, govulncheck, docker-credential-gcr, azure-workload-identity-webhook, kaf, kubernetes-event-exporter, sbom-convert...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: capslock, boring-registry, wave, xcaddy, vault-k8s, octo-sts, regclient, juicefs, openbao-k8s, spicedb-operator, gosu, nats, mongodb-kubernetes-operator, govulncheck, docker-credential-gcr, azure-workload-identity-webhook, kaf, kubernetes-event-exporter, sbom-convert...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: capslock, boring-registry, wave, xcaddy, vault-k8s, octo-sts, regclient, juicefs, openbao-k8s, spicedb-operator, gosu, nats, mongodb-kubernetes-operator, govulncheck, docker-credential-gcr, azure-workload-identity-webhook, kaf, kubernetes-event-exporter, sbom-convert...

EUVD-2013-3342

Malware in sbrugna...

Malicious code in kitchen-shopify-provisioner (npm)

The package kitchen-shopify-provisioner was found to contain malicious code...

MAL-2025-24548 Malicious code in kitchen-shopify-provisioner (npm)

The package kitchen-shopify-provisioner was found to contain malicious code...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: verticadb-operator-fips, cert-manager-csi-driver, k6-fips, opentelemetry-collector-fips, consul-k8s, kubescape-operator-fips, dagger, amazon-k8s-cni, harbor-scanner-trivy-fips, fluxcd-kustomize-mutating-webhook, fulcio, slsa-verifier, etcd, knative-serving-fips,...

CVE-2013-3407

The web interface in Cisco Server Provisioner 6.4.0 Patch 5-1301292331 and earlier does not require authentication for unspecified pages, which allows remote attackers to obtain sensitive information via a direct request, aka Bug ID CSCug65664...

Azure Linux 3.0 Security Update: kubernetes / local-path-provisioner (CVE-2020-8565)

The version of kubernetes / local-path-provisioner installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-8565 advisory. - In Kubernetes, if the logging level is set to at least 9, authorization and bear...

CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5

CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5. A patched version of the package is available...

CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12

CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12. A patched version of the package is available...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: capslock, cue, nri-haproxy, goreleaser, vault-k8s, k8sgpt-operator, sbomqs, regclient, yq, flux-helm-controller, gh, gosu, nats, newrelic-prometheus-configurator, temporal-server, govulncheck, docker-credential-gcr, cass-operator, aws-flb-firehose, kaf,...

CVE-2023-39325 affecting package local-path-provisioner for versions less than 0.0.24-3

CVE-2023-39325 affecting package local-path-provisioner for versions less than 0.0.24-3. A patched version of the package is available...

CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3

CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3. A patched version of the package is available...

GHSA-82M2-CV7P-4M75 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, spark-operator, kubernetes-csi-driver-hostpath, ip-masq-agent, kubeflow-pipelines, nodetaint, cri-tools, aws-efs-csi-driver, kubernetes-dns-node-cache, k8s-device-plugin, argocd-image-updater...

CVE-2024-5321 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, spark-operator, kubernetes-csi-driver-hostpath, ip-masq-agent, kubeflow-pipelines, nodetaint, cri-tools, aws-efs-csi-driver, kubernetes-dns-node-cache, k8s-device-plugin, argocd-image-updater...

Backup Failing With `Too many snapshots` When Using Longhorn as a Storage Provisioner

Challenge Veeam Kasten for Kubernetes backup action for longhorn volumes fails with the error message: too many snapshots created Cause When integrating with CSI-based volumes, Veeam Kasten for Kubernetes employs VolumeSnapshot resources to create snapshots during backup operations. With Longhorn...

Sensitive Information leak via Log File in Kubernetes

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects v1.19.3, v1.18.10, v1.17.13...

AZL-38488 CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: capslock, hubble, boring-registry, goreleaser, vault-k8s, k8sgpt-operator, flux-helm-controller, cloudflared, gh, nats, crossplane-provider-aws-ec2, temporal-server, cass-operator, crossplane-provider-azure-storage, kaf, kubernetes-event-exporter,...