48 matches found
CVE-2025-41118 Sensitive COS `SecretKey` exposed in plaintext via configuration API due to missing type protection
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
Pyroscope 安全漏洞
Pyroscope is an open-source continuous performance analysis platform developed by Grafana. Vulnerabilities exist in versions prior to Pyroscope 1.15.2, 1.16.1, and 1.17.0. These vulnerabilities stem from improper configuration, potentially allowing attackers to extract the secretkey configuration...
GHSA-78H2-9FRX-2JM8 vulnerabilities
Vulnerabilities for packages: consul, timestamp-authority-fips, podman-fips, consul-k8s, gitlab-cng, vault-secrets-webhook, cosign, terragrunt-fips, gomplate, beats-fips, pulumi, kyverno, step-issuer-fips, tekton-chains, hydra, external-secrets-operator-fips, steampipe, cert-manager-fips,...
CVE-2026-27142 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudformation, kapp-controller, net-kourier, timoni, pulumi-language-yaml, gogatekeeper, spqr, amazon-cloudwatch-agent-operator, ksops, gcp-compute-persistent-disk-csi-driver, kubernetes-dashboard-api, rook, cass-operator,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudformation, kapp-controller, net-kourier, timoni, pulumi-language-yaml, gogatekeeper, spqr, amazon-cloudwatch-agent-operator, ksops, gcp-compute-persistent-disk-csi-driver, kubernetes-dashboard-api, rook, cass-operator,...
GHSA-J3GX-2473-5FP8 vulnerabilities
Vulnerabilities for packages: net-kourier, kubernetes-dashboard-api, promxy, victoriametrics-cluster, gitea, langfuse, flux-source-controller, minio-object-browser, rancher-telemetry, croc, fuse-overlayfs-snapshotter, mesosphere-vsphere-csi, aws-flb-kinesis, pdfcpu, mountpoint-s3-csi-driver,...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: net-kourier, kubernetes-dashboard-api, promxy, victoriametrics-cluster, gitea, langfuse, flux-source-controller, minio-object-browser, rancher-telemetry, croc, fuse-overlayfs-snapshotter, mesosphere-vsphere-csi, aws-flb-kinesis, pdfcpu, mountpoint-s3-csi-driver,...
GHSA-RV83-G57W-FR8J vulnerabilities
Vulnerabilities for packages: net-kourier, kubernetes-dashboard-api, promxy, victoriametrics-cluster, gitea, langfuse, flux-source-controller, minio-object-browser, rancher-telemetry, croc, wazero, fuse-overlayfs-snapshotter, mesosphere-vsphere-csi, aws-flb-kinesis, pdfcpu,...
GHSA-J4J7-VW47-RHFQ vulnerabilities
Vulnerabilities for packages: azuredisk-csi-fips, consul, onepassword-operator, cloud-sql-proxy, k8ssandra-operator, sftpgo-plugin-eventstore, helm-exporter, nginx-prometheus-exporter, dcgm-exporter, terragrunt-fips, gomplate, beats-fips, pulumi, kong-ingress-controller-fips, kyverno,...
CVE-2026-25679 vulnerabilities
Vulnerabilities for packages: azuredisk-csi-fips, consul, onepassword-operator, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, nri-discovery-kubernetes-fips, helm-exporter, consul-k8s, podman-fips, nginx-prometheus-exporter,...
GHSA-J3GX-2473-5FP8 vulnerabilities
Vulnerabilities for packages: azuredisk-csi-fips, consul, onepassword-operator, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, nri-discovery-kubernetes-fips, helm-exporter, consul-k8s, podman-fips, nginx-prometheus-exporter,...
GHSA-RV83-G57W-FR8J vulnerabilities
Vulnerabilities for packages: azuredisk-csi-fips, consul, kratos, onepassword-operator, cloud-sql-proxy, k8ssandra-operator, kubernetes-replicator, timestamp-authority-fips, sftpgo-plugin-eventstore, nri-discovery-kubernetes-fips, helm-exporter, consul-k8s, gitlab-cng, nginx-prometheus-exporter,...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: azuredisk-csi-fips, consul, onepassword-operator, gitlab-cng, vault-secrets-webhook, cosign, terragrunt-fips, gomplate, beats-fips, kyverno, tekton-chains, hydra, steampipe, trufflehog-fips, thanos, dgraph, fulcio, velero-plugin-for-gcp, jaeger-operator-fips, headlam...
PT-2026-3780
Name of the Vulnerable Software and Affected Versions Pyroscope versions prior to 1.15.2 Pyroscope versions prior to 1.16.1 Description When configured to use Tencent Cloud Object Storage COS as the storage backend, the Pyroscope API may expose the secret key configuration value. An attacker with...
Exposure of Storage Secret in Pyroscope
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage COS. If the database is configured to use Tencent COS as the storage backend, an attacker could extract the secretkey configuration value from the...
GHSA-5MH9-3JWC-RP59 vulnerabilities
Vulnerabilities for packages: ipfs-cluster, spqr, gogatekeeper, grafana, paranoia, github-mcp-server, kubeflow, infinispan-operator, steampipe, promxy, temporal, snyk-cli, gitea, k9s, terraform-mcp-server, terraform-docs, rancher-telemetry, kind, opa, kube-rbac-proxy, kserve-rest-proxy, nri-jmx,...
CVE-2025-61727 vulnerabilities
Vulnerabilities for packages: ipfs-cluster, spqr, gogatekeeper, grafana, paranoia, github-mcp-server, kubeflow, infinispan-operator, steampipe, promxy, temporal, snyk-cli, gitea, k9s, terraform-mcp-server, terraform-docs, rancher-telemetry, kind, opa, kube-rbac-proxy, kserve-rest-proxy, nri-jmx,...
GHSA-5MH9-3JWC-RP59 vulnerabilities
Vulnerabilities for packages: azuredisk-csi-fips, consul, kubernetes-replicator, sftpgo-plugin-eventstore, nri-discovery-kubernetes-fips, gitlab-cng, velero-plugin-for-csi-fips, opa-envoy, kubernetes-event-exporter, go-fips, kyverno-policy-reporter-plugins-trivy-fips, steampipe,...