PT-2026-35539

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.5 Spring Boot versions 3.5.0 through 3.5.13 Description When configured to use an SSL bundle, the RabbitMQ auto-configuration fails to perform hostname verification during the connection process to the...

RabbitMQ auto-configuration with an SSL bundle disables TLS hostname verification

When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, dkron, local-path-provisioner, github-mcp-server, aws-network-policy-agent, clickhouse-operator, victoriametrics, victoriametrics-cluster, fluxcd-kustomize-mutating-webhook, kubewatch, metacontroller, newrelic-k8s-metadata-injection,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: docker-cli-buildx, victoriametrics-cluster, kubernetes-dashboard-metrics-scraper, http-echo, kube-fluentd-operator, whereabouts, go-discover, scorecard, wgcf, grafana, nfs-subdir-external-provisioner, syft, extism, flux-source-controller, kustomize, s5cmd, xeol,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: dbmate, flux-image-automation-controller-fips, kubewatch, fluxcd-kustomize-mutating-webhook-fips, aws-privateca-issuer-fips, nemo, pluto, stakater-reloader, github-mcp-server, nginx-kubernetes-ingress-fips, polaris-fips, actions-runner-controller-fips, nodetaint-fips...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: dbmate, flux-image-automation-controller-fips, kubewatch, fluxcd-kustomize-mutating-webhook-fips, aws-privateca-issuer-fips, nemo, pluto, stakater-reloader, github-mcp-server, nginx-kubernetes-ingress-fips, polaris-fips, actions-runner-controller-fips, nodetaint-fips...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: dex, elastic-agent, opentofu, cluster-autoscaler-fips, telegraf, tofu-controller, grafana, aws-flb-firehose-fips, aws-flb-cloudwatch-fips, docker-cli-fips, tkn-fips, atlantis, azurefile-csi-fips, backup-restore-operator, karpenter, rancher-machine, nats,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: dex, elastic-agent, opentofu, cluster-autoscaler-fips, telegraf, tofu-controller, grafana, aws-flb-firehose-fips, aws-flb-cloudwatch-fips, docker-cli-fips, tkn-fips, atlantis, azurefile-csi-fips, backup-restore-operator, karpenter, rancher-machine, nats,...

CLEANSTART-2026-PI36812 Security fixes for CVE-2026-33186, ghsa-6v2p-p943-phr9, ghsa-c6gw-w398-hv78, ghsa-f6x5-jh6r-wrfv, ghsa-hcg3-p754-cr77, ghsa-j5w8-q4qc-rx2x, ghsa-qxp5-gw88-xv66, ghsa-v778-237x-gjrc, ghsa-vvgc-356p-c3xw applied in versions: 1.15.0-r1, 1.19.0-r0

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

ROOT-OS-ALPINE-318-CVE-2023-35789 CVE-2023-35789 in rootio-rabbitmq-c - Patched by Root

Root has patched CVE-2023-35789 in the rootio-rabbitmq-c package for Root:Alpine:3.18. Multiple fixed versions available...

BIT-RABBITMQ-C-2023-35789

An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for amqp-publish or amqp-consume and are thus visible to local attackers by listing a process and its arguments...

Malicious code in rabbitmq-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5fd48bd646ad6b2f173f479170d732395513c048f0c0f6148205c0e1d08f864 The package rabbitmq-sdk was found to contain malicious code...

MAL-2026-1831 Malicious code in rabbitmq-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5fd48bd646ad6b2f173f479170d732395513c048f0c0f6148205c0e1d08f864 The package rabbitmq-sdk was found to contain malicious code...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: rook, victoriametrics-cluster, kubernetes-dashboard-metrics-scraper, http-echo, kube-fluentd-operator, whereabouts, kube-metrics-adapter, kubevela, wgcf, kube-rbac-proxy, nfs-subdir-external-provisioner, syft, azcopy, flux-source-controller, k8sgpt, kustomize, s5cmd,...

GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: rook, victoriametrics-cluster, kubernetes-dashboard-metrics-scraper, http-echo, kube-fluentd-operator, whereabouts, kube-metrics-adapter, kubevela, wgcf, kube-rbac-proxy, nfs-subdir-external-provisioner, syft, azcopy, flux-source-controller, k8sgpt, kustomize, s5cmd,...

GHSA-J3GX-2473-5FP8 vulnerabilities

Vulnerabilities for packages: rook, victoriametrics-cluster, kubernetes-dashboard-metrics-scraper, http-echo, kube-fluentd-operator, whereabouts, kube-metrics-adapter, kubevela, wgcf, kube-rbac-proxy, nfs-subdir-external-provisioner, syft, azcopy, flux-source-controller, k8sgpt, kustomize, s5cmd,...

CVE-2026-27139 vulnerabilities

Vulnerabilities for packages: rook, victoriametrics-cluster, kubernetes-dashboard-metrics-scraper, http-echo, kube-fluentd-operator, whereabouts, kube-metrics-adapter, kubevela, wgcf, kube-rbac-proxy, nfs-subdir-external-provisioner, syft, azcopy, flux-source-controller, k8sgpt, kustomize, s5cmd,...

CLEANSTART-2026-CA79883 Security fixes for GHSA-6V2P-P943-PHR9, GHSA-C6GW-W398-HV78, GHSA-F6X5-JH6R-WRFV, GHSA-HCG3-P754-CR77, GHSA-J5W8-Q4QC-RX2X, GHSA-QXP5-GW88-XV66, GHSA-V778-237X-GJRC, GHSA-VVGC-356P-C3XW applied in versions: 1.15.0-r1

Multiple security vulnerabilities affect the rabbitmq-messaging-topology-operator package. These issues are resolved in later releases. See references for individual vulnerability details...

Malicious code in @purecore/rabbitmq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e503973dbf2c860017e4ea8118ddec5cd43a537c32eb8fca24ac544a86d8822 The package @purecore/rabbitmq was found to contain malicious code. Source: ghsa-malware...

MAL-2026-749 Malicious code in @purecore/rabbitmq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e503973dbf2c860017e4ea8118ddec5cd43a537c32eb8fca24ac544a86d8822 The package @purecore/rabbitmq was found to contain malicious code. Source: ghsa-malware...