EUVD-2022-2051

Malicious code in bioql PyPI...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy-init, dagdotdev, checksec, local-path-provisioner, confluent-common-docker, kuberay-operator, docker-credential-ecr-login, bank-vaults, addon-resizer, kserve-rest-proxy, gitsign, cloud-provider-aws, blobfuse2, grafana-operator, nats, lvm-driver,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: stakater-reloader, yace-fips, secrets-store-csi-driver-provider-aws, openbao-k8s-fips, apm-server-fips, git-lfs, karpenter, kube-vip-cloud-provider, mattmoor-chainit, terraform-provider-time, docker-credential-ecr-login, vault-k8s, nvidia-nsight-compute-13.0,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: stakater-reloader, yace-fips, secrets-store-csi-driver-provider-aws, openbao-k8s-fips, apm-server-fips, git-lfs, karpenter, kube-vip-cloud-provider, mattmoor-chainit, terraform-provider-time, docker-credential-ecr-login, vault-k8s, nvidia-nsight-compute-13.0,...

GO-2025-3939 secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller

secrets-store-sync-controller discloses service account tokens in logs in sigs.k8s.io/secrets-store-sync-controller...

GHSA-RCW7-PQFP-735X secrets-store-sync-controller discloses service account tokens in logs

Hello Kubernetes Community, A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vau...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the error handling for parameters marshalling. An attacker can obtain sensitive service account tokens sent to the providers by accessing log files containing these credentials...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the error handling for parameters marshalling. An attacker can obtain sensitive service account tokens sent to the providers by accessing log files containing these credentials...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the error handling for parameters marshalling. An attacker can obtain sensitive service account tokens sent to the providers by accessing log files containing these credentials...

CVE-2025-7445

Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs...

CVE-2025-7445 Kubernetes secrets-store-sync-controller discloses service account tokens in logs

Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs...

CVE-2025-7445 Kubernetes secrets-store-sync-controller discloses service account tokens in logs

Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs...

CVE-2025-7445 Kubernetes secrets-store-sync-controller discloses service account tokens in logs

Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs...

PT-2025-36106

Name of the Vulnerable Software and Affected Versions Kubernetes secrets-store-sync-controller versions prior to 0.0.2 Description The Kubernetes secrets-store-sync-controller discloses service account tokens in logs. Recommendations Update to version 0.0.2 or later...

PT-2025-36631

Hello Kubernetes Community, A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vau...

secrets-store-sync-controller discloses service account tokens in logs

A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vault solutions. Tokens are onl...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: hello-world-golang, nri-kafka, dex, fq, timoni, local-path-provisioner, kuberay-operator, go-md2man, dockerize, nri-nginx, pulumi, yam, kaf, govulncheck, nodetaint, prometheus-adapter, nri-nagios, volume-modifier-for-k8s, kor, kubernetes-event-exporter, wire-go,...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: fulcio, tkn, rekor, restic, opentelemetry-collector-contrib, terragrunt, guac, cosign, pulumi, up, spire-server, bank-vaults, py3-cassandra-medusa, timestamp-authority, py3-azure-identity, argo-events, rclone, grafana-mimir, flyte, flux-image-reflector-controller,...

GO-2024-2750 Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure

Kubernetes Secrets Store CSI Driver plugins arbitrary file write in github.com/Azure/secrets-store-csi-driver-provider-azure. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, kaniko, metrics-server, certificate-transparency, actions-runner-controller, secrets-store-csi-driver-provider-aws, newrelic-nri-kube-events, flux-kustomize-controller, frp, sigstore-scaffolding, kubeflow, grpc-health-probe,...