GO-2024-2918 vulnerabilities

Vulnerabilities for packages: flux-source-controller, rclone, hugo, up, fluent-bit-plugin-loki, goreleaser, bank-vaults, sigstore-scaffolding, cortex, flux-image-reflector-controller, fulcio, k8sgpt, sqlpad, trivy, cosign, nuclei, buildkitd, airflow, py3-azure-identity, step, kubescape, zarf, sop...

GO-2025-4006 vulnerabilities

Vulnerabilities for packages: runc, gotestsum, terraform-docs, cert-exporter, helm-docs, wait-for-port, tfsec, mods, sriov-network-device-plugin, mongo-tools, go-bindata, oauth2-proxy, distribution, pvc-autoresizer, s5cmd, cert-manager-cmctl, sbom-convert, vexctl, dockerize, go-md2man, age, incer...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: karpenter, runc, crossplane-provider-aws-s3, terraform-docs, actions-runner-controller, cert-exporter, litestream, cluster-api-ipam-provider-in-cluster, sftpgo-plugin-eventstore, datadog-agent, aws-flb-kinesis, crossplane-provider-aws-ec2, steampipe,...

GO-2026-5037 vulnerabilities

Vulnerabilities for packages: karpenter, runc, crossplane-provider-aws-s3, terraform-docs, actions-runner-controller, cert-exporter, litestream, cluster-api-ipam-provider-in-cluster, sftpgo-plugin-eventstore, mongo-tools, datadog-agent, aws-flb-kinesis, crossplane-provider-aws-ec2, steampipe,...

GO-2026-5426 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3, gitness, vitess, cluster-api-ipam-provider-in-cluster, cluster-api-aws-controller, mcp-grafana, tfsec, helm-operator, datadog-agent, distribution, kine, crossplane-provider-aws-ec2, gatekeeper, steampipe, docker-machine-driver-harvester,...

GO-2026-4982 vulnerabilities

Vulnerabilities for packages: karpenter, runc, kubernetes-csi-driver-nfs, litestream, sftpgo-plugin-eventstore, helm-operator, apko, aws-flb-kinesis, gatekeeper, azure-service-operator, step, dex, metrics-server, prometheus-adapter, kuma, trino, rancher-helm, flyte, cloud-sql-proxy,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-s3, mods, datadog-agent, kine, apko, crossplane-provider-aws-ec2, steampipe, step-kms-plugin, step, eksctl, pulumi-language-java, policy-controller, gitlab-runner, crossplane-provider-aws-dynamodb, syft, atlantis, crossplane-provider-aws-sqs,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: runc, crossplane-provider-aws-s3, gitness, terraform-docs, actions-runner-controller, kubernetes-csi-driver-nfs, litestream, cluster-api-ipam-provider-in-cluster, tfsec, mods, helm-operator, sriov-network-device-plugin, s5cmd, pvc-autoresizer, cert-manager-cmctl, kin...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: gitness, actions-runner-controller, gitsign, oauth2-proxy, mongo-tools, vexctl, distribution, kine, step-kms-plugin, step, eksctl, policy-controller, flyte, promxy, atlantis, crossplane-provider-azure-authorization, minio-operator, chezmoi, kubernetes-dashboard-auth,...

GO-2024-2824 vulnerabilities

Vulnerabilities for packages: runc, gitness, terraform-docs, cert-exporter, litestream, wait-for-port, tfsec, kubewatch, mods, helm-operator, mongo-tools, go-bindata, oauth2-proxy, s5cmd, kubernetes-ingress-defaultbackend, dockerize, go-md2man, step, sonobuoy, dex, eksctl, metrics-server,...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

Security Bulletin: Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit the...

Malicious code in path-match-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7606d3a4e2ac3f49313aee20db3419de70aa76e17ec213031a0c3b6a62110273 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14005 Malicious code in path-match-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7606d3a4e2ac3f49313aee20db3419de70aa76e17ec213031a0c3b6a62110273 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-8715

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

CVE-2026-19483

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets may be disclosed in information related ...

EUVD-2026-58400

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

CVE-2026-8715 Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...

CVE-2026-8715

Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit their...