233 matches found
Malicious Package
Overview sidecar-mcp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
CVE-2026-76262 Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...
CVE-2026-76262
CVE-2026-76262 affects Splunk Enterprise 10.4 versions below 10.4.2 . The Edge Processor SPL2 Preview sidecar exposes its Prometheus metrics endpoint without authentication, allowing any unauthenticated network client to retrieve runtime and build metadata for the sidecar. The vulnerability is li...
CVE-2026-76262 Exposure of Sensitive Information to an Unauthorized Actor through the REST API in Splunk Enterprise
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...
PT-2026-78734
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could read Prometheus service metrics from the Edge Processor SPL2 Preview sidecar, including service details that expose relevant runtime and build metadata for the sidecar. The vulnerability does not affect Splunk Enterpri...
pii-shield v2.2.0
PII-Shield 🛡️ Zero-code log sanitization sidecar for Kubernetes. Prevents data leaks GDPR/SOC2 by redacting PII from logs before they leave the pod. PII-Shield runs in-process — CLI, sidecar, or WASM. There is no hosted API and no server your data is sent to. "Don't let PII poison your AI models."...
GO-2026-5046 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-contrib, dapr, bento, splunk-otel-collector...
CVE-2026-15467 Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...
CVE-2026-15467 Trustyai-service-operator: trustyai-service-operator: lmevaljob sidecar containers bypass protected environment variable filtering, allowing trust_remote_code policy override
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...
CVE-2026-15467
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...
CVE-2026-15467
Trustyai-service-operator vulnerability CVE-2026-15467 affects the LMEvalJob controller. An authenticated cluster user can abuse a sidecar container to bypass environment-variable filtering and security policies, enabling remote code execution within the cluster. CVSS 3.1 base score 8.1 (HIGH) wi...
EUVD-2026-55809
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...
CVE-2026-15467
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...
CVE-2026-15467: Incorrect Privilege Assignment
A flaw was found in the trustyai-service-operator's LMEvalJob controller. An authenticated user within the cluster can exploit this vulnerability by configuring a sidecar container to bypass existing security policies. This allows the user to enable and execute untrusted remote code, leading to...
PT-2026-69952
Name of the Vulnerable Software and Affected Versions trustyai-service-operator affected versions not specified Description A flaw in the LMEvalJob controller allows an authenticated user within the cluster to bypass security policies by configuring a sidecar container. This bypass enables the...
GHSA-G6CJ-PR64-35W5 vulnerabilities
Vulnerabilities for packages: openstack-placement-2025.1, dagster, azureml-inference-server-http, apache-beam-python-3.14-sdk, openstack-placement-2026.1, ggshield, dbt-snowflake, barman, datadog-agent-fips, openstack-nova-2025.1, request-1276, openstack-kolla-toolbox-2025.1, airflow-core,...
CVE-2026-69247 vulnerabilities
Vulnerabilities for packages: openstack-placement-2025.1, dagster, azureml-inference-server-http, apache-beam-python-3.14-sdk, openstack-placement-2026.1, ggshield, dbt-snowflake, barman, datadog-agent-fips, openstack-nova-2025.1, request-1276, openstack-kolla-toolbox-2025.1, airflow-core,...
GHSA-G6CJ-PR64-35W5 vulnerabilities
Vulnerabilities for packages: open-webui, kubeflow, datadog-agent, az, kserve, ggshield, mlflow, py3-cassandra-medusa, semgrep, superset, mycli, mitmproxy, kubeflow-volumes-web-app, k8s-sidecar, airflow, in-toto, dask-kubernetes...
CVE-2026-69247 vulnerabilities
Vulnerabilities for packages: open-webui, kubeflow, datadog-agent, az, kserve, ggshield, mlflow, py3-cassandra-medusa, semgrep, superset, mycli, mitmproxy, kubeflow-volumes-web-app, k8s-sidecar, airflow, in-toto, dask-kubernetes...
