CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: kyverno, telegraf, kargo, crossplane-fips, cosign, helm-fips, rke2-runtime-fips, snyk-cli, grafana-fips, kube-arangodb-fips, libnvidia-container, kubernetes-csi-node-driver-registrar, amazon-ecs-cni-plugins-fips, knative-serving-fips, step-ca, crane-fips, jaeger,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: kyverno, aws-sigv4-proxy, telegraf, terraform-provider-time, newrelic-k8s-metadata-injection, kubernetes-dashboard-auth-fips, pguser, nri-nginx, kargo, kyverno-notation-aws, custom-pod-autoscaler, crossplane-provider-keycloak, crossplane-fips, k8sgpt-operator,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: kyverno, telegraf, grype-db, tekton-chains, envoy-gateway-fips, kargo, kyverno-notation-aws, vexctl, crossplane-fips, flux-kustomize-controller-fips, cosign, snyk-cli, neuvector-sigstore-interface, grafana-fips, kube-arangodb-fips, step, kubescape-operator, step-ca,...

CLEANSTART-2026-RR25843 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-6g7g-w4f8-9c9x, ghsa-9h8m-3fm2-qjrq, ghsa-j5w8-q4qc-rx2x, ghsa-p77j-4mvh-x3m3 applied in versions: 1.35.2-r0, 1.35.2-r1, 1.35.2-r2

Multiple security vulnerabilities affect the weaviate package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UO45926 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, ghsa-j5w8-q4qc-rx2x applied in versions: 1.35.2-r0

Multiple security vulnerabilities affect the weaviate package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: dgraph, terraform-mcp-server, mcp-grafana, nuclei, malcontent, maru, minio, nfpm, k3s, k8sgpt, grafana, grafana-alloy, dagger, eksctl, lazygit, prometheus, cri-tools, redpanda, datadog-agent, vcluster, weaviate, loki, witness, tempo, gitlab-runner, terragrunt,...

Path Traversal

github.com/weaviate/weaviate is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of the fileName field in the transfer logic, which allows an attacker who can invoke the GetFile method while a shard is in the “Pause file activity” state and the...

Malicious code in weaviate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229f83d7066881287b7035e8e71dc5ed74531480ab19cbf47ebd72990bc1525 The package weaviate-js was found to contain malicious code. Source: ghsa-malware bb063c82675f5933564b46d7e49a2c2a7aac395d9a399b1264e3de0aafb29905 An...

EUVD-2026-3717

Malicious code in weaviate-js npm...

MAL-2026-434 Malicious code in weaviate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229f83d7066881287b7035e8e71dc5ed74531480ab19cbf47ebd72990bc1525 The package weaviate-js was found to contain malicious code. Source: ghsa-malware bb063c82675f5933564b46d7e49a2c2a7aac395d9a399b1264e3de0aafb29905 An...

Malicious Package

Overview weaviate-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

SUSE CVE-2025-67818

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path e.g., /etc/... or use parent directory traversal ../../.. to escape the restore root when a backup is restored, potentially creating or...

SUSE CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...

CVE-2025-67818

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path e.g., /etc/... or use parent directory traversal ../../.. to escape the restore root when a backup is restored, potentially creating or...

CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...

GO-2025-4238 Weaviate OSS has path traversal vulnerability via the Shard Movement API in github.com/weaviate/weaviate

Weaviate OSS has path traversal vulnerability via the Shard Movement API in github.com/weaviate/weaviate...

GO-2025-4237 Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip in github.com/weaviate/weaviate

Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip in github.com/weaviate/weaviate...

EUVD-2025-203093

Weaviate OSS has path traversal vulnerability via the Shard Movement API...

EUVD-2025-203094

Weaviate OSS has a Path Traversal Vulnerability via Backup ZipSlip...

Weaviate OSS has path traversal vulnerability via the Shard Movement API

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...