GO-2023-2113 vulnerabilities

Vulnerabilities for packages: rancher-webhook, metrics-server-fips, kubernetes-fips, rancher-webhook-fips, k3s, prometheus-adapter, kubernetes, kube-oidc-proxy, caddy, up, kubevela, buildkitd...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, aws-efs-csi-driver-fips, prometheus-adapter, spark-operator, aws-efs-csi-driver, kubernetes-dns-node-cache, aws-ebs-csi-driver, nodetaint...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, kubernetes-dashboard-metrics-scraper, aws-flb-kinesis, cortex, helm-push, go-bindata, metrics-server, wait-for-port, oras, dgraph, cass-operator, prometheus-adapter-fips, jsonnet-bundler, gke-gcloud-auth-plugin, aactl, render-template,...

GO-2024-3205 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, fq...

GO-2026-5208 vulnerabilities

Vulnerabilities for packages: snyk-cli, temporal-ui-server, kube-metrics-adapter, fq, temporal...

GO-2023-2113 vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, prometheus-adapter, up, caddy, kubevela, buildkitd...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: spark-operator, prometheus-adapter, kubernetes-dns-node-cache, aws-efs-csi-driver, nodetaint, ip-masq-agent...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: buildah, kubeflow, step-issuer, temporal-ui-server, timoni, runc, podinfo, gatus, k9s, kubernetes-csi-external-provisioner, nri-haproxy, src, jaeger-operator, victoriametrics-cluster, vault-k8s, crossplane-provider-aws-ec2, kube-vip, speedtest-go, nri-apache, act,...

EUVD-2026-50562

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials...

GHSA-H7P7-W5GC-XJ3W Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...

CLEANSTART-2026-MN93701 Security fixes in prometheus-adapter 0.12.0-r1

Package prometheus-adapter version 0.12.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-f5wc-c3c7-36mc, ghsa-5cgq-3rg8-m6cv...

AZL-95946 CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

CVE-2026-73425

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

EUVD-2026-57610

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remoteimages for Netlify's Image CDN allowlist. In...

PT-2026-71340

Astro is a web framework for content-driven websites. Prior to 8.1.2, the Astro Netlify adapter converts each image.remotePatterns entry into a regular expression written to .netlify/v1/config.json under images.remote images for Netlify's Image CDN allowlist. In...

CVE-2026-72742

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

CVE-2026-72742

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

EUVD-2026-56886

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

CVE-2026-72742 DSPy 3.3.0b1 Local File Read via Image/Audio Output Field Parsing

DSPy 3.3.0b1 contains a file exfiltration vulnerability in the Image and Audio output field adapters that allows attackers with influence over language model outputs to read arbitrary local files by injecting a filesystem path into the url field of a parsed Image or Audio typed output. The...

CVE-2026-58231 Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...