GO-2024-2491 vulnerabilities

Vulnerabilities for packages: nerdctl, wolfictl, grype, buildkitd, kots, kubescape, skaffold, zarf, trivy, cadvisor, runc, k9s, skopeo, docker, podman, newrelic-infrastructure-agent, kubernetes, k3s, kaniko, zot, k3d, ctop, syft...

GO-2023-2412 vulnerabilities

Vulnerabilities for packages: up, cilium-cli, grype, eksctl, buildkitd, flux-source-controller, kots, gitness, helm-push, k8sgpt, kubescape, skaffold, kubevela, flux-helm-controller, trivy, newrelic-infrastructure-agent, helm, melange, kaniko, zot, k3d, ctop, fuse-overlayfs-snapshotter...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: spark-operator, nodetaint, kubernetes-dns-node-cache, cri-tools, kubernetes-csi-driver-hostpath, local-static-provisioner, kubeflow-pipelines, k8s-device-plugin, aws-efs-csi-driver, argocd-image-updater, ip-masq-agent...

GO-2026-5224 vulnerabilities

Vulnerabilities for packages: rancher, rancher-agent, azure-service-operator...

GO-2025-4222 vulnerabilities

Vulnerabilities for packages: flannel, kuma, calico, nerdctl, containerd, docker, istio, datadog-agent, podman, multus-cni, azure-ipam, buildkitd, buildah, rootlesskit, k3s...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: spark-operator, nodetaint, kubernetes-dns-node-cache, prometheus-adapter, aws-efs-csi-driver, ip-masq-agent...

GO-2024-3286 vulnerabilities

Vulnerabilities for packages: nodetaint, kubernetes-dns-node-cache, local-static-provisioner, kubeflow-pipelines, k8s-device-plugin, aws-efs-csi-driver, argocd-image-updater, ip-masq-agent...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: karma, datadog-agent, prometheus-pushgateway, certificate-transparency, mc, telegraf, loki, jaeger, tempo, istio, grafana-pyroscope, cloud-sql-proxy, minio-object-browser, aws-otel-collector, minio, minio-operator, keda, trillian, splunk-otel-collector, mcp-grafana...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-cloudformation, crossplane-provider-aws-s3, grafana-alloy, crossplane-provider-family-azure, datadog-agent, nuclei, crossplane-provider-azure-storage, crossplane-provider-aws-sqs, crossplane-provider-aws-rds...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, grafana-alloy, jitsucom-bulker, opentelemetry-collector-contrib, amazon-cloudwatch-agent, sqlexporter, cluster-api-aws-controller, bento, argo-events...

GO-2025-3525 vulnerabilities

Vulnerabilities for packages: argo-rollouts, grafana-alloy, nats, opentelemetry-collector-contrib, argo-workflows, k8sgpt, kargo, amazon-cloudwatch-agent, kubeflow-pipelines, tempo, splunk-otel-collector, opentelemetry-collector...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: karma, datadog-agent, prometheus-pushgateway, opentelemetry-collector, node-problem-detector, certificate-transparency, metrics-server, k8sgpt, fluent-bit-plugin-loki, mc, prometheus, loki, prometheus-operator, jaeger, grafana, istio, tempo, cloud-sql-proxy,...

GO-2024-3305 vulnerabilities

Vulnerabilities for packages: pulumi, amazon-cloudwatch-agent-operator, promxy, kubevela, rancher-agent, k3s...

GO-2024-3311 vulnerabilities

Vulnerabilities for packages: pulumi, amazon-cloudwatch-agent-operator, promxy...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: up, policy-controller, rclone, cortex, flux-image-reflector-controller, tekton-chains, spire-server, buildkitd, flux-source-controller, nuclei, opentelemetry-collector, guac, hugo, k8sgpt, kubescape, fluent-bit-plugin-loki, harbor-registry, druid,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, aws-privateca-issuer, policy-controller, swagger, cortex, kubelet-csr-approver, juicefs, spire-server, kserve-modelmesh-serving, spire-controller-manager, crossplane-provider-sql, whereabouts, postgres-operator,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: dive, aws-privateca-issuer, gcsfuse, swagger, kubernetes-dashboard-auth, lazydocker, terraform-provider-azapi, docker-machine-driver-harvester, spire-controller-manager, helm-push, terraform, rabbitmq-messaging-topology-operator, nri-mysql, azure-service-operator,...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-72849

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...

CVE-2026-72849 Budibase before 3.40.0 Identity Confusion via Chat-Link Handoff CSRF

Budibase before 3.40.0 contains a cross-site request forgery vulnerability in the chat-link handoff endpoint that allows attackers to bind an external chat identity to a victim's account. Attackers can craft a phishing page that auto-submits a POST request with a leaked confirmation token to bind...