GO-2024-2947 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, falcoctl, step-ca, skopeo, snyk-cli, bank-vaults, sigstore-scaffolding, kubevela, policy-controller, crossplane-provider-azure, flux-helm-controller, sops, rekor, k3s, flux, kubernetes-event-exporter, fulcio, gh,...

Malicious code in cdktn-provider-azurerm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: kaf, crossplane-provider-aws-cloudtrail-fips, redpanda-console, crossplane-provider-aws-lambda, crossplane-provider-azure-servicebus, crossplane-provider-aws-secretsmanager, livekit-cli, crossplane-provider-aws-s3, scorecard, prometheus, etcd-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, cloud-provider-aws, policy-controller, steampipe, ko, flux, cluster-api-azure-controller, docker-machine-driver-harvester, trivy-operator, buildah, glab, crossplane-provider-family-azure, act, flux-source-controller, atlanti...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver-fips, kaf, neuvector-dbgen, kubernetes-csi-driver-nfs-fips, octo-sts, dataplaneapi-fips, regclient, seaweedfs, prometheus-mysqld-exporter-fips, k8ssandra-client-fips, kube-bench, rancher-system-upgrade-controller, aws-flb-cloudwatch,...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver-fips, kaf, crossplane-provider-aws-lambda, seaweedfs, dapr-fips, kube-bench, livekit-cli, apm-server-fips, ollama, dockerize, crossplane-provider-aws-s3, scorecard, prometheus, nginx-prometheus-exporter-fips, etcd-fips, kubeflow-pipelines,...

CVE-2025-47914 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver-fips, kaf, crossplane-provider-aws-lambda, seaweedfs, dapr-fips, kube-bench, livekit-cli, apm-server-fips, ollama, dockerize, crossplane-provider-aws-s3, scorecard, prometheus, nginx-prometheus-exporter-fips, etcd-fips, kubeflow-pipelines,...

GHSA-J5W8-Q4QC-RX2X vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver-fips, kaf, volcano, crossplane-provider-aws-lambda, seaweedfs, k8ssandra-client-fips, livekit-cli, apm-server-fips, dockerize, crossplane-provider-aws-s3, scorecard, prometheus, etcd-fips, kubeflow-pipelines, terraform-provider-google, k3d,...

CVE-2025-58181 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver-fips, kaf, volcano, crossplane-provider-aws-lambda, seaweedfs, k8ssandra-client-fips, livekit-cli, apm-server-fips, dockerize, crossplane-provider-aws-s3, scorecard, prometheus, etcd-fips, kubeflow-pipelines, terraform-provider-google, k3d,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: volume-modifier-for-k8s-fips, smarter-device-manager-fips, prometheus-stackdriver-exporter, up, kiam, prometheus-adapter-fips, spark-operator, slsa-verifier, kubernetes-csi-livenessprobe-fips, kubernetes-csi-livenessprobe, buildkitd, conftest-fips, kubescape,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, terraform-provider-sendgrid, kubeflow, slsa-verifier, src, scorecard, cortex, kubescape, kubevela, aactl, buildkitd, up, dgraph, k3d...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: haproxy-ingress, ip-masq-agent, ko, gitness, hugo, mc, k3d, bom, flux-source-controller, atlantis, pulumi-language-java, aactl, memcached-exporter, kubescape, kubernetes-csi-livenessprobe, amass, dynamic-localpv-provisioner, wireguard-go, aws-efs-csi-driver,...

Information Disclosure

github.com/hashicorp/terraform is vulnerable to information disclosure. The vulnerability exists when Terraform is configured to use AzureRM blob storage, and is authenticated using a SAS that does not require HTTPS, and if the AzureRM blob storage container allows HTTP connections. The token and...