GO-2024-2947 vulnerabilities

Vulnerabilities for packages: fulcio, policy-controller, rook, timestamp-authority, zarf, terragrunt, ksops, crossplane-provider-azure-authorization, opentelemetry-collector, crossplane-provider-azure-storage, flux-image-reflector-controller, skopeo, vexctl, gomplate, terraform-provider-azurerm,...

Malicious code in cdktn-provider-azurerm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, k8sgpt, crossplane-provider-aws-memorydb-fips, crossplane-provider-aws-athena, crossplane-fips, ko, fulcio, crossplane-provider-aws-ssm, mattermost-fips, cilium-cli, prometheus-podman-exporter-fips, crossplane-provider-aws-kafka-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: policy-controller, apko, opentofu, melange, ksops, crossplane-provider-azure-storage, pulumi-language-dotnet, gitlab-kas, splunk-otel-collector, kaf, snyk-cli, zot, docker-cli-buildx, kubernetes-dashboard, eksctl, atlantis, tflint, cilium-cli, flux, rootlesskit,...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: nri-nginx, k8sgpt, vertical-pod-autoscaler-fips, kratos, pguser, crossplane-fips, ko, temporal, terraform-provider-google, nats-server, nri-f5, prometheus-podman-exporter-fips, secrets-store-csi-driver-provider-azure-fips, cluster-api-aws-controller,...

GHSA-J5W8-Q4QC-RX2X vulnerabilities

Vulnerabilities for packages: k8sgpt, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, fulcio, flannel-fips, cephcsi-fips, terraform-provider-google, nats-server, mattermost-fips, cilium-cli, prometheus-podman-exporter-fips, cluster-api-aws-controller,...

CVE-2025-47914 vulnerabilities

Vulnerabilities for packages: step-issuer-fips, k8sgpt, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, ko, prometheus-bind-exporter, fulcio, flannel-fips, cephcsi-fips, temporal, terraform-provider-google, nats-server, mattermost-fips, cilium-cli,...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: step-issuer-fips, k8sgpt, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, ko, prometheus-bind-exporter, fulcio, flannel-fips, cephcsi-fips, temporal, terraform-provider-google, nats-server, mattermost-fips, cilium-cli,...

CVE-2025-58181 vulnerabilities

Vulnerabilities for packages: k8sgpt, crossplane-provider-aws-memorydb-fips, azure-workload-identity-webhook, fulcio, flannel-fips, cephcsi-fips, terraform-provider-google, nats-server, mattermost-fips, cilium-cli, prometheus-podman-exporter-fips, cluster-api-aws-controller,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, terraform-provider-sendgrid-fips, aws-efs-csi-driver-fips, kubernetes-csi-livenessprobe, slsa-verifier, falcoctl-fips, up, cortex, buildkitd, terraform-provider-sendgrid, src, vault-csi-provider, dgraph, scorecard, prometheus-adapter-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubevela, cortex, terraform-provider-sendgrid, up, buildkitd, spark-operator, kubescape, scorecard, src, slsa-verifier, dgraph, k3d, kubeflow, aactl...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nginx-mainline, sigstore-scaffolding, flux-helm-controller, pulumi-language-dotnet, grpcurl, gke-gcloud-auth-plugin, kaf, atlantis, dynamic-localpv-provisioner, kubeflow-katib, src, hugo, nghttp2, metacontroller, gitness, certificate-transparency, scorecard, hey,...

Information Disclosure

github.com/hashicorp/terraform is vulnerable to information disclosure. The vulnerability exists when Terraform is configured to use AzureRM blob storage, and is authenticated using a SAS that does not require HTTPS, and if the AzureRM blob storage container allows HTTP connections. The token and...