WordPress CDI <5.1.9 - Cross Site Scripting

WordPress CDI plugin prior to 5.1.9 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response of an AJAX action. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

GO-2024-3305 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent-operator-fips, vault, pulumi, promxy, amazon-ecs-agent-fips, amazon-cloudwatch-agent-operator, rancher-agent, kubevela, prometheus, harvester-fips, rke2-runtime, k3s, rancher, amazon-ecs-agent, kubevirt-cdi-uploadserver, harvester...

GO-2025-3829 vulnerabilities

Vulnerabilities for packages: lazydocker, xeol, harbor-scanner-trivy-fips, gatekeeper, portieris, helm-mapkubeapis, bento, cluster-api-helm-controller, promxy, cluster-api-helm-controller-fips, cluster-api, opentelemetry-operator, gitlab-rails-ce-fips, newrelic-infrastructure-agent, falcoctl,...

CVE-2026-17527 Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

In containerized-data-importer CDI, the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authoriz...

AZL-90170 CVE-2026-53492 affecting package containerd2 for versions less than 2.2.4-3

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

CVE-2026-53492

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

CVE-2026-53492: Improper Input Validation

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

Important: containerd

Issue Overview: Memory exhaustion DoS causing OOM kill of containerd process NOTE: https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq CVE-2026-47262 Image cache poisoning via unvalidated checkpoint image references, enabling cross-pod code execution NOTE:...

Containerd 2.1.x < 2.1.9 / 2.2.x < 2.2.5 / 2.3.x < 2.3.2 Multiple Vulnerabilities

The version of Containerd on the remote host is 2.1.x prior to 2.1.9, 2.2.x prior to 2.2.5, or 2.3.x prior to 2.3.2. It is, therefore, affected by multiple vulnerabilities: - containerd's CRI checkpoint import process contains a vulnerability where it fails to validate the image references...

CVE-2026-53492

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatchevents, cephcsi, flux-helm-controller, cluster-api, crossplane-provider-aws-lambda-fips, crossplane-provider-aws-sqs-fips, crossplane-provider-aws-s3-fips, crossplane-provider-aws-sns-fips, k3d, vexctl, argocd-image-updater,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis, aws-fsx-csi-driver-fips, cephcsi, gitsign, goose, langfuse-fips, otel-cli, flux-helm-controller, snyk-cli, cluster-api, ytt, gpu-operator-fips, k8ssandra-operator, flux-operator-fips, kafka-proxy, crossplane-provider-aws-lambda-fips,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: cephcsi, gitsign, snyk-cli, sqlexporter, flux-operator-fips, gotrue, neuvector-sigstore-interface, dagdotdev, policy-controller-fips, k3d, vexctl, istio-fips, syft, sqlexporter-fips, falcoctl-fips, cert-manager-istio-csr, goreleaser, crossplane-provider-gcp-fips,...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to an error in the protocol implementation when handling the User Supplied Secret USS digest in the LoadApp function. An attacker can cause the Compound Device Identifier CDI to b...

Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, cont

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.64.0 Release notes...

SUSE-SU-2026:0571-1 Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: Update to version 1.64.0 - Release notes...

CVE-2025-14459

A flaw was found in KubeVirt Containerized Data Importer CDI. This vulnerability allows a user to clone PersistentVolumeClaims PVCs from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism...

CVE-2025-14459: Authorization Bypass Through User-Controlled Key

A flaw was found in KubeVirt Containerized Data Importer CDI. This vulnerability allows a user to clone PersistentVolumeClaims PVCs from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism...

CVE-2025-55307

An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to search.query with a crafted cDIPath parameter e.g., "/" may cause an out-of-bounds read in internal path-parsing logic, potentially leadi...

CVE-2025-55307

An out-of-bounds read vulnerability exists in Foxit PDF and Editor for Windows (versions before 13.2 and 2025 before 2025.2 ) due to a flaw in internal path-parsing logic. This issue can be triggered by opening a malicious PDF file containing a crafted JavaScript call to search.query() with a spe...