Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to insufficient peer verification logic in the verifyPeerCert function. An attacker can impersonate privileged API components and execute unauthorized operations by compromising a single instance and...

CERTFR-2025-ACT-047

creationtimestamp| type| source ---|---|--- 2025-11-03 16:12:14+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m4qfxb3xoc2q 2025-11-03 16:12:17+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115486643525731176 2025-11-03 17:03:15+00:00| seen|...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: fq, hello-world-golang, kpt, sbom-convert, oras, metacontroller, guac, docker-credential-ecr-login, ytt, hydra, prometheus-operator, docker-cli-buildx, runc, argo-rollouts, git-credential-oauth, otel-cli, kapp, go-md2man, wave, dask-gateway, nodetaint,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

CVE-2025-58187 vulnerabilities

Vulnerabilities for packages: fq, hello-world-golang, kpt, sbom-convert, oras, metacontroller, guac, docker-credential-ecr-login, ytt, hydra, prometheus-operator, docker-cli-buildx, runc, argo-rollouts, git-credential-oauth, otel-cli, kapp, go-md2man, wave, dask-gateway, nodetaint,...

CVE-2025-61725 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-7WWX-XJ66-R44X vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-push,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: terraform-provider-kubernetes, fq, cert-manager-cmctl, pvc-autoresizer, mkcert, kustomize, tfsec, nova, vault-k8s, hello-world-golang, slsa-verifier, crossplane, kpt, prometheus-adapter, timestamp-authority, falcosidekick, sbom-convert, oras, metacontroller, helm-pus...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: chartmuseum, wire-go, gatekeeper-fips, distribution-fips, packer, cluster-api-helm-controller, karpenter, kuberlr, stampdalf, azurefile-csi, cilium, aws-sigv4-proxy, terraform-provider-tls-fips, redka, kpt, kube-metrics-adapter, scuttle,...