GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: yunikorn-web, gobuster, kuberlr, ytt, kubeflow, glow, terraform-docs, iptables-wrappers, go-tools, kubevela, kustomize, docker-credential-ecr-login, rancher-telemetry, licenseclassifier, yunikorn-k8shim, protoc-gen-go, kafkaexporter, kube-metrics-adapter,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: thanos-operator, metrics-server, metacontroller, grpcurl, kubernetes-event-exporter, secrets-store-csi-driver, fscrypt, mods, yunikorn-web, hydra, kube-bench, dask-gateway, wire-go, gobuster, opentofu, terraform-provider-time, kubernetes-csi-external-attacher,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: thanos-operator, metrics-server, metacontroller, grpcurl, kubernetes-event-exporter, secrets-store-csi-driver, fscrypt, mods, yunikorn-web, hydra, kube-bench, dask-gateway, wire-go, gobuster, opentofu, terraform-provider-time, kubernetes-csi-external-attacher,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: thanos-operator, metrics-server, metacontroller, grpcurl, kubernetes-event-exporter, secrets-store-csi-driver, fscrypt, mods, yunikorn-web, hydra, kube-bench, dask-gateway, wire-go, gobuster, opentofu, terraform-provider-time, kubernetes-csi-external-attacher,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: thanos-operator, metrics-server, metacontroller, grpcurl, kubernetes-event-exporter, secrets-store-csi-driver, fscrypt, mods, yunikorn-web, hydra, kube-bench, dask-gateway, wire-go, gobuster, opentofu, terraform-provider-time, kubernetes-csi-external-attacher,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: thanos-operator, metrics-server, metacontroller, grpcurl, kubernetes-event-exporter, secrets-store-csi-driver, fscrypt, mods, yunikorn-web, hydra, kube-bench, dask-gateway, wire-go, gobuster, opentofu, terraform-provider-time, kubernetes-csi-external-attacher,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: metrics-server, metacontroller, grpcurl, kubernetes-event-exporter, secrets-store-csi-driver, fscrypt, mods, yunikorn-web, hydra, kube-bench, dask-gateway, wire-go, gobuster, opentofu, terraform-provider-time, kubernetes-csi-external-attacher,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: thanos-operator, metrics-server, metacontroller, grpcurl, kubernetes-event-exporter, secrets-store-csi-driver, fscrypt, mods, yunikorn-web, hydra, kube-bench, dask-gateway, wire-go, gobuster, opentofu, terraform-provider-time, kubernetes-csi-external-attacher,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: thanos-operator, metrics-server, metacontroller, grpcurl, kubernetes-event-exporter, secrets-store-csi-driver, fscrypt, mods, yunikorn-web, hydra, kube-bench, dask-gateway, wire-go, gobuster, opentofu, terraform-provider-time, kubernetes-csi-external-attacher,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: beats-fips, local-static-provisioner-fips, ko, licenseclassifier, terraform-provider-kubernetes-fips, dagdotdev, dive, yunikorn-k8shim, go-md2man, petname, rancher-security-scan, azure-container-networking, capslock, envconsul, prometheus-nats-exporter, cis-operator,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: beats-fips, local-static-provisioner-fips, ko, licenseclassifier, terraform-provider-kubernetes-fips, dagdotdev, dive, yunikorn-k8shim, go-md2man, petname, rancher-security-scan, azure-container-networking, capslock, envconsul, prometheus-nats-exporter, cis-operator,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: beats-fips, local-static-provisioner-fips, ko, licenseclassifier, terraform-provider-kubernetes-fips, dagdotdev, dive, yunikorn-k8shim, go-md2man, petname, rancher-security-scan, azure-container-networking, capslock, envconsul, prometheus-nats-exporter, cis-operator,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: beats-fips, local-static-provisioner-fips, ko, licenseclassifier, terraform-provider-kubernetes-fips, dagdotdev, dive, yunikorn-k8shim, go-md2man, petname, rancher-security-scan, azure-container-networking, capslock, envconsul, prometheus-nats-exporter, cis-operator,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: beats-fips, local-static-provisioner-fips, ko, licenseclassifier, terraform-provider-kubernetes-fips, dagdotdev, dive, yunikorn-k8shim, go-md2man, petname, rancher-security-scan, azure-container-networking, capslock, envconsul, prometheus-nats-exporter, cis-operator,...

AZL-69200 CVE-2025-58183 affecting package gh for versions less than 2.62.0-10

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

CVE-2025-54545 On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges...

CVE-2025-54545

CVE-2025-54545 is a local privilege-escalation in Arista DANZ Monitoring Fabric (DMF) and related products. A restricted user could break out of the CLI sandbox to the system shell, gaining elevated privileges. Arista’s Security Advisory 0124 confirms affected products across DMF, Converged Cloud...

CVE-2025-54545 On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges...

biome-text (3.3.0), elemeno-ai-sdk (>=0.0.8, <=0.2.4) +5 more potentially affected by CVE-2025-11200 via mlflow (1.20.2)

mlflow PYPI version 1.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text 3.3.0 - elemeno-ai-sdk =0.0.8, =0.0.1, =0.2.1.2, =0.1.5, =2.5.1a1, =0.0.1, =0.0.48 Source cves: CVE-2025-11200 Source advisory:...

CVE-2025-11202

win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists...