GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: kbld, certificate-transparency, configmap-reload, rancher-telemetry, thanos-operator, kubernetes-csi-driver-hostpath, etcd, promxy, conjur-cli, jitsucom-bulker, mongo-tools, pvc-autoresizer, aws-s3-controller, terraform-provider-kubernetes, ctop, contour, falcoctl,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: kbld, certificate-transparency, configmap-reload, rancher-telemetry, thanos-operator, kubernetes-csi-driver-hostpath, etcd, promxy, conjur-cli, jitsucom-bulker, mongo-tools, pvc-autoresizer, aws-s3-controller, terraform-provider-kubernetes, ctop, contour, falcoctl,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: kbld, certificate-transparency, configmap-reload, rancher-telemetry, kubernetes-csi-driver-hostpath, etcd, promxy, conjur-cli, jitsucom-bulker, mongo-tools, pvc-autoresizer, aws-s3-controller, terraform-provider-kubernetes, ctop, contour, falcoctl, amass, govulncheck...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: kbld, certificate-transparency, configmap-reload, rancher-telemetry, thanos-operator, kubernetes-csi-driver-hostpath, etcd, promxy, conjur-cli, jitsucom-bulker, mongo-tools, pvc-autoresizer, aws-s3-controller, terraform-provider-kubernetes, ctop, contour, falcoctl,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: kbld, certificate-transparency, configmap-reload, rancher-telemetry, thanos-operator, kubernetes-csi-driver-hostpath, etcd, promxy, conjur-cli, jitsucom-bulker, mongo-tools, pvc-autoresizer, aws-s3-controller, terraform-provider-kubernetes, ctop, contour, falcoctl,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: kbld, certificate-transparency, configmap-reload, rancher-telemetry, thanos-operator, kubernetes-csi-driver-hostpath, etcd, promxy, conjur-cli, jitsucom-bulker, mongo-tools, pvc-autoresizer, aws-s3-controller, terraform-provider-kubernetes, ctop, contour, falcoctl,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: kbld, certificate-transparency, configmap-reload, rancher-telemetry, thanos-operator, kubernetes-csi-driver-hostpath, etcd, promxy, conjur-cli, jitsucom-bulker, mongo-tools, pvc-autoresizer, aws-s3-controller, terraform-provider-kubernetes, ctop, contour, falcoctl,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: skopeo-fips, etcd-fips, falco-exporter, nova-fips, kpt, cloud-provider-gcp-cloud-controller-manager-fips, linkerd2-cni-plugin, mongo-tools, docker-credential-ecr-login, prometheus-process-exporter, argo-rollouts-fips, velero-plugin-for-microsoft-azure-fips,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: skopeo-fips, etcd-fips, falco-exporter, nova-fips, kpt, cloud-provider-gcp-cloud-controller-manager-fips, linkerd2-cni-plugin, mongo-tools, docker-credential-ecr-login, prometheus-process-exporter, argo-rollouts-fips, velero-plugin-for-microsoft-azure-fips,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: skopeo-fips, etcd-fips, falco-exporter, nova-fips, kpt, cloud-provider-gcp-cloud-controller-manager-fips, linkerd2-cni-plugin, mongo-tools, docker-credential-ecr-login, prometheus-process-exporter, argo-rollouts-fips, velero-plugin-for-microsoft-azure-fips,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: skopeo-fips, etcd-fips, falco-exporter, nova-fips, kpt, cloud-provider-gcp-cloud-controller-manager-fips, linkerd2-cni-plugin, mongo-tools, docker-credential-ecr-login, prometheus-process-exporter, argo-rollouts-fips, velero-plugin-for-microsoft-azure-fips,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: skopeo-fips, etcd-fips, falco-exporter, nova-fips, kpt, cloud-provider-gcp-cloud-controller-manager-fips, linkerd2-cni-plugin, mongo-tools, docker-credential-ecr-login, prometheus-process-exporter, argo-rollouts-fips, velero-plugin-for-microsoft-azure-fips,...

AZL-69200 CVE-2025-58183 affecting package gh for versions less than 2.62.0-10

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a...

CVE-2025-54545 On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges...

CVE-2025-54545 On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges...

CVE-2025-54545

CVE-2025-54545 is a local privilege-escalation in Arista DANZ Monitoring Fabric (DMF) and related products. A restricted user could break out of the CLI sandbox to the system shell, gaining elevated privileges. Arista’s Security Advisory 0124 confirms affected products across DMF, Converged Cloud...

CVE-2025-11202

win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-11202 win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability

win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-11202 win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability

win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2025-11202

CVE-2025-11202 relates to win-cli-mcp-server. The issue is in the resolveCommandPath function where a user-supplied string is used to invoke a system call without proper validation, enabling a remote command execution (RCE). The exploit is unauthenticated and would execute code in the service acc...