CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: flagger-fips, clickhouse-operator-fips, goose, crossplane-provider-aws-efs, ollama-fips, vault-secrets-operator, minify, terraform-provider-pagerduty-fips, newrelic-k8s-metadata-injection, k8s-device-plugin, redpanda, nri-mongodb, spire-controller-manager, restic,...

CVE-2025-11065 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26

CVE-2025-11065 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26. A patched version of the package is available...

CVE-2025-30204 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26

CVE-2025-30204 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26. A patched version of the package is available...

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the cloud providers API. An attacker can gain unauthorized access to cloud provider APIs and perform actions with attached cloud credentials by sending crafted requests through the proxy API...

Rancher cloud credentials can be used through proxy API by users without access

A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to communicate with cloud providers. Any Rancher user that was logged-in and aware o...

Insufficient Granularity of Access Control

Overview github.com/rancher/rancher/pkg/controllers/user/rbac is an open source project that provides a container management platform built for organizations that deploy containers in production. Rancher makes it easy to run Kubernetes everywhere, meet IT requirements, and empower DevOps teams...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: commercial-grafana, vitess, restic, gogatekeeper, livekit-server, containerd, prometheus-mongodb-exporter-fips, spicedb-operator, fluent-operator, knative-kafka-broker-fips, k8sgateway-fips, grype-fips, jaeger-operator, trufflehog-fips, jobset-fips,...

[SECURITY] Fedora 42 Update: rust-afterburn-5.10.0-3.fc42

A simple cloud provider agent...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: newrelic-k8s-metadata-injection, k8s-device-plugin, nri-mongodb, spire-controller-manager, restic, gogatekeeper, kubernetes-csi-driver-nfs, aws-flb-firehose, amazon-cloudwatch-agent-operator, containerd, crossplane-provider-aws-elasticache, kots,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: wazero, minify, newrelic-k8s-metadata-injection, k8s-device-plugin, nri-mongodb, spire-controller-manager, restic, gogatekeeper, kubernetes-csi-driver-nfs, aws-flb-firehose, amazon-cloudwatch-agent-operator, containerd, crossplane-provider-aws-elasticache, kots,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: wazero, minify, newrelic-k8s-metadata-injection, k8s-device-plugin, nri-mongodb, spire-controller-manager, restic, gogatekeeper, kubernetes-csi-driver-nfs, aws-flb-firehose, amazon-cloudwatch-agent-operator, containerd, crossplane-provider-aws-elasticache, kots,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: flagger-fips, clickhouse-operator-fips, goose, amazon-ssm-agent, vault-secrets-operator, wazero, minify, terraform-provider-pagerduty-fips, newrelic-k8s-metadata-injection, k8s-device-plugin, redpanda, nri-mongodb, crossplane-provider-keycloak-fips,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: flagger-fips, clickhouse-operator-fips, goose, amazon-ssm-agent, vault-secrets-operator, wazero, minify, terraform-provider-pagerduty-fips, newrelic-k8s-metadata-injection, k8s-device-plugin, redpanda, nri-mongodb, crossplane-provider-keycloak-fips,...

[SECURITY] Fedora 43 Update: rust-afterburn-5.10.0-3.fc43

A simple cloud provider agent...

AZL-77010 CVE-2025-58190 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76889 CVE-2025-58190 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76886 CVE-2025-47911 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: rancher-loglevel, spegel, authservice, kubernetes-dashboard-metrics-scraper, terraform-provider-pagerduty, timescaledb-parallel-copy, gobuster, kubo, eksctl, frp, goreleaser, apache-exporter, restic, gogatekeeper, kubernetes-csi-driver-nfs, blobfuse2,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: wazero, nri-mongodb, spire-controller-manager, restic, gogatekeeper, kubernetes-csi-driver-nfs, crossplane-provider-aws-elasticache, amazon-cloudwatch-agent-operator, docker-machine-driver-linode, neuvector-sigstore-interface, newrelic-nri-statsd, amass, flannel,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: wazero, nri-mongodb, spire-controller-manager, restic, gogatekeeper, kubernetes-csi-driver-nfs, crossplane-provider-aws-elasticache, amazon-cloudwatch-agent-operator, docker-machine-driver-linode, neuvector-sigstore-interface, newrelic-nri-statsd, amass, flannel,...