EUVD-2023-58468

Malicious code in bioql PyPI...

EUVD-2024-3170

Malicious code in bioql PyPI...

GHSA-227X-7MH8-3CF6 Gardener provider extensions vulnerable to code injection when Terraform is used for infrastructure provisioning

Impact A security vulnerability was discovered in Gardener when Terraformer is used for infrastructure provisioning. This vulnerability could allow a user with administrative privileges for a Gardener project to obtain control over the seed cluster where the shoot cluster is managed. This CVE...

GHSA-R3JV-XFGX-GJ24 cors-anywhere vulnerable to server-side request forgery

Rob -- W / cors-anywhere instances configured as an open proxy allow unauthenticated external users to induce the server to make HTTP requests to arbitrary targets SSRF. Because the proxy forwards requests and headers, an attacker can reach internal-only endpoints and link-local metadata services...

CVE-2025-59823 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: etcd-fips, newrelic-fluent-bit-output, kserve-rest-proxy, nvidia-nsight-compute-13.0, wazero-fips, nats, kubeflow-katib, kubernetes-dashboard-fips, linkerd2-proxy-init, prometheus-beat-exporter-fips, pvc-autoresizer, docker-credential-ecr-login,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: etcd-fips, newrelic-fluent-bit-output, kserve-rest-proxy, nvidia-nsight-compute-13.0, wazero-fips, nats, kubeflow-katib, kubernetes-dashboard-fips, linkerd2-proxy-init, prometheus-beat-exporter-fips, pvc-autoresizer, docker-credential-ecr-login,...

GHSA-RCW7-PQFP-735X secrets-store-sync-controller discloses service account tokens in logs

Hello Kubernetes Community, A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vau...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: skopeo-fips, helm-operator, falco-exporter, newrelic-fluent-bit-output, terragrunt, cerbos-fips, eck-operator, cloudnative-pg, nova-fips, kpt, crossplane-provider-azure, mongo-tools, sbomqs, argo-rollouts-fips, beats, pdfcpu, kube-logging-logging-operator,...

SUSE CVE-2025-47284

Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the gardenlet component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user with administrative privileges for a...

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4. A patched version of the package is available...

CVE-2024-51744 affecting package kube-vip-cloud-provider for versions less than 0.0.2-22

CVE-2024-51744 affecting package kube-vip-cloud-provider for versions less than 0.0.2-22. A patched version of the package is available...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: glab, kaniko, minio, trivy, aactl, jitsucom-bulker, mongo-tools, promxy, falcoctl, opentelemetry-operator, crossplane-provider-family-azure, grafana-alloy, velero, flux-image-reflector-controller, fulcio, restic, sqlexporter, timestamp-authority, zot, k3s, cortex,...

GHSA-MH63-6H87-95CP vulnerabilities

Vulnerabilities for packages: glab, kaniko, minio, trivy, aactl, jitsucom-bulker, mongo-tools, promxy, falcoctl, opentelemetry-operator, crossplane-provider-family-azure, grafana-alloy, velero, flux-image-reflector-controller, fulcio, restic, sqlexporter, timestamp-authority, zot, k3s, cortex,...

CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20

CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20. A patched version of the package is available...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: configmap-reload, thanos-operator, cass-operator, promxy, nri-f5, k9s, shfmt, esbuild, minify, cloudnative-pg, cni-plugins, flux-helm-controller, flux-kustomize-controller, velero-plugin-for-microsoft-azure, gostatsd, kubewatch, aws-flb-kinesis, mods, oras, xcaddy,...

[SECURITY] Fedora 40 Update: rust-afterburn-5.7.0-3.fc40

A simple cloud provider agent...

[SECURITY] Fedora 41 Update: rust-afterburn-5.7.0-3.fc41

A simple cloud provider agent...

CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3

CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3. A patched version of the package is available...

The vulnerabilities of vSphere CPI (Cloud Provider Interface) and vSphere CSI (Container Storage Interface), which are software platforms for deploying containers in a production environment, allow attackers to exploit them to disclose sensitive information.

The vulnerability of vSphere CPI Cloud Provider Interface and vSphere CSI Container Storage Interface, two components of the software platform for container deployment in a production environment, is related to insufficient protection of registration data. Exploiting this vulnerability can allow ...