267 matches found
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: ko, prometheus, fscrypt, osv-scanner, spire-server, snyk-cli, docker-machine-driver-harvester, knative-serving, flux-source-controller, pulumi-language-java, external-secrets-operator, apko, falcoctl, gitlab-kas, splunk-otel-collector, step-issuer, step-kms-plugin,...
GHSA-X527-X647-Q7GG vulnerabilities
Vulnerabilities for packages: prometheus, fscrypt, kubernetes-dashboard, osv-scanner, prometheus-operator, skaffold, snyk-cli, kaf, spire-server, istio, knative-serving, containerd, cilium, flux-source-controller, argocd-image-updater, flux, cilium-cli, chisel, external-secrets-operator, loki,...
GHSA-F5WC-C3C7-36MC vulnerabilities
Vulnerabilities for packages: prometheus, fscrypt, osv-scanner, spire-server, snyk-cli, docker-machine-driver-harvester, knative-serving, flux-source-controller, pulumi-language-java, external-secrets-operator, apko, gitlab-kas, step-issuer, step-kms-plugin, k3s, trivy-operator, witness,...
GHSA-JPPX-RXG9-JMRX vulnerabilities
Vulnerabilities for packages: prometheus, fscrypt, kubernetes-dashboard, prometheus-operator, spire-server, snyk-cli, kaf, docker-cli-buildx, istio, knative-serving, containerd, cilium, flux, cilium-cli, external-secrets-operator, loki, external-dns, gitlab-kas, kubernetes, k3s, kyverno,...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: skopeo-fips, commercial-expanso-edge, prometheus-podman-exporter, dkron, step-ca-fips, k8s-agents-operator, spire-server-fips, gatus-fips, temporal-fips, hubble-ui, beats-fips, crossplane-provider-azure-spring, verticadb-operator-fips, blob-csi-fips,...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: skopeo-fips, commercial-expanso-edge, prometheus-podman-exporter, dkron, step-ca-fips, k8s-agents-operator, spire-server-fips, gatus-fips, temporal-fips, hubble-ui, beats-fips, crossplane-provider-azure-spring, verticadb-operator-fips, blob-csi-fips,...
Security Bulletin: Vulnerabilities in OpenSSL affect IBM Aspera Transfer Cluster Manager, faspex on Demand, Server on Demand, Application Platform on
Question Security Bulletin: Vulnerabilities in OpenSSL affect IBM Aspera Transfer Cluster Manager, faspex on Demand, Server on Demand, Application Platform on Demand, and Azure on Demand. CVE-2016-2107, CVE-2016-2106, CVE-2016-2176 "Business Unit":"code":"BU059","label":"IBM Software w/o...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...
CVE-2026-25680 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
CVE-2026-25680 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...
CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...
CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...
CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4
CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...
CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4
CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...
CVE-2026-42506 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4
CVE-2026-42506 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...
PT-2026-45067
Summary CC-Tweaked's HTTP API http.request, http.websocket blocks requests to private network ranges to prevent server-side request forgery SSRF. This protection can be bypassed on IPv6-capable servers using NAT64 well-known prefix addresses 64:ff9b::/96. An attacker who can execute Lua code can...
