CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: opencost, crossplane-provider-aws-route53, cloudflared, vitess, argocd-image-updater, k6, mesosphere-vsphere-csi, external-secrets-operator, azuredisk-csi, cloud-provider-azure, dagger, crossplane-provider-aws-lambda, envoy-ratelimit, goreleaser,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: opencost, crossplane-provider-aws-route53, cloudflared, vitess, argocd-image-updater, k6, mesosphere-vsphere-csi, external-secrets-operator, azuredisk-csi, cloud-provider-azure, dagger, crossplane-provider-aws-lambda, envoy-ratelimit, goreleaser,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: gitlab-cng, cyberark-secrets-provider-for-k8s, haproxy-ingress, cerbos-fips, ratify-fips, crossplane-provider-azure-servicefabric, kubernetes-csi-external-health-monitor, chainloop-cli-fips, prometheus-mongodb-exporter-fips, cass-operator-fips-no-pvc-delete,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: gitlab-cng, cyberark-secrets-provider-for-k8s, haproxy-ingress, cerbos-fips, ratify-fips, crossplane-provider-azure-servicefabric, kubernetes-csi-external-health-monitor, chainloop-cli-fips, prometheus-mongodb-exporter-fips, cass-operator-fips-no-pvc-delete,...

CVE-2026-34719

CVE-2026-34719 affects Zammad. The vulnerability is a server-side request forgery (SSRF) in the webhook model. Before 7.0.1 and 6.5.4, the webhook validation only checked the URL scheme and hostname, missing proper validation for loopback and link-local addresses, enabling potential access to con...

Zammad 代码问题漏洞

Zammad is a ticketing management software developed by the German company Zammad. Versions of Zammad prior to 7.0.1 and 6.5.4 contained code vulnerabilities. These vulnerabilities stemmed from the Webhook model’s lack of validation for loopback addresses, which could lead to the retrieval of...

CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network service...

PT-2026-28586

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev97 Description pyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network...

CVE-2026-33226

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint POST /api/queries/preview makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An...

CVE-2025-47911 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5

CVE-2025-47911 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5. A patched version of the package is available...

CVE-2025-47911 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3

CVE-2025-47911 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3. A patched version of the package is available...

CVE-2025-58190 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3

CVE-2025-58190 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3. A patched version of the package is available...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: promxy, opencost, crossplane-provider-aws-route53, cloudflared, argocd-image-updater, spqr, mesosphere-vsphere-csi, external-secrets-operator, azuredisk-csi, crossplane-provider-aws-cloudfront, crossplane-provider-aws-lambda, secrets-store-csi-driver,...

CVE-2026-27142 vulnerabilities

Vulnerabilities for packages: promxy, opencost, crossplane-provider-aws-route53, cloudflared, argocd-image-updater, spqr, mesosphere-vsphere-csi, external-secrets-operator, azuredisk-csi, crossplane-provider-aws-cloudfront, crossplane-provider-aws-lambda, secrets-store-csi-driver,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-web, cerbos-fips, flux-image-reflector-controller-fips, vault-fips, temporal-ui-server-fips, karpenter, kubernetes-csi-external-health-monitor, net-kourier-fips, prometheus-mongodb-exporter-fips, cass-operator-fips-no-pvc-delete, falco-no-driver,...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: secretgen-controller, kubernetes-dashboard-web, cerbos-fips, nfpm, flux-image-reflector-controller-fips, ratify-fips, vault-fips, temporal-ui-server-fips, ipfs-cluster-fips, aws-sigv4-proxy, karpenter, kubernetes-csi-external-health-monitor, net-kourier-fips,...

CVE-2025-30204 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26

CVE-2025-30204 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26. A patched version of the package is available...

CVE-2025-11065 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26

CVE-2025-11065 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26. A patched version of the package is available...

Rancher cloud credentials can be used through proxy API by users without access

A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to communicate with cloud providers. Any Rancher user that was logged-in and aware o...

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the cloud providers API. An attacker can gain unauthorized access to cloud provider APIs and perform actions with attached cloud credentials by sending crafted requests through the proxy API...