AZL-87873 CVE-2026-39821 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-87885 CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87876 CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87483 CVE-2026-42506 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87495 CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87891 CVE-2026-27136 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87489 CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87486 CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-87498 CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

AZL-87492 CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87888 CVE-2026-25680 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

AZL-87882 CVE-2026-25681 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Malicious Package

Overview knot-rspec-formatter-json is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: prometheus, fscrypt, spire-server, nri-couchbase, knative-serving, temporal, tigera-operator, kustomize, node-problem-detector, pulumi-language-java, kube-fluentd-operator, redka, helm-mapkubeapis, spqr, k3s, trillian, trivy-operator, x509-certificate-exporter,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: ko, bom, cloud-provider-azure, cluster-api-provider-vsphere, fscrypt, aws-flb-cloudwatch, kubernetes-dashboard-web, lvm-driver, osv-scanner, docker-machine-driver-harvester, prometheus, amazon-cloudwatch-agent-operator, authservice, snyk-cli, knative-serving, step-ca...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: commercial-expanso-edge, prometheus-podman-exporter, dkron, step-ca-fips, gatus-fips, hubble-ui, beats-fips, verticadb-operator-fips, k8s-metacollector-fips, crossplane-provider-aws-dynamodb-fips, blob-csi-fips, polaris-fips, eks-distro-fips, vexctl,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: commercial-expanso-edge, git-lfs-fips, nri-elasticsearch, prometheus-podman-exporter, stern, dkron, step-ca-fips, gatus-fips, k8s-driver-manager-fips, http-echo, gpu-operator-fips, hubble-ui, aws-privateca-issuer-fips, beats-fips, verticadb-operator-fips,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: commercial-expanso-edge, git-lfs-fips, nri-elasticsearch, prometheus-podman-exporter, stern, dkron, step-ca-fips, gatus-fips, k8s-driver-manager-fips, http-echo, gpu-operator-fips, hubble-ui, aws-privateca-issuer-fips, beats-fips, verticadb-operator-fips,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: commercial-expanso-edge, git-lfs-fips, nri-elasticsearch, prometheus-podman-exporter, stern, dkron, step-ca-fips, gatus-fips, k8s-driver-manager-fips, http-echo, gpu-operator-fips, hubble-ui, aws-privateca-issuer-fips, beats-fips, verticadb-operator-fips,...