CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-56852 affecting package cloud-provider-kubevirt for versions less than 0.5.1-6

CVE-2026-56852 affecting package cloud-provider-kubevirt for versions less than 0.5.1-6. A patched version of the package is available...

CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7

CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7. A patched version of the package is available...

CVE-2026-54250 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider-fips, rke2-cloud-provider...

GHSA-JXR7-MQHW-9P98 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider-fips, rke2-cloud-provider...

CVE-2026-54250 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider...

GHSA-JXR7-MQHW-9P98 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: cert-manager, cass-operator, external-secrets-operator, cert-manager-istio-csr, cloud-provider-gcp-cloud-controller-manager, cluster-api-ipam-provider-in-cluster, gitlab-kas, kubernetes-csi-external-snapshotter, metrics-server, rancher-agent, grafana, spqr,...

CVE-2026-15143

CVE-2026-15143 affects guardrails-detectors' file_type content detector. An attacker can supply an arbitrary XML Schema (XSD) string, processed without proper restrictions, enabling server-side requests to arbitrary URLs or local file reads and risking disclosure of sensitive information.

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: grype-fips, fleet-server, karpenter-fips, etcd, k8s-device-plugin, rekor, net-kourier-fips, karpenter, snyk-cli, kube-fluentd-operator, commercial-spilo, elastic-agent-fips, flux-source-watcher-fips, containerd, frankenphp-8.3, kine, grafana, terraform,...

CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

PYSEC-2026-771 Apache Airflow AWS Provider Generates Error Message Containing Sensitive Information

Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1...

PYSEC-2026-497 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: skaffold, coder-fips, etcd, snyk-cli, flux-source-controller-fips, flux-source-controller, elastic-agent-fips, containerd, frankenphp-8.3, fscrypt, kine, terraform, mattermost-fips, nerdctl, seaweedfs-rocksdb-fips, external-dns, gitlab-kas, reports-server,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: step, external-secrets-fips, peerdb-flow, flux-source-controller-fips, crossplane-provider-azure-synapse, docker-compose-fips, kueue-fips, fscrypt, syft-fips, crossplane-provider-aws-emr, nerdctl, step-kms-plugin, crossplane-provider-aws-route53,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: cert-manager, cosign, rootlesskit, external-dns, grype, eksctl, kubernetes, openbao, zot, gitea, pulumi-language-dotnet, tekton-chains, k3s, docker-machine-driver-harvester, syft, gomplate, spire-server, cilium-cli, crossplane-provider-azure-authorization,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: skaffold, cert-manager, flux-source-controller, gitlab-kas, flux-image-automation-controller, fscrypt, containerd, external-dns, rancher, kots, knative-serving, flux, kubernetes, mattermost, zarf, cloud-provider-aws, zot, gitea, kine, k3s, kyverno, osv-scanner, trivy...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: cert-manager, external-dns, grype, kubernetes, openbao, zot, gitea, pulumi-language-dotnet, k3s, docker-machine-driver-harvester, syft, gomplate, spire-server, cilium-cli, caddy, opentofu, terragrunt, trivy-operator, nerdctl, minio, act, gitlab-kas, buildah,...