GO-2026-5973 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider, rke2-runtime, rke2-cloud-provider-fips, rke2-runtime-fips...

GO-2026-5973 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: tigera-operator, kubernetes-event-exporter, cloudnative-pg, govulncheck, kubeflow-katib, pulumi-kubernetes-operator, crossplane-provider-aws-cloudfront, octo-sts, grafana-alloy, cloud-provider-aws, skopeo, rancher-webhook, kubernetes-csi-livenessprobe, kuma,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: tigera-operator, secrets-store-csi-driver-provider-gcp, kubeflow-katib, pulumi-kubernetes-operator, grafana-alloy, weaviate, skopeo, flux-helm-controller, kserve-modelmesh-serving, cloud-provider-azure, minio, kine, k8sgpt, spicedb-operator,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: falcoctl, rancher-machine, rootlesskit, pulumi-kubernetes-operator, crossplane-provider-aws-cloudfront, cloud-provider-aws, grype, docker-compose, apko, kaf, minio, external-dns, spire-server, kine, act, argo-cd, gh, k8sgpt, sops, kots, terraform-provider-tls,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: nri-postgresql, kubernetes-event-exporter, kubernetes-csi-driver-nfs, hydra, govulncheck, kubeflow-katib, rancher-machine, crossplane-provider-aws-cloudfront, octo-sts, local-static-provisioner, cloud-provider-aws, kubernetes-dns-node-cache,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-nfs, falcoctl, kubeflow-katib, cni-plugins, grafana-alloy, amazon-cloudwatch-agent-operator, kyverno-notation-aws, nginx-prometheus-exporter, libnvidia-container, k8sgpt, undock, yunikorn-k8shim, kuberlr, aws-application-networking-k8s,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-gcp, kubeflow-katib, weaviate, skopeo, flux-helm-controller, minio, newrelic-nri-kube-events, kine, rancher-loglevel, k8sgpt, terraform-provider-sendgrid, yunikorn-k8shim, timescaledb-parallel-copy,...

AZL-95907 CVE-2026-73500 affecting package cloud-provider-kubevirt for versions less than 0.5.1-7

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

Malicious code in @servicetitan/examples (npm)

npm/@servicetitan/examples is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CVE-2026-67349 OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CVE-2026-67349

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELMVALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMINTOKEN is unset, allowing unauthenticated attackers to modify GCP servic...

CLEANSTART-2026-QS96651 Security fixes in cloud-provider-aws-1.34 1.34.1-r1

Package cloud-provider-aws-1.34 version 1.34.1-r1 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wnfv, ghsa-j5w8-q4qc-rx2x...

CVE-2026-56852 affecting package cloud-provider-kubevirt for versions less than 0.5.1-6

CVE-2026-56852 affecting package cloud-provider-kubevirt for versions less than 0.5.1-6. A patched version of the package is available...

CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7

CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7. A patched version of the package is available...

CVE-2026-54250 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider, rke2-runtime, rke2-cloud-provider-fips, rke2-runtime-fips...

GHSA-JXR7-MQHW-9P98 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider, rke2-runtime, rke2-cloud-provider-fips, rke2-runtime-fips...

GHSA-JXR7-MQHW-9P98 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider...

CVE-2026-54250 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: k3s, kyverno, openfga, tetragon, calico, spqr, datadog-operator, cluster-api-helm-controller, rancher-agent, kubescape, kube-state-metrics, cluster-api-azure-controller, metrics-server, opentelemetry-operator, pulumi-kubernetes-operator,...