AZL-93147 CVE-2026-56852 affecting package cloud-provider-kubevirt for versions less than 0.5.1-6

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

AZL-93219 CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-63731

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...

EUVD-2026-46067

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to arbitrary internal destinations by supplying a caller-controlled host parameter to the ClickHouse proxy test endpoint with no URL validation or allowlist...

CVE-2026-15143

CVE-2026-15143 affects guardrails-detectors' file_type content detector. An attacker can supply an arbitrary XML Schema (XSD) string, processed without proper restrictions, enabling server-side requests to arbitrary URLs or local file reads and risking disclosure of sensitive information.

GHSA-XCGV-8MV7-V8C7 vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter, hubble, kots, kubernetes-fips, azurefile-csi-fips, elastic-agent-fips, eks-distro-fips, grype, k8s-device-plugin, redka, dapr-fips, external-secrets-operator-fips, dask-gateway, rekor-fips, vault-secrets-operator-fips, cert-manager,...

CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...

PYSEC-2026-771 Apache Airflow AWS Provider Generates Error Message Containing Sensitive Information

Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1...

PYSEC-2026-497 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

Summary PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: tekton-pipelines, prometheus-mongodb-exporter, vault, zot, tigera-operator, kots, kubernetes-fips, elastic-agent-fips, gitea, minio, external-secrets-operator-fips, cert-manager, trivy-fips, drone, vitess, k9s-fips, zarf, prometheus-elasticsearch-exporter,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: nfpm, crossplane-provider-aws-acm, tekton-pipelines, crossplane-provider-aws-firehose-fips, chainctl, crossplane-provider-aws-acm-fips, packer, tkn-fips, crossplane-provider-aws-kafkaconnect, crossplane-provider-aws-osis-fips, crossplane-provider-family-aws,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: argo-cd, atlantis, docker-cli-buildx, flux-image-automation-controller, buildah, falco-no-driver, splunk-otel-collector, wal-g, cilium-cli, act, trivy-operator, datadog-agent, aactl, gatus, step-kms-plugin, pulumi, skaffold, crossplane-provider-azure-managedidentity,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: kyverno, prometheus-operator, chisel, rancher, flux, telegraf, gitea, zarf, flux-image-automation-controller, falco-no-driver, argocd-image-updater, kaf, loki, rancher-agent, helm, mattermost, cilium-cli, containerd, zot, kubernetes-dashboard, trivy-operator, kine,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: argo-cd, docker-cli-buildx, flux-image-automation-controller, buildah, falco-no-driver, cilium-cli, act, trivy-operator, aactl, step-kms-plugin, pulumi, skaffold, cert-manager, gitlab-kas, osv-scanner, cloud-provider-aws, k9s, go-discover, kyverno, rancher,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: kyverno, prometheus-operator, rancher, flux, telegraf, docker-cli-buildx, buildah, kaf, falco-no-driver, podman, loki, rancher-agent, helm, mattermost, cilium-cli, containerd, zot, kubernetes-dashboard, kine, kubernetes, aactl, fscrypt, spire-server, istio,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, stunnerd, go-sqlcmd, cadvisor-fips, tekton-pipelines, datadog-operator-fips, node-problem-detector-fips, chainctl, crossplane-provider-gcp-beta-compute, k9s, crossplane-provider-aws-acm-fips, kong-ingress-controller-fips, eks-distro-fips, packer,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, stunnerd, go-sqlcmd, cadvisor-fips, tekton-pipelines, datadog-operator-fips, node-problem-detector-fips, chainctl, crossplane-provider-gcp-beta-compute, k9s, crossplane-provider-aws-acm-fips, kong-ingress-controller-fips, eks-distro-fips, packer,...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM Aspera Transfer Cluster Manager, faspex on Demand, Server on Demand, Application Platform on

Question Security Bulletin: Vulnerabilities in OpenSSL affect IBM Aspera Transfer Cluster Manager, faspex on Demand, Server on Demand, Application Platform on Demand, and Azure on Demand. CVE-2016-2107, CVE-2016-2106, CVE-2016-2176 "Business Unit":"code":"BU059","label":"IBM Software w/o...