CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: s5cmd, lazydocker, kubeflow, vale, local-path-provisioner, regclient, php-fpmexporter, cilium-cli, omnibump, crossplane-provider-azure-sql, azure-workload-identity-webhook, percona-server-mongodb-operator, nri-mysql, crossplane-provider-azure-authorization,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: aws-flb-cloudwatch, lazydocker, cerbos, neuvector-scanner, apisix-ingress-controller, crossplane-provider-family-azure, vault-benchmark, golangci-lint, vault-env, terraform-provider-time, kubernetes-csi-external-attacher, secrets-store-csi-driver, argo-events,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: terraform-provider-databricks-fips, kubernetes-dashboard-auth, virt-controller, crossplane-provider-aws-acm, tekton-pipelines, crossplane-provider-aws-kinesis-fips, etcd-fips, chronyexporter-fips, kube-arangodb, flux-fips, crossplane-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, terraform-provider-databricks-fips, aws-sigv4-proxy, kubernetes-dashboard-auth, virt-controller, crossplane-provider-aws-acm, kubernetes-secret-generator, tekton-pipelines, crossplane-provider-aws-kinesis-fips, etcd-fips, chronyexporter-fips,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, terraform-provider-databricks-fips, aws-sigv4-proxy, kubernetes-dashboard-auth, virt-controller, crossplane-provider-aws-acm, kubernetes-secret-generator, tekton-pipelines, crossplane-provider-aws-kinesis-fips, etcd-fips, chronyexporter-fips,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, terraform-provider-databricks-fips, aws-sigv4-proxy, kubernetes-dashboard-auth, virt-controller, crossplane-provider-aws-acm, kubernetes-secret-generator, tekton-pipelines, crossplane-provider-aws-kinesis-fips, etcd-fips, chronyexporter-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: terraform-provider-databricks-fips, virt-controller, kubernetes-secret-generator, chronyexporter-fips, nri-nginx-fips, grafana-agent-operator, velero-plugin-for-aws-fips, zot, lvm-driver, chart-testing-fips, gomplate-fips, aws-flb-cloudwatch-fips, kubescape-server,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, terraform-provider-databricks-fips, aws-sigv4-proxy, kubernetes-dashboard-auth, virt-controller, crossplane-provider-aws-acm, kubernetes-secret-generator, tekton-pipelines, crossplane-provider-aws-kinesis-fips, etcd-fips, chronyexporter-fips,...

CVE-2026-35461

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: rancher-webhook, crossplane-provider-aws-elasticache, grafana-image-renderer, lazydocker, cerbos, apisix-ingress-controller, crossplane-provider-family-azure, kubo, thanos, crossplane-provider-aws-firehose, kapp, vault-env, opa, kubernetes-csi-external-attacher,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: rancher-webhook, crossplane-provider-aws-elasticache, grafana-image-renderer, lazydocker, cerbos, apisix-ingress-controller, crossplane-provider-family-azure, kubo, thanos, crossplane-provider-aws-firehose, kapp, vault-env, opa, kubernetes-csi-external-attacher,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: thanos, volsync-fips, ratify, terraform-provider-databricks-fips, crossplane-provider-aws-acm, tekton-pipelines, melange, crossplane-provider-aws-kinesis-fips, etcd-fips, kapp-controller, kube-arangodb, flux-fips, metrics-server,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: thanos, volsync-fips, ratify, terraform-provider-databricks-fips, crossplane-provider-aws-acm, tekton-pipelines, melange, crossplane-provider-aws-kinesis-fips, etcd-fips, kapp-controller, kube-arangodb, flux-fips, metrics-server,...

CVE-2026-34719

CVE-2026-34719 affects Zammad. The vulnerability is a server-side request forgery (SSRF) in the webhook model. Before 7.0.1 and 6.5.4, the webhook validation only checked the URL scheme and hostname, missing proper validation for loopback and link-local addresses, enabling potential access to con...

Zammad 代码问题漏洞

Zammad is a ticketing management software developed by the German company Zammad. Versions of Zammad prior to 7.0.1 and 6.5.4 contained code vulnerabilities. These vulnerabilities stemmed from the Webhook model’s lack of validation for loopback addresses, which could lead to the retrieval of...

CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network service...

PT-2026-28586

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev97 Description pyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network...

CVE-2026-33226

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint POST /api/queries/preview makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An...

CVE-2025-58190 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3

CVE-2025-58190 affecting package cloud-provider-kubevirt for versions less than 0.5.1-3. A patched version of the package is available...

CVE-2025-47911 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5

CVE-2025-47911 affecting package kube-vip-cloud-provider for versions less than 0.0.10-5. A patched version of the package is available...