AZL-87486 CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...

AZL-87888 CVE-2026-25680 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

AZL-87498 CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service...

AZL-87492 CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

AZL-87882 CVE-2026-25681 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Malicious Package

Overview knot-rspec-formatter-json is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: tigera-operator, kubeflow-katib, weaviate, flux-helm-controller, kserve-modelmesh-serving, cloud-provider-azure, kine, rancher-loglevel, spicedb-operator, terraform-provider-sendgrid, yunikorn-k8shim, timescaledb-parallel-copy, aws-s3-controller, kuberlr,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kubernetes-event-exporter, kubernetes-csi-driver-nfs, falcoctl, sftpgo, cloudnative-pg, kubeflow-katib, rancher-machine, opentelemetry-operator, weaviate, cloud-provider-aws, kube-arangodb, kubernetes-csi-livenessprobe, flux-helm-controller, terraform-provider-azurea...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: k8s-device-plugin, flux-source-controller, helm-exporter, k8sgpt-operator, kyverno-fips, cert-manager-google-cas-issuer, seaweedfs-operator, jaeger-fips, terraform-provider-time-fips, beats, caddy, cloud-provider-aws-fips, seaweedfs-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, k8sgpt-operator, gpu-operator, kyverno-fips, cert-manager-google-cas-issuer, seaweedfs-operator, jaeger-fips, git-sync, terraform-provider-time-fips, beats,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, k8sgpt-operator, gpu-operator, kyverno-fips, cert-manager-google-cas-issuer, seaweedfs-operator, jaeger-fips, git-sync, terraform-provider-time-fips, beats,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, k8sgpt-operator, gpu-operator, kyverno-fips, cert-manager-google-cas-issuer, seaweedfs-operator, jaeger-fips, git-sync, terraform-provider-time-fips, beats,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: flux-source-watcher, helm-exporter, gpu-operator, cluster-proportional-autoscaler-fips, howdy-yall, iptables-wrappers, mongodb-kubernetes-operator-fips, backup-restore-operator-fips, minc, jupyterhub-k8s-image-awaiter-fips, certificate-transparency,...

GHSA-GJVH-7JH8-7XHM vulnerabilities

Vulnerabilities for packages: flux-source-watcher, k8s-device-plugin, flux-source-controller, helm-exporter, k8sgpt-operator, gpu-operator, kyverno-fips, cert-manager-google-cas-issuer, seaweedfs-operator, jaeger-fips, git-sync, terraform-provider-time-fips, beats,...

CVE-2026-35461

Papra is a minimalistic document management and archiving platform. Prior to 26.4.0, the Papra webhook system allows authenticated users to register arbitrary URLs as webhook endpoints with no validation of the destination address. The server makes outbound HTTP POST requests to registered URLs,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: datadog-operator, falcoctl, sftpgo, hydra, secrets-store-csi-driver-provider-gcp, opentelemetry-operator, pulumi-kubernetes-operator, octo-sts, grafana-alloy, weaviate, cloud-provider-aws, k6, kube-arangodb, fluent-operator, grype, docker-compose,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: datadog-operator, falcoctl, sftpgo, hydra, secrets-store-csi-driver-provider-gcp, opentelemetry-operator, pulumi-kubernetes-operator, octo-sts, grafana-alloy, weaviate, cloud-provider-aws, k6, kube-arangodb, fluent-operator, grype, docker-compose,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: flux-source-controller, cluster-api-gcp-controller, kyverno-fips, jaeger-fips, beats, crossplane-provider-azure-streamanalytics, caddy, cloud-provider-aws-fips, crossplane-provider-azure-storagecache, vitess, seaweedfs-fips, ld-relay,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: flux-source-controller, cluster-api-gcp-controller, kyverno-fips, jaeger-fips, beats, crossplane-provider-azure-streamanalytics, caddy, cloud-provider-aws-fips, crossplane-provider-azure-storagecache, vitess, seaweedfs-fips, ld-relay,...