AZL-76886 CVE-2025-47911 affecting package cloud-provider-kubevirt 0.5.1-2

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: kube-arangodb, lvm-driver, thanos-operator, guac, stakater-reloader, grafana-rollout-operator, dockerize, spqr, kubernetes-csi-driver-nfs, nfs-subdir-external-provisioner, crossplane-provider-aws-kinesis, db-operator, kubernetes-csi-driver-hostpath,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: thanos-operator, nfs-subdir-external-provisioner, db-operator, ipfs-cluster, vault-secrets-webhook, sftpgo-plugin-pubsub, minio-object-browser, kubeflow, pgtimetable, cosign, helm-operator, crossplane-provider-sql, gitlab-runner, kube-logging-operator-custom-runner,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: thanos-operator, nfs-subdir-external-provisioner, db-operator, ipfs-cluster, vault-secrets-webhook, sftpgo-plugin-pubsub, minio-object-browser, kubeflow, pgtimetable, cosign, helm-operator, crossplane-provider-sql, gitlab-runner, kube-logging-operator-custom-runner,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: thanos-operator, nfs-subdir-external-provisioner, db-operator, ipfs-cluster, vault-secrets-webhook, sftpgo-plugin-pubsub, minio-object-browser, kubeflow, pgtimetable, cosign, helm-operator, crossplane-provider-sql, gitlab-runner, kube-logging-operator-custom-runner,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: kube-arangodb, lvm-driver, thanos-operator, guac, stakater-reloader, grafana-rollout-operator, dockerize, spqr, kubernetes-csi-driver-nfs, nfs-subdir-external-provisioner, crossplane-provider-aws-kinesis, db-operator, rabbitmq-cluster-operator, gitleaks, ratify,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: kube-arangodb, lvm-driver, thanos-operator, guac, stakater-reloader, grafana-rollout-operator, dockerize, spqr, kubernetes-csi-driver-nfs, nfs-subdir-external-provisioner, crossplane-provider-aws-kinesis, db-operator, kubernetes-csi-driver-hostpath,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: traefik, nfs-subdir-external-provisioner-fips, sftpgo-plugin-kms, cilium-envoy, dex, crossplane-provider-gcp, falco-no-driver, kuma, spilo, tetragon-fips, agentbeat, grafana-operator-fips, prometheus-statsd-exporter-fips, docker-credential-gcr, kafka-proxy-fips,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: traefik, nfs-subdir-external-provisioner-fips, sftpgo-plugin-kms, cilium-envoy, dex, crossplane-provider-gcp, falco-no-driver, kuma, spilo, tetragon-fips, agentbeat, grafana-operator-fips, prometheus-statsd-exporter-fips, docker-credential-gcr, kafka-proxy-fips,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: traefik, rancher-security-scan, nfs-subdir-external-provisioner-fips, sftpgo-plugin-kms, cilium-envoy, dex, crossplane-provider-gcp, falco-no-driver, buildtools-fips, kuma, spilo, tetragon-fips, agentbeat, grafana-operator-fips, nri-cassandra,...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: traefik, rancher-security-scan, nfs-subdir-external-provisioner-fips, sftpgo-plugin-kms, dex, crossplane-provider-gcp, buildtools-fips, kuma, spilo, tetragon-fips, grafana-operator-fips, nri-cassandra, prometheus-statsd-exporter-fips, docker-credential-gcr,...

CVE-2025-61731 vulnerabilities

Vulnerabilities for packages: traefik, rancher-security-scan, nfs-subdir-external-provisioner-fips, sftpgo-plugin-kms, cilium-envoy, dex, crossplane-provider-gcp, falco-no-driver, buildtools-fips, kuma, spilo, tetragon-fips, agentbeat, grafana-operator-fips, nri-cassandra,...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: traefik, nfs-subdir-external-provisioner-fips, sftpgo-plugin-kms, cilium-envoy, dex, crossplane-provider-gcp, falco-no-driver, kuma, spilo, tetragon-fips, agentbeat, grafana-operator-fips, prometheus-statsd-exporter-fips, docker-credential-gcr, kafka-proxy-fips,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: traefik, rancher-security-scan, nfs-subdir-external-provisioner-fips, sftpgo-plugin-kms, dex, crossplane-provider-gcp, buildtools-fips, kuma, spilo, tetragon-fips, grafana-operator-fips, nri-cassandra, prometheus-statsd-exporter-fips, docker-credential-gcr,...

AZL-75491 CVE-2025-11065 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

GHSA-JHJH-HCM6-MRCC vulnerabilities

Vulnerabilities for packages: linux-aws, linux-gcp, linux-azure...

CVE-2025-67743 Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service

Local Deep Research is an AI-powered research assistant for deep, iterative research. In versions from 1.3.0 to before 1.3.9, the download service downloadservice.py makes HTTP requests using raw requests.get without utilizing the application's SSRF protection saferequests.py. This can allow...

CVE-2025-65637 affecting package kube-vip-cloud-provider for versions less than 0.0.2-24

CVE-2025-65637 affecting package kube-vip-cloud-provider for versions less than 0.0.2-24. A patched version of the package is available...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: thanos-operator, opa-envoy, metrics-agent, nfs-subdir-external-provisioner, db-operator, nvidia-container-toolkit, ipfs-cluster, harbor, task, sftpgo-plugin-pubsub, minio-object-browser, gops, pulumi-kubernetes-operator, kubeflow, pgtimetable, glow, helm-operator,...

Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks

New research has uncovered that publishers of over 100 Visual Studio Code VS Code extensions leaked access tokens that could be exploited by bad actors to update the extensions, posing a critical software supply chain risk. "A leaked VS Code Marketplace or Open VSX PAT personal access token allow...