GO-2026-5594 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GO-2025-4257 vulnerabilities

Vulnerabilities for packages: kserve, k8sgpt...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, kubernetes-csi-driver-hostpath, mesosphere-vsphere-csi, rancher-system-agent, rancher-fleet, emissary, yunikorn-k8shim, cloud-provider-gcp-cloud-controller-manager, vcluster...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, mc, trillian, loki, minio, minio-operator, mcp-grafana, certificate-transparency, cloud-sql-proxy, istio, karma, prometheus-pushgateway, aws-otel-collector, tempo, telegraf, datadog-agent, minio-object-browser, splunk-otel-collector, jaeger, keda...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: mc, trillian, k8sgpt, loki, minio, grafana, minio-operator, fluent-bit-plugin-loki, opentelemetry-collector, prometheus-operator, metrics-server, certificate-transparency, cloud-sql-proxy, istio, node-problem-detector, karma, prometheus-pushgateway, aws-otel-collecto...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: lazydocker, coredns, kubeflow, cert-manager, newrelic-infra-operator, newrelic-nri-kube-events, kube-fluentd-operator, grafana-alloy, kube-logging-operator-custom-runner, cloudnative-pg, frp, dynamic-localpv-provisioner, ksops, cloud-provider-azure,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: cert-manager, k8sgpt, openbao, grafana-alloy, caddy, envoy-ratelimit, terraform-provider-azuread, buildah, external-dns, thanos, cloud-provider-aws, kubescape-operator, pgtimetable, redis-operator, juicefs, trufflehog, mattermost, flux-kustomize-controller,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: cert-manager, k8sgpt, openbao, caddy, ksops, fscrypt, crossplane-provider-aws-rds, buildah, crossplane-provider-aws-cloudwatchlogs, aactl, external-dns, tw, cloud-provider-aws, scorecard, trivy-operator, crossplane-provider-aws-dynamodb, terraform-provider-azurerm,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: terraform-provider-pagerduty, dockerize, yace, kubeflow, git-credential-oauth, ytt, go-licenses, newrelic-infra-operator, kube-logging-operator-custom-runner, frp, podinfo, dynamic-localpv-provisioner, ksops, sbomqs, crossplane-provider-aws-rds, helm-set-status,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-memcached, lazydocker, kubecolor, k8sgpt, dive, grafana-alloy, caddy, cni-plugins, envconsul, helm-set-status, kubernetes-csi-driver-nfs, mockgen, aactl, cluster-api-helm-controller, kubernetes-csi-external-health-monitor, kapp, nri-f5, spire-controller-manager,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: kubecolor, k8sgpt, caddy, thanos, kubescape-operator, nri-rabbitmq, juicefs, trufflehog, k8ssandra-client, flux-kustomize-controller, crossplane-provider-azure-authorization, grpc-health-probe, kube-bench, local-static-provisioner, falcoctl, ghaudit, k3d,...

EUVD-2026-58551

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

EUVD-2026-58552

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely...

CVE-2026-19758

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely...

CVE-2026-19757

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

EUVD-2026-58550

A vulnerability has been found in Dromara lamp-cloud up to 5.10.0. This affects an unknown part of the file DefGenProjectController.java of the component Code Generator. Such manipulation of the argument outputDir/parent/projectPrefix leads to path traversal. It is possible to launch the attack...

CVE-2026-19758: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely...

CVE-2026-46380: Server-Side Request Forgery (SSRF)

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the HTTPSFetcher.dofetch method passes a user-supplied URL directly to requests.get without validation. This allows an attacker to perform Server-Side Request Forgery, targeting internal...

CVE-2026-53472: Improper Neutralization of Input During Web Page Generation

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...