CVE-2026-53472

The CVE-2026-53472 issue affects the migration-planner component. Root cause: insufficient validation of AgentStatusUpdate.CredentialUrl allows an authenticated attacker to store a javascript: URL, which a victim can render in the Hybrid Cloud Console to trigger Cross-Site Scripting (XSS). Impact...

EUVD-2026-58664

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

CVE-2026-53472 Migration-planner: credentialurl validator accepts javascript: urls

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

CVE-2026-53472

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

CVE-2026-53472 Migration-planner: credentialurl validator accepts javascript: urls

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

GO-2026-5973 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider, rke2-cloud-provider-fips...

GO-2026-5106 vulnerabilities

Vulnerabilities for packages: cloudnative-pg-fips, plugin-barman-cloud, plugin-barman-cloud-fips, cloudnative-pg...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: trivy, zot, smarter-device-manager, pulumi-language-dotnet, k8sgpt-operator, opentelemetry-collector-contrib-fips, cloud-sql-proxy-fips, ferretdb, sops, conftest-fips, spicedb, step, step-fips, spegel, kargo, kube-rbac-proxy-fips, dbmate, hubble-ui, cilium,...

GO-2026-5973 vulnerabilities

Vulnerabilities for packages: rke2-cloud-provider...

GO-2026-5594 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GO-2025-4257 vulnerabilities

Vulnerabilities for packages: kserve, k8sgpt...

GO-2026-5602 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, cloud-provider-gcp-cloud-controller-manager, rancher-system-agent, vcluster, emissary, kubernetes-csi-driver-hostpath, mesosphere-vsphere-csi, yunikorn-k8shim, rancher-fleet...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, prometheus-pushgateway, telegraf, minio-operator, certificate-transparency, jaeger, minio-object-browser, cloud-sql-proxy, karma, trillian, minio, keda, tempo, loki, splunk-otel-collector, mc, mcp-grafana, istio, aws-otel-collector, datadog-agent...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: prometheus-pushgateway, minio-operator, k8sgpt, certificate-transparency, jaeger, cloud-sql-proxy, karma, grafana, trillian, node-problem-detector, amazon-cloudwatch-agent-operator, opentelemetry-collector, minio, fluent-bit-plugin-loki, keda, tempo, prometheus,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: nri-elasticsearch, runc, crossplane-provider-aws-elasticache, terraform-provider-acme, cluster-proportional-autoscaler, kyverno, cis-operator, continuity, kaniko, dask-gateway, kapp-controller, spark-operator, kube-vip, crossplane-provider-aws-memorydb, goreleaser,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-acme, sftpgo-plugin-kms, kube-vip, gatekeeper, kubeflow, apko, rabbitmq-messaging-topology-operator, kube-vip-cloud-provider, gitlab-pages, terraform-provider-grafana, policy-controller, temporal-ui-server,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: cosign, crossplane-provider-aws-elasticache, terraform-provider-acme, kyverno, crossplane-provider-aws-memorydb, cluster-api-azure-controller, k8sgpt, apko, gptscript, hcloud, gitlab-pages, nerdctl, policy-controller, skaffold, cilium, falcoctl, terraform-provider-tl...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: cosign, runc, crossplane-provider-aws-elasticache, go-licenses, http-echo, kapp-controller, kubernetes-dns-node-cache, dask-gateway, rancher-loglevel, spark-operator, sftpgo-plugin-kms, gatekeeper, goreleaser, kubeflow, minio-operator, kserve-modelmesh-serving,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: runc, sftpgo-plugin-kms, kubeflow, ini-file, apko, rabbitmq-messaging-topology-operator, pdfcpu, policy-controller, kubescape-operator, rancher-fleet, malcontent, flux-image-reflector-controller, kind, hydra, eksctl, tflint, yq, cert-exporter, nri-mysql, k9s, juicefs...