91 matches found
GHSA-2V4P-QF9Q-27WJ vulnerabilities
Vulnerabilities for packages: cluster-api-fips, etcd-fips...
CVE-2026-84445 vulnerabilities
Vulnerabilities for packages: cluster-api-fips, etcd-fips...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kapp-controller, kube-rbac-proxy, flux-notification-controller, spicedb, tetragon, cloud-provider-vsphere, rancher-system-agent, emissary, tkn, rancher, tekton-pipelines, kubernetes-csi-external-snapshotter, cloud-provider-gcp-cloud-controller-manager,...
CVE-2026-48162
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...
CVE-2026-48162
CVE-2026-48162 affects Wazuh (open-source threat detection platform) versions 4.0.0 through 4.14.6 and 5.0.0-beta3 . The vulnerability resides in DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py, where an attacker-controlled tmp_file value is joined to WAZUH_PATH withou...
GO-2025-3802 vulnerabilities
Vulnerabilities for packages: cilium-cli, eksctl, flux-helm-controller, helm-docs, harbor-fips, linkerd2, chartmuseum, chart-testing-fips, harbor, zot, teleport, rancher-helm, flux-source-controller, trivy, envoy-gateway-fips, helm-operator, istio, trivy-operator-fips, zarf, k9s,...
GO-2026-5882 vulnerabilities
Vulnerabilities for packages: maru, kyverno, steampipe, linkerd2, cloudbeat-fips, helm-exporter, xeol-fips, vcluster-fips, cert-manager-cmctl, drone, helm-mapkubeapis, k8ssandra-client, kubescape-operator, crossplane-fips, consul-k8s, falcoctl-fips, argocd-image-updater, rancher-fleet,...
GO-2025-4123 vulnerabilities
Vulnerabilities for packages: cluster-api-aws-controller, argo-events-fips, sqlexporter, splunk-otel-collector-fips, amazon-cloudwatch-agent, cluster-api-aws-controller-fips, dapr, sqlexporter-fips, bento, grafana-alloy, vault-fips, opentelemetry-collector-contrib, argo-events,...
GO-2025-3602 vulnerabilities
Vulnerabilities for packages: zot, cilium-cli, k8ssandra-client, helm-operator, eksctl, rancher-helm, flux-helm-controller, zarf, flux-source-controller, cert-manager-cmctl, helm-docs, kubescape, flux, helm-push, chartmuseum, tw, cluster-api-helm-controller, chart-testing, kots, trivy, pluto, k9s...
GO-2025-3802 vulnerabilities
Vulnerabilities for packages: zot, cilium-cli, k8ssandra-client, helm-operator, k9s, eksctl, k8sgpt, envoy-gateway, rancher-helm, linkerd2, zarf, rancher-fleet, flux-source-controller, cert-manager-cmctl, helm-docs, cerbos, helm-push, chartmuseum, tw, istio, pluto, cluster-api-helm-controller,...
GO-2025-4123 vulnerabilities
Vulnerabilities for packages: jitsucom-bulker, opentelemetry-collector-contrib, sqlexporter, grafana-alloy, splunk-otel-collector, bento, cluster-api-aws-controller, amazon-cloudwatch-agent, argo-events...
GO-2026-5039 vulnerabilities
Vulnerabilities for packages: kapp-controller, crossplane-provider-aws-route53, aactl, golangci-lint, fuse-overlayfs-snapshotter, crossplane-provider-aws-s3, flannel, grafana-rollout-operator, libnvidia-container, sftpgo-plugin-geoipfilter, sftpgo-plugin-pubsub, terraform-provider-azurerm, kiali,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: kapp-controller, maru, aactl, golangci-lint, fuse-overlayfs-snapshotter, crossplane-provider-aws-s3, flannel, grafana-rollout-operator, grpcurl, cilium-cli, flux-notification-controller, helm-set-status, doppler-kubernetes-operator, sftpgo-plugin-geoipfilter,...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: kapp-controller, aactl, glow, helm-set-status, grafana-rollout-operator, libnvidia-container, cilium-cli, harbor-cli, buildkitd, k8sgpt, spark-operator, wait-for-port, delve, ip-masq-agent, kubecolor, cloud-provider-vsphere, rancher-system-agent, emissary,...
SUSE CVE-2026-47190
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: kapp-controller, kube-rbac-proxy, flux-notification-controller, spicedb, tetragon, cloud-provider-vsphere, rancher-system-agent, emissary, tkn, rancher, tekton-pipelines, kubernetes-csi-external-snapshotter, cloud-provider-gcp-cloud-controller-manager,...
GHSA-GCJH-H69Q-9W9G vulnerabilities
Vulnerabilities for packages: kapp-controller, k8s-agents-operator, kube-oidc-proxy, chainloop-cli-fips, openbao, ansible-operator, kubeflow-pipelines-driver-fips, kyverno, cluster-autoscaler, beats, cass-operator-fips-no-pvc-delete, cloud-provider-azure-fips, cert-manager-webhook-pdns,...
CVE-2026-28220
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: aactl, cilium-cli, flux-notification-controller, nfpm, terraform-provider-azurerm, buildkitd, k8sgpt, gatus, falco-no-driver, melange, witness, tkn, hcloud, rancher, prometheus-operator, pulumi-language-yaml, caddy, knative-serving, mattermost, minio, podman,...
