CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: tigera-operator, buildkitd, headlamp, manifest-tool, wolfictl, gatekeeper, skaffold, kubevela, k8sgpt, eksctl, rancher-agent, zot, grype, falco-no-driver, docker-compose, fuse-overlayfs-snapshotter, helm-mapkubeapis, rancher, dagger, neuvector-scanner, kaniko,...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-acmpca-fips, grafana-rollout-operator-fips, crossplane-provider-aws-amplify, crossplane-provider-aws-appautoscaling-fips, crossplane-provider-aws-firehose-fips, longhorn-engine, terraform-provider-kubernetes, crossplane-provider-aws-mq,...

CVE-2026-84445 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-acmpca-fips, grafana-rollout-operator-fips, crossplane-provider-aws-amplify, crossplane-provider-aws-appautoscaling-fips, crossplane-provider-aws-firehose-fips, longhorn-engine, terraform-provider-kubernetes, crossplane-provider-aws-mq,...

SUSE CVE-2026-7184

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

GO-2026-6282 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

PT-2026-82031

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: spqr, kyverno-notation-aws, cass-operator, cluster-autoscaler, metrics-server, pulumi-kubernetes-operator, tekton-pipelines, flux-notification-controller, gatekeeper, cluster-api, kube-state-metrics, k3s, openbao, tkn, hubble, rancher-system-agent,...

CVE-2026-48162

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-48162

CVE-2026-48162 affects Wazuh (open-source threat detection platform) versions 4.0.0 through 4.14.6 and 5.0.0-beta3 . The vulnerability resides in DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py, where an attacker-controlled tmp_file value is joined to WAZUH_PATH withou...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl-fips, rancher-fleet, linkerd2, trivy, k8ssandra-client-fips, cerbos-fips, flux, teleport, harbor, trivy-fips, zarf, pluto, consul-k8s-fips, cerbos, chartmuseum, helm-operator-fips, tw, helm-docs, envoy-gateway-fips, eksctl, flux-fips, istio,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: rancher-fleet, trivy-fips, xeol, kubescape-server, maru, vcluster, rancher-agent, envoy-gateway-fips, argo-cd, headlamp, rancher-helm, ratify-fips, kubescape, redpanda-operator, argocd-image-updater-fips, chaos-mesh-fips, conftest-fips, cert-manager-cmctl, kube-mgmt,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector-fips, sqlexporter-fips, bento, cluster-api-aws-controller, vault-fips, telegraf, splunk-otel-collector, amazon-cloudwatch-agent, dapr, amazon-cloudwatch-agent-fips, dapr-fips, jitsucom-bulker, sqlexporter, grafana-alloy, vault,...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, flux, tw, helm-docs, zot, eksctl, k8ssandra-client, pluto, cilium-cli, helm-push, flux-helm-controller, k9s, zarf, helm-operator, flux-source-controller, cluster-api-helm-controller, chartmuseum, trivy, chart-testing, kubescape, kots, rancher-helm...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: linkerd2, rancher-fleet, cert-manager-cmctl, tw, helm-docs, k8sgpt, eksctl, zot, k8ssandra-client, pluto, envoy-gateway, cilium-cli, helm-push, flux-helm-controller, k9s, kargo, zarf, istio, helm-operator, flux-source-controller, cerbos, cluster-api-helm-controller,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: grafana-alloy, jitsucom-bulker, amazon-cloudwatch-agent, argo-events, cluster-api-aws-controller, splunk-otel-collector, bento, opentelemetry-collector-contrib, sqlexporter...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: podinfo, rancher-fleet, rancher-webhook, trino, cluster-autoscaler, tigera-operator, buildah, metrics-server, pulumi-kubernetes-operator, runc, opa-envoy, nri-apache, kubernetes-csi-livenessprobe, flux-kustomize-controller, containerd, nri-consul,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: nri-mongodb, nginx-prometheus-exporter, cert-manager-cmctl, go-licenses, runc, nri-postgresql, terraform-provider-pagerduty, kubernetes-csi-livenessprobe, flux-kustomize-controller, mods, external-dns, container-object-storage-interface,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nginx-prometheus-exporter, fzf, aws-application-networking-k8s, glow, portieris, nri-apache, containerd, nri-consul, rabbitmq-default-user-credential-updater, cluster-api-azure-controller, docker-cli, kubernetes-csi-driver-nfs, swagger, gptscript, src,...

SUSE CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: spqr, kyverno-notation-aws, cass-operator, cluster-autoscaler, metrics-server, pulumi-kubernetes-operator, tekton-pipelines, flux-notification-controller, gatekeeper, cluster-api, kube-state-metrics, k3s, openbao, tkn, hubble, rancher-system-agent,...