GO-2025-3802 vulnerabilities

Vulnerabilities for packages: consul-k8s, istio, pluto, cert-manager-cmctl-fips, kots, eksctl, flux-source-controller, zarf, k8ssandra-client-fips, chart-testing-fips, rancher-helm, helm-operator-fips, tw, chartmuseum-fips, harbor-fips, envoy-gateway, flux-fips, teleport, helm-push, cilium-cli,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: trivy-operator, cert-manager-cmctl-fips, kube-mgmt-fips, eksctl, ratify, kube-mgmt, falcoctl-fips, kubescape-operator-fips, gitlab-operator-fips, gogatekeeper, chartmuseum-fips, crossplane, teleport, helm-push, jfrog-cli, chaos-mesh-fips, kgateway, linkerd2,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, amazon-cloudwatch-agent-fips, dapr, splunk-otel-collector-fips, argo-events, bento, cluster-api-aws-controller, argo-events-fips, opentelemetry-collector-contrib, vault, jitsucom-bulker, sqlexporter-fips, sqlexporter, dapr-fips, telegraf,...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: kubescape, helm-docs, cilium-cli, zot, k8ssandra-client, flux, cert-manager-cmctl, flux-source-controller, k9s, chartmuseum, chart-testing, rancher-helm, tw, flux-helm-controller, trivy, pluto, helm-operator, helm-push, eksctl, kots, cluster-api-helm-controller, zarf...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: helm-docs, cilium-cli, zot, k8ssandra-client, cert-manager-cmctl, flux-source-controller, envoy-gateway, k9s, chartmuseum, chart-testing, linkerd2, istio, cerbos, rancher-fleet, rancher-helm, zarf, tw, flux-helm-controller, trivy, pluto, helm-operator, helm-push,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: sqlexporter, argo-events, splunk-otel-collector, amazon-cloudwatch-agent, bento, jitsucom-bulker, cluster-api-aws-controller, grafana-alloy, opentelemetry-collector-contrib...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: cert-manager, kube-fluentd-operator, kubeflow, rancher, vault-k8s, fuse-overlayfs-snapshotter, hubble-ui, conjur-cli, container-object-storage-interface, nri-apache, q, secrets-store-csi-driver, octo-sts, db-operator, kube-state-metrics, flux,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kubeflow, ytt, vault-k8s, flux-image-automation-controller, fuse-overlayfs-snapshotter, hubble-ui, step, conjur-cli, container-object-storage-interface, maru, sbomqs, blobfuse2, pguser, secrets-store-csi-driver, terraform-mcp-server, octo-sts, esbuild,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: glow, nri-apache, kyverno-notation-aws, terraform-mcp-server, gcsfuse, flux, cni-plugins, chart-testing, rabbitmq-default-user-credential-updater, undock, caddy, rabbitmq-cluster-operator, wire-go, kubecolor, k8sgateway, ip-masq-agent, kubernetes-dashboard-auth,...

SUSE CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: fluent-operator, datadog-operator, cert-manager, rancher, hubble-ui, kyverno-notation-aws, k8ssandra-client, kube-state-metrics, kubernetes-csi-external-attacher, datadog-agent, rke2-cloud-provider, cilium, kubernetes-csi-external-resizer, kubescape-operator,...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: backup-restore-operator, istio, cloud-provider-azure-fips, ceph-csi-operator-fips, cluster-api-provider-vsphere, kubernetes-csi-external-snapshotter, newrelic-k8s-metrics-adapter, metrics-server, yunikorn-k8shim-fips, emissary, elastic-agent, cloud-provider-azure,...

CVE-2026-28220

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: cert-manager, rancher, flux-image-automation-controller, step, melange, flux, apko, datadog-agent, skaffold, crossplane-provider-azure-sql, cilium, fscrypt, chisel, caddy, docker, loki, flux-notification-controller, argocd-image-updater, age, wal-g, chezmoi, nuclei,...

GO-2026-5615 CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3

CAPM3 vulnerable to Cross-Namespace resource access in github.com/metal3-io/cluster-api-provider-metal3...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: trivy-operator, gitlab-rails-ce-fips, kube-mgmt-fips, eksctl, kube-mgmt, k3s, kubescape-operator-fips, docker-fips, skaffold-fips, chartmuseum-fips, crossplane, teleport, helm-push, jfrog-cli, chaos-mesh-fips, kgateway, gitlab-rails-ce, kaniko-fips, linkerd2,...

CVE-2026-47190

A flaw was found in the Cluster API Provider Metal3 IP Address Manager IPAM controller. The controller's ClusterRole granted excessive permissions, allowing full create, read, update, and delete CRUD access to core/v1 Secrets. If the controller pod were compromised, an attacker could leverage the...

CVE-2026-47190

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...

EUVD-2026-36500

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

EUVD-2026-36463

IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...