CVE-2026-94448 vulnerabilities

Vulnerabilities for packages: authentik, chainloop-cli-fips, db-operator-fips, crossplane-provider-aws-osis-fips, crossplane-provider-azure-purview, opensearch-datasource-fips, google-guest-agent-manager, versitygw, kyverno-policy-reporter-ui, kubernetes-event-exporter-fips,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

CVE-2026-78659 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips, clickhouse-backup-fips, witness...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, docker-credential-ecr-login, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, prom-label-proxy, google-guest-agent-manager, sops, kubectx, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips,...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, k8sgpt, k9s, kargo, kube-arangodb, xeol, opentofu, helm-push, helm-mapkubeapis, gitness, cert-manager-cmctl, helm-set-status, kyverno-notation-aws, rancher-helm, tigera-operator, cluster-api-helm-controller, manifest-tool, maru...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, k8sgpt, k9s, kargo, kube-arangodb, xeol, opentofu, helm-push, helm-mapkubeapis, gitness, cert-manager-cmctl, helm-set-status, kyverno-notation-aws, rancher-helm, tigera-operator, cluster-api-helm-controller, manifest-tool, maru...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: k8sgpt, gatekeeper, k9s, zot, neuvector-scanner, helm-mapkubeapis, rancher-agent, dagger, rancher, cluster-api-helm-controller, kubescape, buildkitd, kubevela, kubescape-operator, k3s, grype, xeol, docker-compose, fuse-overlayfs-snapshotter, helm-push, trivy-operator...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, sops, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips, clickhouse-backup-fips, witness, prometheus-alertmanager,...

CVE-2026-84445 vulnerabilities

Vulnerabilities for packages: chainloop-cli-fips, syft, crossplane-provider-azure-purview, crossplane-provider-aws-appconfig, sops, kubernetes-event-exporter-fips, crossplane-provider-aws-kinesisanalytics-fips, clickhouse-backup-fips, witness, prometheus-alertmanager,...

SUSE CVE-2026-7184

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

GO-2026-6282 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

PT-2026-82031

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: flux-helm-controller, gatekeeper, kots, node-feature-discovery, tekton-chains, kapp-controller, zot, argocd-image-updater, emissary, tekton-pipelines, cert-manager-webhook-pdns, cluster-api-azure-controller, openbao, rancher-agent, cluster-autoscaler,...

CVE-2026-48162

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-48162

CVE-2026-48162 affects Wazuh (open-source threat detection platform) versions 4.0.0 through 4.14.6 and 5.0.0-beta3 . The vulnerability resides in DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py, where an attacker-controlled tmp_file value is joined to WAZUH_PATH withou...