GO-2026-6497 vulnerabilities

Vulnerabilities for packages: xeol, k9s, opentofu, flux-helm-controller, helm-set-status, manifest-tool, k8sgpt, cluster-api-helm-controller, tigera-operator, helm-push, kargo, cert-manager-cmctl, rancher-helm, kube-arangodb, helm-mapkubeapis, maru, kyverno-notation-aws, gitness...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: xeol, k9s, opentofu, flux-helm-controller, helm-set-status, manifest-tool, k8sgpt, cluster-api-helm-controller, tigera-operator, helm-push, kargo, cert-manager-cmctl, rancher-helm, kube-arangodb, helm-mapkubeapis, maru, kyverno-notation-aws, gitness...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: buildkitd, zot, skaffold, helm-set-status, scorecard, tigera-operator, kubevela, chartmuseum, docker-compose, rancher-agent, kube-arangodb, trivy, fuse-overlayfs-snapshotter, helm-mapkubeapis, xeol, kubescape, manifest-tool, k8sgpt, rancher, headlamp, zarf, steampipe...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: harvester-fips, gitlab-runner-fips, bank-vaults, crossplane-provider-aws-location, cluster-api-aws-controller, falco-exporter-fips, scorecard, opentelemetry-operator-fips, fleet-server-fips, rancher-agent, rqlite-fips, grafana-tempo-datasource, grype,...

CVE-2026-84445 vulnerabilities

Vulnerabilities for packages: harvester-fips, gitlab-runner-fips, bank-vaults, crossplane-provider-aws-location, cluster-api-aws-controller, falco-exporter-fips, scorecard, opentelemetry-operator-fips, fleet-server-fips, rancher-agent, rqlite-fips, grafana-tempo-datasource, grype,...

SUSE CVE-2026-7184

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

GO-2026-6282 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

PT-2026-82031

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller, external-secrets-operator, zot, kwok, kubernetes-csi-external-snapshotter, telegraf, kubeflow-pipelines, rancher-agent, kubernetes-csi-external-attacher, cloud-provider-gcp-cloud-controller-manager, node-feature-discovery, cass-operator,...

CVE-2026-48162

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-48162

CVE-2026-48162 affects Wazuh (open-source threat detection platform) versions 4.0.0 through 4.14.6 and 5.0.0-beta3 . The vulnerability resides in DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py, where an attacker-controlled tmp_file value is joined to WAZUH_PATH withou...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: chartmuseum-fips, consul-k8s, k8sgpt, zot, helm-push, tw, flux-helm-controller, flux-fips, harbor, k9s, helm-operator, k8ssandra-client-fips, consul-k8s-fips, flux, harbor-fips, chartmuseum, cert-manager-cmctl-fips, rancher-fleet-fips, cluster-api-helm-controller,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: tigera-operator, chartmuseum-fips, helm-set-status, kubescape-operator-fips, falcoctl-fips, consul-k8s-fips, kyverno-fips, manifest-tool, helm-operator-fips, ratify, trivy-operator, kube-arangodb-fips, rancher-agent, kube-mgmt, opentofu-fips, oras, jfrog-cli,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: dapr, cluster-api-aws-controller-fips, amazon-cloudwatch-agent-fips, jitsucom-bulker, splunk-otel-collector-fips, splunk-otel-collector, telegraf, amazon-cloudwatch-agent, grafana-alloy, cluster-api-aws-controller, argo-events, sqlexporter, dapr-fips, argo-events-fip...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: tw, zot, chartmuseum, cilium-cli, trivy, kots, pluto, k8ssandra-client, helm-docs, flux-helm-controller, kubescape, zarf, k9s, chart-testing, flux-source-controller, helm-push, cert-manager-cmctl, eksctl, helm-operator, rancher-helm, flux, cluster-api-helm-controller...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: tw, zot, linkerd2, rancher-fleet, chartmuseum, cilium-cli, trivy, istio, kots, k8ssandra-client, pluto, helm-docs, flux-helm-controller, k8sgpt, zarf, cerbos, k9s, chart-testing, flux-source-controller, helm-push, cert-manager-cmctl, eksctl, helm-operator,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: argo-events, splunk-otel-collector, bento, cluster-api-aws-controller, grafana-alloy, jitsucom-bulker, sqlexporter, opentelemetry-collector-contrib, amazon-cloudwatch-agent...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, terraform-docs, podinfo, crossplane-provider-aws-kms, wuzz, aws-node-termination-handler, crossplane-provider-aws-rds, crossplane-provider-aws-sqs, gomplate, kubeflow-pipelines, knative-serving, kubevela, nri-prometheus,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: minio-object-browser, helm-set-status, aws-sigv4-proxy, podinfo, terraform-docs, wuzz, crossplane-provider-aws-rds, sftpgo-plugin-pubsub, kubeflow-pipelines, gptscript, ghaudit, go-licenses, kubernetes-csi-external-attacher, restic, wave, harbor-registry, wgcf, src,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: helm-set-status, chartmuseum, gptscript, trivy, harbor-registry, wgcf, src, terraform-provider-azapi, cloud-sql-proxy, k8sgpt, thanos-operator, kor, kapp, fulcio, rancher-system-agent, headlamp, aactl, prometheus, kubernetes-csi-driver-hostpath, hubble, cerbos,...