CVE-2026-54247: Allocation of Resources Without Limits or Throttling

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...

CVE-2026-15581

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

CVE-2026-15581

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

CVE-2026-15581: Missing Authentication for Critical Function

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

AZL-93090 CVE-2026-15811 affecting package kronosnet 1.29-3

A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after...

CVE-2026-15811

Kronosnet (version

CVE-2026-15811 Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes

A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after...

CVE-2026-15063 Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the gorch service when unproxied orchestrator and detector metrics ports are exposed on the cluster network. An attacker can gain unauthorized access to sensitive metrics by directly...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the gorch service when unproxied orchestrator and detector metrics ports are exposed on the cluster network. An attacker can gain unauthorized access to sensitive metrics by directly...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via exposed HTTP endpoints in the cluster network. An attacker can gain unauthorized access to sensitive data and potentially manipulate AI models by sending requests from any co-located pod without authentication...

CVE-2026-13325

...

CVE-2026-26055

Yoke is a Helm-inspired infrastructure-as-code IaC package deployer. In 0.19.0 and earlier, a vulnerability exists in the Air Traffic Controller ATC component of Yoke. The ATC webhook endpoints lack proper authentication mechanisms, allowing any pod within the cluster network to directly send...

yoke 访问控制错误漏洞

Yoke is a Kubernetes package management tool developed by YokeCD. Versions of Yoke prior to 0.19.0 contained an access control vulnerability. This vulnerability stemmed from the lack of proper authentication mechanisms in the Webhook endpoints of the Air Traffic Controller component, allowing any...

CVE-2025-8077

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in admin account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default...

CVE-2025-8077 NeuVector admin account has insecure default password

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in admin account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default...

CVE-2025-8077

CVE-2025-8077 describes a vulnerability in NeuVector up to version 5.4.5 where the built-in admin account uses a fixed string as the default password. If this password is not changed after deployment, any workload with network access within the cluster could use the default credentials to obtain ...

CVE-2025-8415

A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment. Mitigation...

PT-2024-26505 · Kemp · Kemp Loadmaster

Name of the Vulnerable Software and Affected Versions: Kemp LoadMaster affected versions not specified Description: Unauthenticated attackers can perform actions using SSH private keys by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster grou...

CVE-2020-25660

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the...