CVE-2026-94448 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, crossplane-provider-aws-lightsail-fips, prometheus-alertmanager-fips, kuma, neuvector-scanner-fips, crossplane-provider-aws-route53recoveryreadiness-fips, influxd,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, redis-operator, kyverno-policy-reporter-plugins-trivy, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, git-sync-fips, longhorn-cli-fips,...

CVE-2026-78659 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, redis-operator, kyverno-policy-reporter-plugins-trivy, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, git-sync-fips,...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, redis-operator, kyverno-policy-reporter-plugins-trivy, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, git-sync-fips,...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, redis-operator, kyverno-policy-reporter-plugins-trivy, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, git-sync-fips,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, redis-operator, kyverno-policy-reporter-plugins-trivy, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, git-sync-fips,...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, redis-operator, kyverno-policy-reporter-plugins-trivy, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, git-sync-fips,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, redis-operator, kyverno-policy-reporter-plugins-trivy, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, git-sync-fips,...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-kyverno-plugin-fips, metrics-server-fips, redis-operator, kyverno-policy-reporter-plugins-trivy, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, git-sync-fips,...

GO-2026-6497 vulnerabilities

Vulnerabilities for packages: opentofu, manifest-tool, k8sgpt, k9s, flux-helm-controller, kargo, rancher-helm, kyverno-notation-aws, tigera-operator, xeol, cluster-api-helm-controller, gitness, helm-set-status, helm-push, kube-arangodb, maru, helm-mapkubeapis, cert-manager-cmctl...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: opentofu, manifest-tool, k8sgpt, k9s, flux-helm-controller, kargo, rancher-helm, kyverno-notation-aws, tigera-operator, xeol, cluster-api-helm-controller, gitness, helm-set-status, helm-push, kube-arangodb, maru, helm-mapkubeapis, cert-manager-cmctl...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: rancher, k8sgpt, kargo, nerdctl, skaffold, cluster-api-helm-controller, trivy, falco-no-driver, syft, scorecard, helm-set-status, chartmuseum, zarf, helm-push, grype, neuvector-scanner, docker-compose, fuse-overlayfs-snapshotter, manifest-tool, zot, docker,...

CVE-2026-84445 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, redis-operator, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, crossplane-provider-aws-codeartifact, promxy, k8ssandra-client, crossplane-provider-aws-batch, ferretd...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: metrics-server-fips, redis-operator, neuvector-scanner-fips, knative-serving, certificate-transparency-fips, crossplane-provider-aws-identitystore-fips, tempo-fips, crossplane-provider-aws-codeartifact, promxy, k8ssandra-client, crossplane-provider-aws-batch, ferretd...

SUSE CVE-2026-7184

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

GO-2026-6282 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

PT-2026-82031

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: spqr, cluster-api-gcp-controller, gitlab-kas, cluster-api, rancher, telegraf, tetragon, cluster-api-helm-controller, kubernetes, azure-service-operator, kapp-controller, keda, crossplane, kubeflow-pipelines, cloud-provider-azure, datadog-agent, openbao,...

CVE-2026-48162

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-48162

CVE-2026-48162 affects Wazuh (open-source threat detection platform) versions 4.0.0 through 4.14.6 and 5.0.0-beta3 . The vulnerability resides in DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py, where an attacker-controlled tmp_file value is joined to WAZUH_PATH withou...