Apache AsterixDB 0.9.9 Missing Authentication

Apache AsterixDB version 0.9.9 contains a missing authentication vulnerability in its Cluster Controller HTTP API, allowing unauthenticated SQL++ queries and cluster shutdown requests. !/usr/bin/env perl Apache AsterixDB 0.9.9 Missing Authentication Vendor: The Apache Software Foundation Product...

Apache AsterixDB 0.9.9 Missing Authentication

Summary Apache AsterixDB is a highly scalable data management system that can store, index, and manage semi-structured data, e.g., much like MongoDB, but it also supports a full-power query language with the expressiveness of SQL and more. Unlike analytics engines like Apache Hive or Apache Spark...

CVE-2026-71208

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-71208

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

EUVD-2026-53205

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-71208

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-71208: Server-Side Request Forgery (SSRF)

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

PT-2026-68046

Name of the Vulnerable Software and Affected Versions KubeSphere affected versions not specified Description The cluster-controller reconciliation process in the addCluster function located in pkg/utils/clusterclient/clusterclient.go processes connection configurations for Cluster custom resource...

cobras (>=1.7.7, <=2.1.7), docker-cluster-controller (0.1.23) potentially affected by CVE-2024-40647 via sentry-sdk (0.11.2)

sentry-sdk PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - cobras =1.7.7, =2.1.7 - docker-cluster-controller 0.1.23 Source cves: CVE-2024-40647 Source advisory: OSV:PYSEC-2026-1917...

cobras (>=1.7.7, <=2.1.7), docker-cluster-controller (0.1.23) potentially affected by CVE-2023-28117 via sentry-sdk (0.11.2)

sentry-sdk PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - cobras =1.7.7, =2.1.7 - docker-cluster-controller 0.1.23 Source cves: CVE-2023-28117 Source advisory: OSV:PYSEC-2026-920...

CVE-2026-41485

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...

CVE-2026-41485

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.17.2 and 1.16.4, an unchecked type assertion in the forEach mutation handler allows any user with permission to create a Policy or ClusterPolicy to crash the cluster-wide background controller int...

Security Bulletin: Due to the use of helm, IBM Kubecost Self Hosted is affected by stack overflow and memory exhaustion

Summary helm is used by IBM Kubecost Self Hosted as part of the cluster-controller component CVE-2025-32387, CVE-2025-32386 Vulnerability Details CVEID:CVE-2025-32387 DESCRIPTION: Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply...

EUVD-2022-3694

Malicious code in bioql PyPI...

EUVD-2024-17612

Malicious code in bioql PyPI...

cobras (>=1.7.7, <=2.1.7), docker-cluster-controller (0.1.23) potentially affected by CVE-2024-40647 via sentry-sdk (0.11.2)

sentry-sdk PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - cobras =1.7.7, =2.1.7 - docker-cluster-controller 0.1.23 Source cves: CVE-2024-40647 Source advisory: OSV:GHSA-G92J-QHMH-64V2...

CVE-2024-31989 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS...

CVE-2024-1889

Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with these user permissions on the affected device...

CVE-2024-1889

Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with these user permissions on the affected device...

Cross site request forgery (csrf)

Cross-Site Request Forgery vulnerability in SMA Cluster Controller, affecting version 01.05.01.R. This vulnerability could allow an attacker to send a malicious link to an authenticated user to perform actions with these user permissions on the affected device...