GO-2025-4017 vulnerabilities

Vulnerabilities for packages: k8sgateway, kubo, frp, dkron, kargo, spegel, traefik, ipfs-cluster, kyverno-policy-reporter-ui, q, caddy, k3s, kubernetes-dns-node-cache...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: helm-operator, pluto, istio, flux-source-controller, helm-push, linkerd2, kots, tw, chart-testing, cilium-cli, cerbos, rancher-helm, cluster-api-helm-controller, zot, flux-helm-controller, envoy-gateway, k9s, chartmuseum, cert-manager-cmctl, zarf, kargo, trivy,...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: k8sgateway, kubo, frp, dkron, kargo, spegel, traefik, ipfs-cluster, q, seaweedfs, caddy, k3s, buf, kubernetes-dns-node-cache...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent, bento, grafana-alloy, jitsucom-bulker, argo-events, sqlexporter, cluster-api-aws-controller, splunk-otel-collector, opentelemetry-collector-contrib...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: argo-cd, src, trufflehog, fluent-bit-plugin-loki, flux-kustomize-controller, pgpool2exporter, golangci-lint, crossplane-provider-azure-sql, vcluster, delve, kiali, kaniko, pinact, flyte, kube-fluentd-operator, consul-k8s, helm, kubernetes-csi-livenessprobe,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: src, flux-kustomize-controller, postgres-operator, pgpool2exporter, golangci-lint, crossplane-provider-azure-sql, sbomqs, neuvector-sigstore-interface, sriov-network-device-plugin, ferretdb, scorecard, helm, kubernetes-csi-livenessprobe, kubernetes-dns-node-cache,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: src, cni-plugins, delve, docker-cli, neuvector-sigstore-interface, rclone, regclient, kyverno-notation-aws, mongo-tools, steampipe, aws-privateca-issuer, cilium-cli, argo-events, kubernetes-dashboard-web, buildkitd, tflint, cluster-api-helm-controller, cloud-sql-prox...

CVE-2026-19763

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is...

CVE-2026-19763

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is...

EUVD-2026-58557

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is...

CVE-2026-19763 DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is...

CVE-2026-19763: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in DTStack Taier 1.4.0. Affected by this issue is the function FileUtils.deleteDirectory of the file ClusterController.java of the component Cluster Creation. This manipulation of the argument clusterName causes path traversal. Remote exploitation of the attack is...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843

OpenChoreo is vulnerable prior to versions 1.0.2 and 1.1.2 due to unauthenticated access in internal/cluster-gateway/server.go that exposed caller-facing management APIs on the external agent listener. This allows network-reachable attackers to invoke /api/proxy/ and /api/exec/, proxy the data-pl...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...

CVE-2026-73842 OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...