GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, rancher-loglevel, crossplane, nats, incert, chisel-fips, redka, rancher-helm, vault-secrets-operator, cluster-api-fips, ipfs-cluster, ghaudit, spark-operator-fips, vertical-pod-autoscaler-fips, container-object-storage-interface-fips, multus-cni,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, rancher-loglevel, crossplane, nats, incert, chisel-fips, redka, rancher-helm, vault-secrets-operator, cluster-api-fips, ipfs-cluster, ghaudit, spark-operator-fips, vertical-pod-autoscaler-fips, container-object-storage-interface-fips, multus-cni,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, rancher-loglevel, crossplane, nats, incert, chisel-fips, redka, rancher-helm, vault-secrets-operator, cluster-api-fips, ipfs-cluster, ghaudit, spark-operator-fips, vertical-pod-autoscaler-fips, container-object-storage-interface-fips, multus-cni,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: exfat: Added a check for the cluster chain loop in dir functions. An infinite loop may occur if the following conditions occur due to file system corruption: 1 Condition for exfatcountdirEntries to loop infinitely: - The clust...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validating UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified to ensure that their sizes match the declared lengths, and that they fit within the allocated buffer sizes as well...

CVE-2025-34271

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network...

CVE-2025-54469

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTERRPCPORT and CLUSTERLANPORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer...

CVE-2025-34271

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network...

CVE-2025-34271

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network...

CVE-2025-34271 Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network...

CVE-2025-34271 Nagios Log Server < 2024R2.0.2 Cluster Manager Credential Requests Sent Over Plaintext

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted channel even when SSL/TLS is enabled in the product configuration. As a result, an attacker positioned on the network...

Moderate: Red Hat Security Advisory: RHACS 4.8.5 security and bug fix update

Updated images are now available for Red Hat Advanced Cluster Security RHACS, which typically include new features, bug fixes, and/or security patches. See the release notes link in the references section for a description of the fixes and enhancements in this particular release...

EUVD-2025-37126

Malicious code in epic-node-cluster npm...

Malicious code in epic-node-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9966452924bba620a2f07fa9c2a6686dd281b3de0d11e2771d16085957b8dd0a The package epic-node-cluster was found to contain malicious code...

MAL-2025-49167 Malicious code in epic-node-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9966452924bba620a2f07fa9c2a6686dd281b3de0d11e2771d16085957b8dd0a The package epic-node-cluster was found to contain malicious code...

CVE-2024-58269

A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is exposed to any entity with access to Rancher audit logs...

CVE-2023-32199

A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a on in rule for resources or have a on ru...

GO-2025-4073 Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher

Rancher user retains access to clusters despite Global Role removal in github.com/rancher/rancher...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes 2.14.1 security update

Red Hat Advanced Cluster Management for Kubernetes 2.14 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. Red Hat Advanced Cluster Management for Kubernetes 2.14 images Red Hat Advanced Cluster Management for Kubernetes provides...

CVE-2025-54469

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTERRPCPORT and CLUSTERLANPORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer...