GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: akhq, elasticsearch, spark-fips, apache-tika, cruise-control-fips, flink, traccar-fips, spdx-tools-java, apache-hop, pinot-fips, nacos, kayenta-fips, wildfly, elasticsearch-fips, apache-hop-fips, infinispan, apache-tika-fips, neo4j, geoserver, pinot, kayenta,...

CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766

CVE-2026-47766 affects crun prior to version 1.28. When an OCI bundle uses a symlink for rootfs/dev and the bundle omits mounting /dev, crun may follow the symlink and create default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay...

GO-2025-3690 vulnerabilities

Vulnerabilities for packages: seaweedfs-operator, seaweedfs-operator-fips...

GO-2026-4841 vulnerabilities

Vulnerabilities for packages: k3s, milvus, rke2-runtime-fips...

GO-2024-2690 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2022-0776 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2022-0623 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2023-1850 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2025-3748 vulnerabilities

Vulnerabilities for packages: k3s, ipfs-cluster-fips...

GO-2026-5684 vulnerabilities

Vulnerabilities for packages: rke2-runtime, k3s, rke2-runtime-fips, spegel, ipfs-cluster, spegel-fips, ipfs-cluster-fips...

GO-2026-4351 vulnerabilities

Vulnerabilities for packages: flux-operator-fips, flux-operator...

GO-2025-4104 vulnerabilities

Vulnerabilities for packages: virt-controller-fips, virt-launcher, virt-operator-fips, virt-handler, docker-machine-driver-harvester...

GO-2022-0784 vulnerabilities

Vulnerabilities for packages: ctop...

GO-2025-4097 vulnerabilities

Vulnerabilities for packages: rke2-runtime, node-feature-discovery-fips, cluster-autoscaler-fips, node-feature-discovery, rancher-agent, eks-distro, nvidia-container-toolkit, buildah, falco-no-driver, k3s, azure-container-networking, cluster-autoscaler, kubernetes-fips, grafana-alloy-fips, podman...

GO-2026-4440 vulnerabilities

Vulnerabilities for packages: rke2-runtime, wuzz, k8s-device-plugin, cilium-envoy-fips, gendesk, k3s, aws-load-balancer-controller, localstack, gitness, nvidia-gpu-operator-validator, rke2-runtime-fips, backup-restore-operator, cilium-envoy, terraform, fuse-overlayfs-snapshotter, runc, etcd-fips,...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: cluster-autoscaler-fips, calico-fips, node-feature-discovery, rancher-agent, azuredisk-csi-fips, argo-rollouts, yunikorn-k8shim, nodetaint, kubernetes-csi-driver-nfs, aws-efs-csi-driver, ip-masq-agent, spark-operator-fips, kapp, vcluster,...

GO-2026-5617 vulnerabilities

Vulnerabilities for packages: docker-credential-gcr-fips, portieris-fips, aws-otel-collector-fips, docker-credential-gcr, cloudbeat, elastic-agent-fips, nuclei, harvester, rancher-agent, opentelemetry-operator-fips, nrdot-collector-k8s, beats-fips, google-cloud-otel-ops-collector, skopeo,...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, vexctl, node-feature-discovery-fips, x509-certificate-exporter-fips, cloud-provider-azure-fips, gitlab-workhorse-ce, velero-plugin-for-aws, mage, timescaledb-parallel-copy, prometheus-mongodb-exporter, docker-credential-ecr-login,...

GO-2025-4008 vulnerabilities

Vulnerabilities for packages: external-secrets-operator-fips, vexctl, node-feature-discovery-fips, x509-certificate-exporter-fips, cloud-provider-azure-fips, gitlab-workhorse-ce, velero-plugin-for-aws, mage, timescaledb-parallel-copy, prometheus-mongodb-exporter, docker-credential-ecr-login,...