Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

Gitea Container Registry - Unauthorized Private Image Access

Gitea = 1.26.2. As a temporary workaround, set REQUIRESIGNINVIEW=true in gitea app.ini, though this blocks all anonymous access including public repos. reference: - https://blog.gitea.com/release-of-1.26.2/ - https://github.com/go-gitea/gitea/pull/37290 -...

GHSA-HQVF-45JJ-MCCQ vulnerabilities

Vulnerabilities for packages: localstack...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth-fips, aws-flb-kinesis-fips, crossplane-provider-aws-opensearch-fips, helm-exporter, apiserver-network-proxy-fips, kube-state-metrics, nodetaint-fips, nodetaint, crossplane-provider-azure-authorization, kubevela, terraform-provider-grafana,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, k8ssandra-client, go-licenses, cert-exporter, mattermost, manifest-tool, bazelisk, whereabouts, opentelemetry-collector-contrib, neuvector-dbgen, nri-prometheus, traefik, terraform-provider-azurerm, vt-cli, redis-operator, grafana-mimir,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: grafana-rollout-operator, k8ssandra-client, go-licenses, cert-exporter, mattermost, manifest-tool, bazelisk, whereabouts, opentelemetry-collector-contrib, neuvector-dbgen, nri-prometheus, traefik, terraform-provider-azurerm, vt-cli, redis-operator, grafana-mimir,...

OPENSUSE-SU-2026:11520-1 kubevirt1.9-container-disk-1.9.0-1.1 on GA media

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: infinispan, pinot, pinot-fips, cruise-control-fips, spark-fips, wildfly, geoserver, apache-hop-fips, hono, flink, kayenta-fips, cruise-control, traccar-fips, elasticsearch, akhq, neo4j, elasticsearch-fips, spdx-tools-java, apache-tika, apache-hop, keycloak-config-cli...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth-fips, crossplane-provider-aws-opensearch-fips, helm-exporter, apiserver-network-proxy-fips, kube-state-metrics, nodetaint-fips, nodetaint, crossplane-provider-azure-authorization, kubevela, kube-metrics-adapter-fips, virt-api-fips,...

CVE-2026-56860 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, vale, crossplane-provider-aws-opensearch-fips, helm-exporter, crossplane-provider-azure-purview, terraform-provider-acme-fips, terraform-provider-tls-fips, crossplane-provider-aws-verifiedaccess-fips, crossplane-provider-aws-cloudsearch-fips,...

CVE-2026-54526 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines...

CVE-2026-56864 vulnerabilities

Vulnerabilities for packages: spire-server, zot, k8s-device-plugin, snyk-cli, containerd, k3s, kyverno, aactl, nerdctl, kots...

CVE-2026-56865 vulnerabilities

Vulnerabilities for packages: spire-server, zot, k8s-device-plugin, snyk-cli, containerd, k3s, kyverno, aactl, nerdctl, kots...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: tileserver-gl, jitsucom-jitsu...

CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766

CVE-2026-47766 affects crun prior to version 1.28. When an OCI bundle uses a symlink for rootfs/dev and the bundle omits mounting /dev, crun may follow the symlink and create default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, vale, crossplane-provider-aws-opensearch-fips, helm-exporter, crossplane-provider-azure-purview, terraform-provider-acme-fips, terraform-provider-tls-fips, crossplane-provider-aws-verifiedaccess-fips, crossplane-provider-aws-cloudsearch-fips,...

GO-2026-6088 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-auth-fips, aws-flb-kinesis-fips, crossplane-provider-aws-opensearch-fips, helm-exporter, apiserver-network-proxy-fips, kube-state-metrics, nodetaint-fips, nodetaint, crossplane-provider-azure-authorization, kubevela, terraform-provider-grafana,...