GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: vcluster, spire-controller-manager, nri-mssql, kubebuilder, kubescape-operator, grpcurl, kserve, timestamp-authority, regclient, neuvector-dbgen, crossplane-provider-aws-cloudfront, cluster-api-azure-controller, opa, sonobuoy, rabbitmq-default-user-credential-updater...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: vcluster, spire-controller-manager, nri-mssql, kubebuilder, kubescape-operator, grpcurl, kserve, timestamp-authority, regclient, neuvector-dbgen, crossplane-provider-aws-cloudfront, nri-postgresql, cluster-api-azure-controller, opa, sonobuoy,...

OPENSUSE-SU-2026:11520-1 kubevirt1.9-container-disk-1.9.0-1.1 on GA media

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-76446

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media

These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-QV9R-C865-CP47 vulnerabilities

Vulnerabilities for packages: airbyte-platform, ghidra, apache-activemq-fips, nuxeo, airbyte-server-fips, conductor-fips, nacos, spark, kafbat-ui, wildfly, apache-activemq, apache-tika-fips, ranger, opensearch-fips, conductor, keycloak-config-cli, solr, kafka-fips, opensearch, spdx-tools-java,...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: kube-vip, crossplane-provider-aws-cloudformation, crossplane-provider-aws-scheduler-fips, crossplane-provider-gcp-beta-networksecurity, cluster-autoscaler-fips, crossplane-provider-aws-timestreamwrite, crossplane-provider-azure-keyvault,...

CVE-2026-56860 vulnerabilities

Vulnerabilities for packages: vendir-fips, crossplane-provider-aws-timestreamwrite, moby-ryuk, grype, certificate-transparency, rancher-agent, crossplane-provider-aws-appintegrations, jaeger-operator-fips, terraform-provider-azapi, chronyexporter, victoriametrics-cluster-fips, litefs-fips,...

CVE-2026-54526 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines...

CVE-2026-56864 vulnerabilities

Vulnerabilities for packages: snyk-cli, k3s, falco-no-driver, kots, zot, kyverno, nerdctl, k3d, aactl, spire-server, k8s-device-plugin, containerd...

CVE-2026-56865 vulnerabilities

Vulnerabilities for packages: snyk-cli, k3s, falco-no-driver, kots, zot, kyverno, nerdctl, k3d, aactl, spire-server, k8s-device-plugin, containerd...

CVE-2026-73569 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, tileserver-gl...

AZL-95985 CVE-2026-47766 affecting package crun 1.24-6

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766 crun follows rootfs /dev symlink while creating default devices

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

CVE-2026-47766

CVE-2026-47766 affects crun prior to version 1.28. When an OCI bundle uses a symlink for rootfs/dev and the bundle omits mounting /dev, crun may follow the symlink and create default device nodes and stdio symlinks at the symlink target outside the container rootfs. In a local rootful crun replay...

GO-2026-6088 vulnerabilities

Vulnerabilities for packages: kube-vip, vendir-fips, crossplane-provider-aws-cloudformation, crossplane-provider-aws-scheduler-fips, crossplane-provider-gcp-beta-networksecurity, cluster-autoscaler-fips, crossplane-provider-aws-timestreamwrite, crossplane-provider-azure-keyvault,...

GO-2026-5972 vulnerabilities

Vulnerabilities for packages: vendir-fips, crossplane-provider-aws-timestreamwrite, moby-ryuk, nri-kafka, grype, certificate-transparency, rancher-agent, crossplane-provider-aws-appintegrations, jaeger-operator-fips, terraform-provider-azapi, chronyexporter, victoriametrics-cluster-fips,...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: vendir-fips, crossplane-provider-aws-timestreamwrite, moby-ryuk, nri-kafka, grype, certificate-transparency, rancher-agent, crossplane-provider-aws-appintegrations, jaeger-operator-fips, terraform-provider-azapi, chronyexporter, victoriametrics-cluster-fips,...

CVE-2026-56859 vulnerabilities

Vulnerabilities for packages: kube-vip, vendir-fips, crossplane-provider-aws-cloudformation, crossplane-provider-aws-scheduler-fips, crossplane-provider-gcp-beta-networksecurity, cluster-autoscaler-fips, crossplane-provider-aws-timestreamwrite, crossplane-provider-azure-keyvault,...