141 matches found
CVE-2025-13281 Portworx Half-Blind SSRF in kube-controller-manager
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
CVE-2025-13281
The CVE-2025-13281 entry describes a half-blind SSRF in kube-controller-manager when using the in-tree Portworx StorageClass. Affected: Kubernetes kube-controller-manager components handling Portworx StorageClass, with information disclosure risk by leaking data from unprotected endpoints in the ...
CVE-2025-13281
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
CVE-2025-13281
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
OESA-2025-2819 kubernetes security update
Container cluster management. Security Fixes: A vulnerability was found in Kubernetes kube-controller-manager up to versions 1.30.14, 1.31.14, 1.32.9, 1.33.5 and 1.34.1. It has been classified as CWE-918 Server-Side Request Forgery. The web server receives a URL or similar request from an upstrea...
OESA-2025-2818 kubernetes security update
Container cluster management. Security Fixes: A vulnerability was found in Kubernetes kube-controller-manager up to versions 1.30.14, 1.31.14, 1.32.9, 1.33.5 and 1.34.1. It has been classified as CWE-918 Server-Side Request Forgery. The web server receives a URL or similar request from an upstrea...
OESA-2025-2817 kubernetes security update
Container cluster management. Security Fixes: A vulnerability was found in Kubernetes kube-controller-manager up to versions 1.30.14, 1.31.14, 1.32.9, 1.33.5 and 1.34.1. It has been classified as CWE-918 Server-Side Request Forgery. The web server receives a URL or similar request from an upstrea...
OESA-2025-2816 kubernetes security update
Container cluster management. Security Fixes: A vulnerability was found in Kubernetes kube-controller-manager up to versions 1.30.14, 1.31.14, 1.32.9, 1.33.5 and 1.34.1. It has been classified as CWE-918 Server-Side Request Forgery. The web server receives a URL or similar request from an upstrea...
OESA-2025-2815 kubernetes security update
Container cluster management. Security Fixes: A vulnerability was found in Kubernetes kube-controller-manager up to versions 1.30.14, 1.31.14, 1.32.9, 1.33.5 and 1.34.1. It has been classified as CWE-918 Server-Side Request Forgery. The web server receives a URL or similar request from an upstrea...
CVE-2025-61727 vulnerabilities
Vulnerabilities for packages: postgres-operator, rke2-cloud-provider, opentofu, pulumi-kubernetes-operator, nri-f5, terraform-provider-sendgrid, mockery, tempo, opa, nri-mssql, temporal-server, ipfs-cluster, kiali, sftpgo-plugin-eventsearch, opa-envoy, helm-push, oauth2-proxy, paranoia, frp,...
GHSA-5MH9-3JWC-RP59 vulnerabilities
Vulnerabilities for packages: postgres-operator, rke2-cloud-provider, opentofu, pulumi-kubernetes-operator, nri-f5, terraform-provider-sendgrid, mockery, tempo, opa, nri-mssql, temporal-server, ipfs-cluster, kiali, sftpgo-plugin-eventsearch, opa-envoy, helm-push, oauth2-proxy, paranoia, frp,...
Portworx Half-Blind SSRF in kube-controller-manager
CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N - Medium 5.8 A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This was patched for other in-tree StorageClasses GlusterFS, Quobyte, StorageOS, and...
EUVD-2025-29177
Malicious code in bioql PyPI...
EUVD-2025-29178
Malicious code in bioql PyPI...
EUVD-2024-3260
Malicious code in bioql PyPI...
EUVD-2024-1110
Malicious code in bioql PyPI...
EUVD-2025-29176
Malicious code in bioql PyPI...
SUSE CVE-2025-59358
The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...
SUSE CVE-2025-59359
The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...
SUSE CVE-2025-59360
The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...