PT-2025-42783

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw in the stm32-csi driver where a memory dereference occurs before a NULL check within the stm32 csi start function. Specifically, csidev-s subdev is...

MAL-2025-11046 Malicious code in @zalastax/nolb-csi (npm)

The package @zalastax/nolb-csi was found to contain malicious code...

Malicious code in @zalastax/nolb-csi (npm)

The package @zalastax/nolb-csi was found to contain malicious code...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: gobump, cloud-provider-azure-fips, kubevela, aws-flb-kinesis, juicefs, sops-fips, xeol, trivy-fips, esbuild, kubescape-operator-fips, consul-k8s-fips, cloud-sql-proxy, cluster-proportional-autoscaler, aws-node-termination-handler-fips, crossplane-provider-sql-fips,...

GHSA-6V2P-P543-PHR9 vulnerabilities

Vulnerabilities for packages: portieris, argo-workflows, trivy, scorecard, rabbitmq-cluster-operator, crossplane-provider-aws-sns, kaf, dbmate, kapp-controller, kubernetes-csi-driver-nfs, ghaudit, tekton-chains, ksops, rclone, crossplane-provider-family-azure, kubernetes-csi-external-resizer,...

CVE-2025-4563 vulnerabilities

Vulnerabilities for packages: vcluster, cloud-provider-gcp-cloud-controller-manager, rancher-system-agent, mesosphere-vsphere-csi, emissary, kubernetes-csi-driver-hostpath, docker-machine-driver-harvester, rancher-fleet, yunikorn-k8shim...

GHSA-HJ2P-8WJ8-PFQ4 vulnerabilities

Vulnerabilities for packages: vcluster, cloud-provider-gcp-cloud-controller-manager, rancher-system-agent, mesosphere-vsphere-csi, emissary, kubernetes-csi-driver-hostpath, docker-machine-driver-harvester, rancher-fleet, yunikorn-k8shim...

CVE-2023-30840

Fluid is an open source Kubernetes-native distributed dataset orchestrator and accelerator for data-intensive applications. Starting in version 0.7.0 and prior to version 0.8.6, if a malicious user gains control of a Kubernetes node running fluid csi pod controlled by the csi-nodeplugin-fluid...

CVE-2022-31077

KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In affected versions a malicious message response from KubeEdge can crash the CSI Driver controller server by triggering a nil-pointer dereference panic. As a...

GHSA-3WQC-MWFX-672P vulnerabilities

Vulnerabilities for packages: blob-csi, knative-operator, k3s, wal-g...

GHSA-3WQC-MWFX-672P vulnerabilities

Vulnerabilities for packages: beats-fips, karpenter-fips, blob-csi-fips, eks-distro, blob-csi, gitlab-pages-fips, eks-distro-fips, grafana-fips, knative-operator, wal-g, k3s...

Vulnerability of the rkisp1_csi_disable() function in the drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c module – This driver is responsible for supporting multimedia devices in the Linux operating system. An attacker can exploit this vulnerability to cause a service failure.

Vulnerability of the rkisp1csidisable function in the drivers/media/platform/rockchip/rkisp1/rkisp1-csi.c module – The Linux kernel’s multimedia device support driver is vulnerable to synchronization errors when using shared resources. Exploiting this vulnerability could allow an attacker to caus...

Security Bulletin: A vulnerability in IBM Spectrum Scale CSI could allow unauthorized access (CVE-2022-40607)

Summary A security vulnerability has been identified in IBM Spectrum Scale CSI that could allow unauthorized access. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2022-40607 DESCRIPTION: IBM Spectrum Scale could allow users with permissions to create pod, persistent...

GHSA-VV39-3W5Q-974Q vulnerabilities

Vulnerabilities for packages: rancher-agent, rancher-webhook-fips...

SUSE CVE-2024-1725

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane HCP. This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node...

GO-2025-3512 kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver

kubevirt-csi: PersistentVolume allows access to HCP's root node in github.com/kubevirt/csi-driver. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

GHSA-QXP5-GWG8-XV66 vulnerabilities

Vulnerabilities for packages: cloud-provider-azure-fips, temporal-server, kubevela, istio-pilot-discovery, google-guest-agent, dcgm-exporter, crossplane-provider-aws-cloudformation, xeol, trivy-fips, amazon-cloudwatch-agent-operator-fips, crossplane-provider-aws-kms, cue-fips, consul-k8s-fips,...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: nri-redis, argo-workflows, trivy, nri-haproxy, shfmt, scorecard, rabbitmq-cluster-operator, slsa-verifier, kaf, redka, ghaudit, tekton-chains, ksops, rclone, docker-credential-gcr, mkcert, mockery, ollama, kubernetes-ingress-defaultbackend, vault-k8s,...

GHSA-3WHM-J4XM-RV8X vulnerabilities

Vulnerabilities for packages: portieris, nri-redis, argo-workflows, trivy, nri-haproxy, shfmt, scorecard, rabbitmq-cluster-operator, crossplane-provider-aws-sns, slsa-verifier, rancher-loglevel, kaf, dbmate, redka, kapp-controller, ghaudit, tekton-chains, ksops, rclone,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, kubernetes-csi-external-provisioner, govulncheck, gcsfuse, ctop, crossplane-provider-azure, go-licenses, nri-kafka, kor, nri-redis, argo-workflows, kubewatch, caddy, nri-haproxy, prometheus-alertmanager, shfmt, scorecard, gomplate,...