CVE-2026-41491 vulnerabilities

Vulnerabilities for packages: dapr...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: gitlab-cng-fips, azure-service-operator-fips, argo-workflows-fips, commercial-expanso-edge, goose, bento, amass, pgtimetable-fips, gotrue, cloudnative-pg-fips, pgtimetable, keda, src, rke2-runtime, commercial-grafana, ory-kratos, vault, certificate-transparency-fips,...

CVE-2026-41491 vulnerabilities

Vulnerabilities for packages: dapr...

GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: argo-workflows, splunk-otel-collector, src, kine, rke2-cloud-provider, sftpgo-plugin-eventstore, openfga, grafana, k3s, spire-server, gitlab-kas, temporal-server, spicedb, kubeflow-pipelines, ferretdb, gitness, cloudnative-pg, amass, telegraf, teleport, bento, keda,...

GHSA-85GX-3QV6-4463 vulnerabilities

Vulnerabilities for packages: dapr...

GHSA-85GX-3QV6-4463 vulnerabilities

Vulnerabilities for packages: dapr...

Dapr: Service Invocation path traversal ACL bypass

Summary A vulnerability has been found in Dapr that allows bypassing access control policies for service invocation using reserved URL characters and path traversal sequences in method paths. The ACL normalized the method path independently from the dispatch layer, so the ACL evaluated one path...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the service invocation access control process. An attacker can bypass access control policies and invoke unauthorized methods by submitting specially crafted method paths containing encoded path traversal...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the service invocation access control process. An attacker can bypass access control policies and invoke unauthorized methods by submitting specially crafted method paths containing encoded path traversal...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the service invocation access control process. An attacker can bypass access control policies and invoke unauthorized methods by submitting specially crafted method paths containing encoded path traversal...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the service invocation access control process. An attacker can bypass access control policies and invoke unauthorized methods by submitting specially crafted method paths containing encoded path traversal...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the service invocation access control process. An attacker can bypass access control policies and invoke unauthorized methods by submitting specially crafted method paths containing encoded path traversal...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the service invocation access control process. An attacker can bypass access control policies and invoke unauthorized methods by submitting specially crafted method paths containing encoded path traversal...

PT-2026-37119

Name of the Vulnerable Software and Affected Versions Dapr versions 1.3.0 through 1.15.13 Dapr versions 1.16.0-rc.1 through 1.16.13 Dapr versions 1.17.0-rc.1 through 1.17.4 Description An issue exists in the way access control policies for service invocation are handled. The Access Control List A...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: tekton-chains, argo-workflows-fips, commercial-expanso-edge, kserve, reports-server, amazon-ssm-agent, omni-fips, src, grafana-pyroscope, seaweedfs-operator-fips, podman, distribution, bento-fips, sops-fips, gcsfuse, knative-eventing, telegraf, minio, gitlab-cng,...

CVE-2022-38817

Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data...

GHSA-32FW-GQ77-F2F2 vulnerabilities

Vulnerabilities for packages: falcosidekick, minio, bento...

CVE-2025-10543 vulnerabilities

Vulnerabilities for packages: falcosidekick, minio, bento...

GHSA-32FW-GQ77-F2F2 vulnerabilities

Vulnerabilities for packages: dapr-fips, falcosidekick, zabbix-agent2, beats-fips, agentbeat, beats, elastic-agent-fips, influxd, telegraf, dapr, agentbeat-fips, bento, elastic-agent, minio-fips, minio, zabbix-agent2-fips, falcosidekick-fips...

CVE-2025-10543 vulnerabilities

Vulnerabilities for packages: dapr-fips, falcosidekick, zabbix-agent2, beats-fips, agentbeat, beats, elastic-agent-fips, influxd, telegraf, dapr, agentbeat-fips, bento, elastic-agent, minio-fips, minio, zabbix-agent2-fips, falcosidekick-fips...