GHSA-RV83-G57W-FR8J vulnerabilities

Vulnerabilities for packages: github-mcp-server, blob-csi, opensearch-k8s-operator, cluster-api-helm-controller-fips, k8s-metacollector-fips, temporal-ui-server-fips, crossplane-provider-aws-ec2-fips, logstash-exporter-fips, gitea, fleet-server, local-static-provisioner, flux-source-controller,...

GHSA-2JWV-JMQ4-4J3R vulnerabilities

Vulnerabilities for packages: gosu, go-bindata, pombump, aws-efs-csi-driver, k3d, prometheus-adapter, flannel, cilium-cli, lazygit, docker-credential-ecr-login, prometheus-alertmanager, flux-source-controller, melange, nfs-subdir-external-provisioner, logstash-exporter, oras, harbor-cli,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: logstash-exporter-fips, local-static-provisioner, flux-source-controller, kubernetes-dashboard-fips, flannel, bom, skopeo, confluent-common-docker, zot, dynamic-localpv-provisioner, logstash-exporter, flux-image-reflector-controller, boring-registry-fips,...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: dagger, temporal-ui-server-fips, logstash-exporter-fips, local-static-provisioner, sbomqs, flux-source-controller, helm-docs, flannel, bom, kubernetes-dashboard-fips, skopeo, confluent-common-docker, dynamic-localpv-provisioner, logstash-exporter,...

OSV-2021-1192 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37927 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::PoolBuffer::MakeUnique arrow::AllocateBuffer...

OSV-2021-1189 Segv on unknown address in arrow::DefaultBackend

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=37915 Crash type: Segv on unknown address Crash state: arrow::DefaultBackend arrow::defaultmemorypool arrow::ipc::IpcReadOptions::Defaults...

Exposed Endpoints

github.com/kubernetes/ingress-nginx is uses publicly exposed endpoints. The prometheus metrics and healthz of the Kubernetes defaultbackend can be accessed by a remote attacker using a port-forward request to access the publicly accessible metrics...