GO-2026-4942 vulnerabilities

Vulnerabilities for packages: portieris, gitness, kots, argocd-image-updater, envoy-gateway, zot...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2025-3418 vulnerabilities

Vulnerabilities for packages: envoy-gateway...

GO-2026-4771 vulnerabilities

Vulnerabilities for packages: vault-fips, envoy-gateway-fips, teleport, vault, gitaly, commercial-grafana...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: envoy-gateway, kine, commercial-chainloop-backend, k3s, commercial-expanso-edge, envoy-gateway-fips, spire-server, kots, commercial-grafana...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: envoy-gateway, portieris-fips, gitlab-rails-ce, gitness, gitlab-rails-ce-fips, zot, envoy-gateway-fips, argocd-image-updater-fips, argocd-image-updater, portieris, kots...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: k9s-fips, kubescape-server-fips, cloudbeat, cluster-api-helm-controller-fips, drone, zarf-fips, helm-exporter, tigera-operator, helm-push, zarf, gitlab-operator, crossplane-fips, helm-mapkubeapis, kubescape-operator, cert-manager-cmctl, gatekeeper, maru, kots,...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: envoy-gateway, portieris-fips, gitlab-rails-ce, gitness, gitlab-rails-ce-fips, zot, envoy-gateway-fips, argocd-image-updater-fips, argocd-image-updater, portieris, kots...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: google-cloud-otel-ops-collector, kubescape-server-fips, docker-compose-fips, ferretdb, elastic-agent-fips, opa-fips, tkn, elastic-agent, k6-fips, net-kourier, commercial-grafana, aws-otel-collector-fips, cortex, flux-notification-controller,...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: gitness, gitleaks, filebrowser, trivy, nuclei, grafana-alloy, zarf, guac, kubescape-operator, podman, gptscript, trufflehog, xeol, undock, nsc, envoy-gateway, zot, steampipe, trivy-operator, k9s, opentofu, tflint, vcluster, terragrunt, rancher-fleet, terraform...

GO-2026-4772 vulnerabilities

Vulnerabilities for packages: spire-server, k3s, kine, kots, envoy-gateway...

GO-2025-3418 vulnerabilities

Vulnerabilities for packages: envoy-gateway...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: eksctl, chartmuseum, helm-docs, helm-push, trivy, cilium-cli, pluto, zarf, cluster-api-helm-controller, flux-source-controller, cerbos, tw, cert-manager-cmctl, kargo, rancher-helm, helm-operator, envoy-gateway, zot, istio, k9s, chart-testing, k8ssandra-client, kots,...

GO-2026-5094 vulnerabilities

Vulnerabilities for packages: portieris, gitness, kots, argocd-image-updater, envoy-gateway, zot...

GO-2026-5185 vulnerabilities

Vulnerabilities for packages: portieris, gitness, kots, argocd-image-updater, envoy-gateway, zot...

GO-2026-4985 vulnerabilities

Vulnerabilities for packages: cloudprober, thanos, tekton-pipelines, aactl, splunk-otel-collector, teleport, docker-cli-buildx, kiali, opentelemetry-operator, grafana-rollout-operator, buildkitd, grafana-mimir, opentofu, amazon-cloudwatch-agent, terragrunt, distribution,...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18673 Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network...

CVE-2026-18673

Kong Mesh CVE-2026-18673 affects kuma-dp readiness service. When Envoy admin API is exposed on a TCP port (9902) while the Envoy admin API is connected to a Unix domain socket by default, the readiness endpoint forwards a large portion of the Envoy admin API to any caller on the port without auth...