CLEANSTART-2026-DR03869 Security fixes in kubernetes-csi-external-provisioner-fips 6.2.1-r1

Package kubernetes-csi-external-provisioner-fips version 6.2.1-r1 fixes 29 vulnerabilities: CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-56853, CVE-2026-56859...

CLEANSTART-2026-OR64895 Security fixes in kubernetes-csi-external-provisioner-fips 6.2.1-r2

Package kubernetes-csi-external-provisioner-fips version 6.2.1-r2 fixes 21 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-HV38878 Security fixes in kubernetes-csi-external-provisioner-fips 6.2.1-r3

Package kubernetes-csi-external-provisioner-fips version 6.2.1-r3 fixes 27 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kubescape, cluster-api, helm-operator, cilium, cluster-api-gcp-controller, yunikorn-k8shim, metrics-server, k3s, k8ssandra-client, pulumi-kubernetes-operator, descheduler, kubernetes, cert-manager, rke2-cloud-provider, kubernetes-csi-external-provisioner,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, flux-notification-controller, metrics-server, ollama, timoni, zot, kube-state-metrics-fips, k3s, nfs-subdir-external-provisioner, secrets-store-csi-driver-provider-gcp, stakater-reloader, cosign, vertical-pod-autoscaler, trillian,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: k8sgpt, sops, osv-scanner, step, hubble-ui, zarf, falcosidekick, terraform-docs, grafana-agent-operator, cloudnative-pg, dagger, kaniko, certificate-transparency, fulcio, step-ca, spegel, k3s, spire-server, temporal, tempo, tflint, k8sgpt-operator, conftest, dex,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: k8sgpt, trillian, git-lfs, bank-vaults, aws-load-balancer-controller, oauth2-proxy, secrets-store-csi-driver, trust-manager, kubeflow, helm, aactl, buildkitd, kubernetes-dashboard, metrics-server, k3s, vertical-pod-autoscaler, frp, k8sgpt-operator,...

SUSE CVE-2026-55429

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob...

CLEANSTART-2026-AI73891 Security fixes in kubernetes-csi-external-provisioner-fips 6.1.0-r0

Package kubernetes-csi-external-provisioner-fips version 6.1.0-r0 fixes 7 vulnerabilities: CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2025-61730, CVE-2025-61726...

CLEANSTART-2026-ZB04903 Security fixes in kubernetes-csi-external-provisioner-fips 6.2.0-r0

Package kubernetes-csi-external-provisioner-fips version 6.2.0-r0 fixes 4 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-25679, CVE-2026-33186...

CLEANSTART-2026-CC95374 Security fixes in kubernetes-csi-external-provisioner-fips 6.2.0-r1

Package kubernetes-csi-external-provisioner-fips version 6.2.0-r1 fixes 8 vulnerabilities: CVE-2026-39883, CVE-2026-32282, CVE-2026-32281, CVE-2026-32288, CVE-2026-32289...

CLEANSTART-2026-PQ77493 Security fixes in kubernetes-csi-external-provisioner-fips 6.1.0-r4

Package kubernetes-csi-external-provisioner-fips version 6.1.0-r4 fixes 32 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811...

CLEANSTART-2026-WK17839 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-32281, CVE-2026-32283, CVE-2026-33186, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3 applied in versions: 6.1.0-r0, 6.1.0-r1, 6.1.0-r2, 6.1.0-r3, 6.1.0-r4

Multiple security vulnerabilities affect the kubernetes-csi-external-provisioner-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OF46770 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-32281, CVE-2026-32283, CVE-2026-33186, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3 applied in versions: 6.1.0-r0, 6.1.0-r1, 6.1.0-r2, 6.1.0-r3, 6.1.0-r4

Multiple security vulnerabilities affect the kubernetes-csi-external-provisioner-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: langfuse-fips, kaniko-fips, crossplane-provider-aws-glue, kueue-fips, vertical-pod-autoscaler, go-fips, kube-metrics-adapter-fips, mattermost, envoy-ai-gateway-fips, crossplane-provider-aws-kinesisanalytics-fips, crossplane-provider-aws-oam-fips, rke2-cloud-provider,...

Improper Authorization

github.com/coder/coder is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation in the UpsertWorkspaceApp and insertAgentApp functions, which fail to verify that a supplied application ID belongs to the workspace being built before performing a cross-workspace...

CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...