GO-2023-1988 vulnerabilities

Vulnerabilities for packages: gomplate, pulumi-language-yaml, chartmuseum, prometheus-statsd-exporter-fips, rqlite, kubevela, trillian, dynamic-localpv-provisioner, fuse-overlayfs-snapshotter, src, aws-efs-csi-driver, prometheus-alertmanager, prometheus-bind-exporter, node-problem-detector,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: k3d, opa, osv-scanner, spire-server, vcluster, kube-rbac-proxy, cloudnative-pg, sigstore-scaffolding, zarf, gomplate, opentelemetry-collector-contrib, ksops, step-ca, rqlite, grafana-mimir, cilium-cli, melange, certificate-transparency, pulumi-language-dotnet, sops,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner, kubernetes-csi-livenessprobe, aws-load-balancer-controller, oauth2-proxy, pulumi, vault-k8s, hey, metacontroller, timoni, bank-vaults, k3s, runc, src, kubeflow, kubevela, bom, kube-logging-operator, trust-manager, metrics-server,...

SUSE CVE-2026-55429

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob...

CLEANSTART-2026-ZB04903 Security fixes in kubernetes-csi-external-provisioner-fips 6.2.0-r0

Package kubernetes-csi-external-provisioner-fips version 6.2.0-r0 fixes 4 vulnerabilities: CVE-2026-27139, CVE-2026-27142, CVE-2026-25679, CVE-2026-33186...

CLEANSTART-2026-AI73891 Security fixes in kubernetes-csi-external-provisioner-fips 6.1.0-r0

Package kubernetes-csi-external-provisioner-fips version 6.1.0-r0 fixes 7 vulnerabilities: CVE-2026-25679, CVE-2026-27139, CVE-2026-27142, CVE-2025-61730, CVE-2025-61726...

CLEANSTART-2026-CC95374 Security fixes in kubernetes-csi-external-provisioner-fips 6.2.0-r1

Package kubernetes-csi-external-provisioner-fips version 6.2.0-r1 fixes 8 vulnerabilities: CVE-2026-39883, CVE-2026-32282, CVE-2026-32281, CVE-2026-32288, CVE-2026-32289...

CLEANSTART-2026-PQ77493 Security fixes in kubernetes-csi-external-provisioner-fips 6.1.0-r4

Package kubernetes-csi-external-provisioner-fips version 6.1.0-r4 fixes 32 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811...

CLEANSTART-2026-WK17839 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-32281, CVE-2026-32283, CVE-2026-33186, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3 applied in versions: 6.1.0-r0, 6.1.0-r1, 6.1.0-r2, 6.1.0-r3, 6.1.0-r4

Multiple security vulnerabilities affect the kubernetes-csi-external-provisioner-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OF46770 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-32281, CVE-2026-32283, CVE-2026-33186, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3 applied in versions: 6.1.0-r0, 6.1.0-r1, 6.1.0-r2, 6.1.0-r3, 6.1.0-r4

Multiple security vulnerabilities affect the kubernetes-csi-external-provisioner-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, crossplane-provider-aws-codecommit, crossplane-provider-azure-portal, crossplane-provider-terraform-fips, k8s-metacollector-fips, crossplane-function-environment-configs-fips, crossplane-provider-aws-mq-fips,...

Improper Authorization

github.com/coder/coder is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation in the UpsertWorkspaceApp and insertAgentApp functions, which fail to verify that a supplied application ID belongs to the workspace being built before performing a cross-workspace...

CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the UpsertWorkspaceApp process. An attacker can gain unauthorized access to another user's workspace app by submitting a crafted payload with a known victim app UUID and an...

PT-2026-56073

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.34.2 Coder versions prior to 2.33.8 Coder versions prior to 2.32.7 Coder versions prior to 2.29.17 Description An issue exists where the UpsertWorkspaceApp function overwrites an existing application's agent id during...

CLEANSTART-2026-WS85269 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-27139, CVE-2026-27142, CVE-2026-32281, CVE-2026-32283, CVE-2026-33186, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-39883, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3 applied in versions: 6.1.0-r0, 6.1.0-r1, 6.1.0-r2, 6.1.0-r3, 6.1.0-r4

Multiple security vulnerabilities affect the kubernetes-csi-external-provisioner-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: flux, grafana-operator, envoy-ratelimit, nfs-subdir-external-provisioner, osv-scanner, smarter-device-manager, spire-server, polaris, ingress-nginx-controller, actions-runner-controller, sftpgo-plugin-eventsearch, goreleaser, aws-load-balancer-controller, pluto, apko...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: vgpu-util, gitlab-cng, flux-source-controller-fips, aws-privateca-issuer-fips, rke2-runtime, trillian, promxy-fips, velero-fips, kubernetes-dashboard-api, wave-fips, fuse-overlayfs-snapshotter, ytt, kubo-fips, crossplane-provider-azure-sql, cilium-fips, nri-mysql,...