CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: spark-operator, jobset-fips, aws-otel-collector-fips, keda-fips, authentik-fips, crossplane-provider-keycloak-fips, crossplane-provider-gcp-beta-container, dagdotdev, spicedb-fips, kubevela-fips, azuredisk-csi-fips, crossplane-cli, haproxy-ingress-fips, tflint-fips,...

GHSA-8WMF-6V46-5GFG vulnerabilities

Vulnerabilities for packages: spark-operator, jobset-fips, aws-otel-collector-fips, keda-fips, authentik-fips, crossplane-provider-keycloak-fips, crossplane-provider-gcp-beta-container, dagdotdev, spicedb-fips, kubevela-fips, azuredisk-csi-fips, crossplane-cli, haproxy-ingress-fips, tflint-fips,...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: ocm-kubernetes-controller, cert-manager-cmctl, consul-k8s, consul-k8s-fips, tigera-operator-fips, xeol, helm-push, cloudbeat-fips, ocm-cli, kube-arangodb, helm-mapkubeapis, manifest-tool, helm-exporter-fips, kyverno-notation-aws, maru, kyverno, flux-helm-controller,...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure via sanitizeCryptoModule in lib/builtin.js, where a NodeVM that allowlists the crypto builtin exposes crypto.setFips...

CVE-2026-93604

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93604

vm2 through 3.12.0 allows untrusted guest code to cross the NodeVM isolation boundary when the embedder allowlists the crypto builtin. The builtin sanitizer in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper does not localize side effects of f...

CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CLEANSTART-2026-FG82255 Security fix for CVE-2018-15664 applied in: docker 18.09.7-r0, docker-fips 18.09.7-r0

CVE-2018-15664 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KW83332 Security fix for CVE-2019-14271 applied in: docker 19.03.1-r0, docker-fips 19.03.1-r0

CVE-2019-14271 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LO92201 Security fix for CVE-2020-13401 applied in: docker 19.03.11-r0, docker-fips 19.03.11-r0

CVE-2020-13401 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SS82988 Security fix for CVE-2021-41092 applied in: docker 20.10.9-r0, docker-fips 20.10.9-r0

CVE-2021-41092 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GE40868 Security fix for CVE-2023-26054 applied in: docker 23.0.2-r0, docker-fips 23.0.2-r0

CVE-2023-26054 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LT94285 Security fix for CVE-2024-23652 applied in: docker 25.0.2-r0, docker-fips 25.0.2-r0

CVE-2024-23652 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DP59961 Security fix for CVE-2025-0913 applied in: argo-workflows-fips 3.7.0-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, flux-notification-controller-fips 1.5.0-r0, ingress-nginx-controller 1.24.2-r0, k8ssandra-operator-fips 1.24.0-r0, k8ssandra-operator-fips 3.3.0-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, kyverno-policy-reporter-fips 3.1.3-r6, kyverno-policy-reporter-fips 3.2.2, kyverno-policy-reporter-fips 3.3.2, kyverno-policy-reporter-fips 3.3.2-r0, metrics-server 0.8.0-r0, metrics-server-fips 0.8.0-r3, minio-client-fips 0.20250416181326-r2, minio-client-fips 0.20250521015954-r2, minio-client-fips 0.20250716.153503-r2, minio-client-fips 0.20250721052808-r2, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r0, opensearch-k8s-operator-fips 2.6.1-r0, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r7, runc 1.1.14-r0

CVE-2025-0913 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UZ56675 Security fix for CVE-2025-47907 applied in: argo-workflows-fips 3.7.0-r0, cert-manager-webhook-pdns-fips 3.0.0-r0, cert-manager-webhook-pdns-fips 3.1.3-r0, cert-manager-webhook-pdns-fips 3.2.3-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.1-r0, consul-k8s-fips 1.8.6-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.40.0-r3, dex-fips 2.41.1-r3, dex-fips 2.42.1-r3, dex-fips 2.43.1-r3, druid-exporter-fips 0.10-r0, druid-exporter-fips 0.11-r1, fluent-operator-fips 3.1.0-r3, flux-notification-controller-fips 1.5.0-r0, gomplate 4.3.3-r0, gomplate-fips 4.3.3-r0, gosu 1.17-r5, harbor-fips 2.10.3-r0, harbor-fips 2.11.2-r3, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, harbor-registry 3.0.0.1-r2, k8ssandra-operator-fips 1.24.0-r0, k8ssandra-operator-fips 3.3.0-r3, kubernetes-csi-node-driver-registrar 2.13.0-r0, kyverno-fips 1.11.5-r6, kyverno-fips 1.12.7-r5, kyverno-fips 1.14.4-r1, kyverno-policy-reporter-fips 3.0.7-r5, kyverno-policy-reporter-fips 3.1.3-r6, kyverno-policy-reporter-fips 3.2.2, kyverno-policy-reporter-fips 3.3.2, kyverno-policy-reporter-fips 3.3.2-r0, kyverno-policy-reporter-kyverno-plugin-fips 1.3.1-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r2, kyverno-policy-reporter-kyverno-plugin-fips 1.5.2-r1, kyverno-policy-reporter-kyverno-plugin-fips 1.6.4-r1, metrics-server 0.8.0-r0, metrics-server-fips 0.8.0-r3, minio-client-fips 0.20250416181326-r2, minio-client-fips 0.20250521015954-r2, minio-client-fips 0.20250716.153503-r2, minio-client-fips 0.20250721052808-r2, minio-operator-fips 4.5.8-r3, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r0, opensearch-k8s-operator-fips 2.6.1-r0, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r7, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0

CVE-2025-47907 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RW27001 Security fix for CVE-2022-41717 applied in: cfssl 1.5.0-r1, minio-client-fips 0.20250416181326-r0, minio-client-fips 0.20250521015954-r0, minio-client-fips 0.20250716.153503-r0, minio-client-fips 0.20250721052808-r0, wavefront-collector-for-kubernetes 1.13.0-r0

CVE-2022-41717 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UY23574 Security fix for CVE-2022-21698 applied in: cert-manager-webhook-pdns-fips 2.3.0-r0, druid-exporter-fips 0.11-r0, kubernetes 1.33.13-r0

CVE-2022-21698 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-PP55064 Security fix for CVE-2023-25151 applied in: cert-manager-webhook-pdns-fips 2.3.0-r0, druid-exporter-fips 0.11-r0, kubernetes 1.33.13-r0

CVE-2023-25151 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LO55255 Security fix for CVE-2023-45142 applied in: cert-manager-webhook-pdns-fips 2.3.0-r0, druid-exporter-fips 0.11-r0, kubernetes 1.33.13-r0

CVE-2023-45142 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...