GHSA-9GM5-9RFH-M6VX vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, eks-distro, juicefs, k8sgateway, kubernetes-dns-node-cache, kubernetes-dns-node-cache-fips, eks-distro-fips...

CVE-2026-86003 vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, eks-distro, juicefs, k8sgateway, kubernetes-dns-node-cache, kubernetes-dns-node-cache-fips, eks-distro-fips...

GHSA-MRG3-QVQR-JW29 vulnerabilities

Vulnerabilities for packages: k8sgateway-fips, eks-distro, juicefs, k8sgateway, kubernetes-dns-node-cache, kubernetes-dns-node-cache-fips, eks-distro-fips...

CVE-2026-85721 vulnerabilities

Vulnerabilities for packages: druid, apache-pulsar, tez, pinot-fips, apache-pulsar-fips, pinot...

CVE-2026-85717 vulnerabilities

Vulnerabilities for packages: druid, apache-pulsar, tez, pinot-fips, apache-pulsar-fips, pinot...

GHSA-F8M2-889X-VW4X vulnerabilities

Vulnerabilities for packages: druid, apache-pulsar, tez, pinot-fips, apache-pulsar-fips, pinot...

GHSA-7GRG-JCF7-RPMX vulnerabilities

Vulnerabilities for packages: druid, apache-pulsar, tez, pinot-fips, apache-pulsar-fips, pinot...

CVE-2026-86000 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow, open-webui...

CVE-2026-85999 vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow, open-webui...

GHSA-GJV8-XP57-G29C vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow, open-webui...

GHSA-J934-XHV5-FG8F vulnerabilities

Vulnerabilities for packages: datadog-agent-fips, airflow, open-webui...

PT-2026-95844

Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=true, ssl.quorum.hostnameVerification=true, and ssl.quorum.clientHostnameVerification=true are enabled, the Java SSLSocket quorum path accepts a CA-trusted pe...

GHSA-H7VF-4X9W-H99V vulnerabilities

Vulnerabilities for packages: kube-arangodb, ocm-kubernetes-controller, maru, helm-push, chaos-mesh-fips, ocm-cli-fips, chaos-mesh, cert-manager-cmctl, ocm-kubernetes-controller-fips, redpanda-operator, gitlab-operator, cloudbeat-fips, k8sgpt, tigera-operator-fips, ocm-cli, xeol, gitness,...

CVE-2026-81870 vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana-fips, clickhouse-operator, metrics-server-fips, k8s-agents-operator-fips, cloudprober, db-operator, packer, cluster-api-aws-controller, amazon-cloudwatch-agent-operator, cloudflared-fips, gitlab-elasticsearch-indexer-fips,...

GHSA-8WMF-6V46-5GFG vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana-fips, clickhouse-operator, metrics-server-fips, k8s-agents-operator-fips, cloudprober, db-operator, packer, cluster-api-aws-controller, amazon-cloudwatch-agent-operator, cloudflared-fips, gitlab-elasticsearch-indexer-fips,...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: kube-arangodb, ocm-kubernetes-controller, maru, helm-push, chaos-mesh-fips, ocm-cli-fips, chaos-mesh, cert-manager-cmctl, ocm-kubernetes-controller-fips, redpanda-operator, gitlab-operator, cloudbeat-fips, k8sgpt, tigera-operator-fips, ocm-cli, xeol, gitness,...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure via sanitizeCryptoModule in lib/builtin.js, where a NodeVM that allowlists the crypto builtin exposes crypto.setFips...

CVE-2026-93604

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93604

vm2 through 3.12.0 allows untrusted guest code to cross the NodeVM isolation boundary when the embedder allowlists the crypto builtin. The builtin sanitizer in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper does not localize side effects of f...

CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...