112 matches found
EUVD-2026-78077
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer.ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer.Get writes the sam...
CVE-2026-53717: Memory Allocation with Excessive Size Value
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm.code.image.url values to Docker or OCI Wasm layers, and...
RHEL 9 : image-builder (RHSA-2026:65886)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65886 advisory. A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fixes:...
Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 3.3.7
Red Hat OpenShift Service Mesh 3.3.7 This update has a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. Red Hat OpenShift Service Mesh 3.3....
RHEL 9 : osbuild-composer (RHSA-2026:65153)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:65153 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...
SUSE CVE-2026-47427
GitHub MCP Server is GitHub's official MCP Server. Prior to 1.1.0, the CompletionsHandler function in pkg/github/server.go accesses params.Ref without first checking whether it is nil, so a completion/complete request with a missing or empty ref field triggers a nil pointer dereference and a Go...
CVE-2026-79777 rclone before v1.75.0 Information Disclosure via RC API
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
EUVD-2026-65535
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses...
AZL-97649 CVE-2026-17113 affecting package cri-o 1.30.1-1
A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...
CVE-2026-17113: Improper Validation of Specified Type of Input
A flaw was found in CRI-O's container-creation environment-variable handling mergeEnvs in server/utils.go, consumed by setupContainerEnvironmentAndWorkdir in server/containercreate.go. When a CreateContainer request supplies a nil CRI Envs field, CRI-O falls back to using the target OCI image's...
GO-2026-6237 vulnerabilities
Vulnerabilities for packages: kube-vip, cni-plugins...
OPENSUSE-SU-2026:11514-1 containerized-data-importer1.66-api-1.66.0-1.1 on GA media
These are all security issues fixed in the containerized-data-importer1.66-api-1.66.0-1.1 package on the GA media of openSUSE Tumbleweed...
GO-2024-3042 vulnerabilities
Vulnerabilities for packages: podman...
GO-2023-2042 vulnerabilities
Vulnerabilities for packages: metrics-server...
GO-2023-1897 vulnerabilities
Vulnerabilities for packages: k3d...
GO-2025-3833 vulnerabilities
Vulnerabilities for packages: grafana-pyroscope...
GO-2023-2185 vulnerabilities
Vulnerabilities for packages: go...
GO-2026-5021 vulnerabilities
Vulnerabilities for packages: falco-no-driver, gatekeeper, vault, helm, kyverno, upwind-agent, commercial-expanso-edge, omnictl-multiarch, terragrunt, harbor, external-secrets-operator, keda-fips, argocd-image-updater, flux, argo-events-fips, apply-cve-bump, mattermost-fips, telegraf, argo-cd,...
GO-2025-4008 vulnerabilities
Vulnerabilities for packages: livekit-egress, yace-fips, hivemind, crossplane-function-auto-ready-fips, velero, sigstore-scaffolding, aws-signer-notation-plugin-fips, apm-server-fips, conftest, pvc-autoresizer-fips, gke-gcloud-auth-plugin, neuvector-dbgen, prometheus-adapter, crossplane,...