CVE-2025-14269

CVE-2025-14269 A security issue was discovered in the in-cluster version of Headlamp where unauthenticated users may be able to reuse cached credentials to access Helm functionality through the Headlamp UI. Kubernetes clusters are only affected if Headlamp is installed, is configured with...

GO-2026-6609 vulnerabilities

Vulnerabilities for packages: filebrowser, juicefs, grafana-alloy, prometheus-adapter, cert-manager, flux-source-controller, loki, chartmuseum, ingress-nginx-controller, gitness, step, falco-no-driver, cert-manager-webhook-pdns, zarf, continuity, kyverno-policy-reporter, external-dns, gitlab-page...

GHSA-F4XW-M386-M277 vulnerabilities

Vulnerabilities for packages: filebrowser, juicefs, grafana-alloy, prometheus-adapter, cert-manager, flux-source-controller, loki, chartmuseum, ingress-nginx-controller, gitness, step, falco-no-driver, cert-manager-webhook-pdns, zarf, continuity, kyverno-policy-reporter, external-dns, gitlab-page...

GHSA-PG57-6JWG-Q645 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, helm-operator-fips, buildkitd-fips, commercial-gitlab-rails-ee-fips, grype-db, rancher-helm, docker-compose-fips, chainctl-fips, kube-mgmt, kube-arangodb, helm-push, helm-exporter, helm-set-status, neuvector-scanner, packer, trivy-fips,...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, helm-operator-fips, buildkitd-fips, commercial-gitlab-rails-ee-fips, grype-db, rancher-helm, docker-compose-fips, chainctl-fips, kube-mgmt, kube-arangodb, helm-push, helm-exporter, helm-set-status, neuvector-scanner, packer, trivy-fips,...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: nerdctl, kubescape, trivy-operator, neuvector-scanner, k3s, steampipe, scorecard, k8sgpt, chartmuseum, zot, trivy, tigera-operator, falco-no-driver, zarf, skaffold, rancher, buildkitd, eksctl, fuse-overlayfs-snapshotter, helm-operator, kube-arangodb, helm-set-status,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, falcoctl-fips, helm-operator-fips, rancher-fleet, cilium-cli, rancher-fleet-fips, kyverno, rancher-helm, kube-mgmt, kube-arangodb, helm-push, vcluster, helm-exporter, helm-set-status, oras-fips, trivy-fips, trivy, oras, ocm-cli-fips,...

GO-2025-3888 vulnerabilities

Vulnerabilities for packages: kubescape, trivy-operator, istio, linkerd2, chart-testing, k8ssandra-client, flux-source-controller, cerbos, k8sgpt, chartmuseum, zot, trivy, zarf, eksctl, nova, helm-operator, helm-set-status, cilium-cli, kots, pluto, flux, cert-manager-cmctl, helm-push, k9s,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: opa, witness, cloud-provider-gcp-cloud-controller-manager, kuberlr, ipfs-cluster, nri-f5, kpt, cerbos, grafana-rollout-operator, argo-events, ko, tekton-chains, kor, kubernetes-csi-driver-hostpath, kubernetes-csi-external-health-monitor, nri-apache, harbor-registry,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, helm-operator-fips, buildkitd-fips, grype-db, rancher-helm, docker-compose-fips, chainctl-fips, kube-mgmt, kube-arangodb, helm-push, helm-exporter, helm-set-status, neuvector-scanner, packer, trivy-fips, docker-cli-buildx-fips, harvester-fips, trivy...

CVE-2026-53488 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, helm-operator-fips, buildkitd-fips, grype-db, rancher-helm, docker-compose-fips, chainctl-fips, kube-mgmt, kube-arangodb, helm-push, helm-exporter, helm-set-status, neuvector-scanner, packer, trivy-fips, docker-cli-buildx-fips, harvester-fips, trivy...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: opa, kubescape, tw, kubescape-operator, trivy-operator, neuvector-scanner, linkerd2, k8ssandra-client, k3s, steampipe, scorecard, chartmuseum, k8sgpt, zot, datadog-agent, trivy, tigera-operator, falco-no-driver, zarf, skaffold, consul-k8s, rancher, buildkitd, eksctl,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: helm-mapkubeapis, helm-operator-fips, buildkitd-fips, grype-db, rancher-helm, docker-compose-fips, chainctl-fips, kube-mgmt, kube-arangodb, helm-push, helm-exporter, helm-set-status, neuvector-scanner, packer, trivy-fips, docker-cli-buildx-fips, trivy,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: kubescape, k8sgpt-operator, trivy-operator, kiali, jitsucom-bulker, istio, kubeflow-pipelines, linkerd2, k8ssandra-client, cluster-api, k3s, kpt, velero, percona-server-mongodb-operator, k8sgpt, datadog-agent, trivy, gitlab-runner, dynamic-localpv-provisioner, zarf,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: kubescape, k8sgpt-operator, trivy-operator, kiali, jitsucom-bulker, istio, kubeflow-pipelines, linkerd2, k8ssandra-client, cluster-api, k3s, kpt, velero, percona-server-mongodb-operator, k8sgpt, datadog-agent, trivy, gitlab-runner, dynamic-localpv-provisioner, zarf,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: kubescape, tw, trivy-operator, istio, linkerd2, chart-testing, k8ssandra-client, flux-source-controller, cerbos, chartmuseum, zot, trivy, tigera-operator, zarf, consul-k8s, eksctl, nova, helm-operator, kube-arangodb, helm-set-status, helm, kuma, cilium-cli, kots,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: kubescape, tw, trivy-operator, istio, linkerd2, chart-testing, k8ssandra-client, flux-source-controller, cerbos, chartmuseum, zot, trivy, tigera-operator, zarf, consul-k8s, eksctl, nova, helm-operator, kube-arangodb, helm-set-status, helm, kuma, cilium-cli, kots,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: chaos-mesh-fips, helm-exporter-fips, pluto-fips, linkerd2, helm-mapkubeapis, harbor-fips, flux-fips, flux, helm-operator-fips, nova-fips, rancher-fleet, cilium-cli, rancher-fleet-fips, headlamp-fips, zarf, zarf-fips, cloudbeat-fips, kube-arangodb-fips, zot,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: opa, metrics-server, witness, cloud-provider-gcp-cloud-controller-manager, trivy-operator, cluster-api, rekor, tailscale, cadvisor, cerbos, cloud-provider-aws, crossplane-provider-family-azure, flux-source-controller, cluster-autoscaler, kube-state-metrics,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: podman-fips, rancher-webhook-fips, witness, telegraf, fulcio, kyverno, backup-restore-operator-fips, commercial-grafana, emissary, ld-relay, go-sqlcmd, kube-state-metrics, docker-compose-fips, kube-mgmt, fluent-operator, eck-operator, certificate-transparency-fips,...