GO-2025-3547 vulnerabilities

Vulnerabilities for packages: rke2-runtime-fips, eks-distro, harvester-fips, longhorn-share-manager-fips, harvester, azurefile-csi, longhorn-manager, kubernetes-csi-driver-hostpath, longhorn-manager-fips, rancher-system-agent, longhorn-share-manager, argo-cd-fips, azuredisk-csi, azurefile-csi-fip...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, kubernetes, argocd-image-updater-fips, aws-efs-csi-driver, ip-masq-agent, spark-operator, aws-ebs-csi-driver, kubernetes-csi-driver-hostpath, argocd-image-updater, nodetaint, rancher-webhook, aws-efs-csi-driver-fips, kubeflow-pipelines,...

GO-2025-3547 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, rancher-system-agent...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, melange, zot, osv-scanner, sops, dbmate, spicedb, opa, pulumi-language-dotnet, k3s, kube-rbac-proxy, spire-server, grpc-health-probe, conftest, zarf, kubernetes-csi-driver-hostpath, rqlite, terragrunt, opentelemetry-collector-contrib, tempo, k8sgp...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, ip-masq-agent, cri-tools, spark-operator, k8s-device-plugin, argocd-image-updater, kubeflow-pipelines, aws-efs-csi-driver, nodetaint, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, ip-masq-agent, spark-operator, yunikorn-k8shim, argocd-image-updater, argo-rollouts, aws-efs-csi-driver, kubernetes, nodetaint, emissary, kubernetes-csi-driver-nfs, vcluster, rancher-fleet, kapp, kubernetes-csi-driver-hostpath,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: kube-bench, chartmuseum, gobuster, cluster-api-provider-vsphere, kind, kubernetes-csi-driver-hostpath, gcsfuse, nats-server-config-reloader, mockgen, kpt, tkn, aws-privateca-issuer, docker-credential-gcr, k8sgateway, dgraph, dive, kubeflow-katib, ko, oauth2-proxy,...

CVE-2026-44180

CVE-2026-44180 affects Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids can be bypassed to run kernels as root by supplying KERNEL_UID/KERNEL_GID values with whitespace. Affected versions: 2.0.0rc1 through

CVE-2024-7598 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, rancher-system-agent...

GHSA-R56H-J38W-HRQQ vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, rancher-system-agent...

CVE-2026-44543 Local Path Provisioner: HelperPod Template Injection

Local Path Provisioner provides a way for the Kubernetes users to utilize the local storage in each node. Prior to 0.0.36, a malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by...

Local Path Provisioner Vulnerable to HelperPod Template Injection

Impact A malicious user with permission to edit the local-path-config ConfigMap in the local-path-storage namespace can manipulate the helperPod.yaml template used by rancher/local-path-provisioner. The helperPod.yaml template is loaded by the provisioner and used to create HelperPods during PVC...

Bypassing Kyverno Policies via Double Policy Exceptions

Summary If a cluster has a Kyverno policy in enforce mode and there are two exceptions, this allows the policy to be bypassed, even if the first exception is more restrictive than the second. Details The following policy was applied: yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata:...

EUVD-2023-0865

Malicious code in bioql PyPI...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Linux Distros Unpatched Vulnerability : CVE-2021-43816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - containerd is an open source container runtime. On installations using SELinux, such as EL8 CentOS, RHEL, Fedora, or SUSE MicroOS, with containerd since...

CVE-2024-45497

A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories...

CVE-2024-45497

A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories...

GHSA-82M2-CV7P-4M75 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, ip-masq-agent, cri-tools, spark-operator, k8s-device-plugin, argocd-image-updater, kubeflow-pipelines, aws-efs-csi-driver, nodetaint, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache...

CVE-2024-5321 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, ip-masq-agent, cri-tools, spark-operator, k8s-device-plugin, argocd-image-updater, kubeflow-pipelines, aws-efs-csi-driver, nodetaint, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache...