GO-2026-6506 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache-fips, eks-distro-fips, k8sgateway-fips, eks-distro, k8sgateway, kubernetes-dns-node-cache...

GO-2026-6506 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, juicefs, k8sgateway...

GO-2026-6507 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache-fips, eks-distro-fips, k8sgateway-fips, eks-distro, k8sgateway, kubernetes-dns-node-cache...

GO-2026-6507 vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, juicefs, k8sgateway...

CVE-2026-82399 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache-fips, eks-distro-fips, k8sgateway-fips, eks-distro, k8sgateway, kubernetes-dns-node-cache...

GHSA-9GM5-9RFH-M6VX vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache-fips, eks-distro-fips, k8sgateway-fips, eks-distro, k8sgateway, kubernetes-dns-node-cache...

CVE-2026-86003 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache-fips, eks-distro-fips, k8sgateway-fips, eks-distro, k8sgateway, kubernetes-dns-node-cache...

GHSA-MRG3-QVQR-JW29 vulnerabilities

Vulnerabilities for packages: juicefs, kubernetes-dns-node-cache-fips, eks-distro-fips, k8sgateway-fips, eks-distro, k8sgateway, kubernetes-dns-node-cache...

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

EUVD-2026-63899

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763

JuiceFS filestore backend (pkg/object/file.go) contains a path traversal vulnerability. The path(key) function joined object keys onto the storage root using filepath.Join or filepath.Clean without verifying the resolved path remained beneath the root. All operations—Put, Get, Head, Delete, Chmod...

CVE-2026-77763 JuiceFS Local Filestore Backend Joins Object Keys onto the Storage Root Without a Containment Check, Allowing Writes Outside the Configured Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

CVE-2026-77763: Improper Limitation of a Pathname to a Restricted Directory

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

PT-2026-79360

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

GO-2026-6091 vulnerabilities

Vulnerabilities for packages: blob-csi, grype, k8sgpt, kubernetes-dashboard-web, kubescape, prometheus-operator, crossplane-provider-aws-rds, kubernetes-dashboard-api, azure-service-operator, crossplane-provider-aws-cloudformation, net-kourier, xeol, gh, opentelemetry-collector-contrib,...

CVE-2026-56858 vulnerabilities

Vulnerabilities for packages: blob-csi, grype, k8sgpt, kubernetes-dashboard-web, kubescape, prometheus-operator, crossplane-provider-aws-rds, kubernetes-dashboard-api, azure-service-operator, crossplane-provider-aws-cloudformation, net-kourier, xeol, gh, opentelemetry-collector-contrib,...

CVE-2026-56859 vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator, k8sgpt, prometheus-operator, net-kourier, spark-operator, crossplane-provider-aws-s3, kubernetes-csi-external-resizer, weaviate, percona-server-mongodb-operator, crossplane-provider-family-aws, terraform, terraform-provider-acme, gostatsd...

GO-2026-6088 vulnerabilities

Vulnerabilities for packages: mongodb-kubernetes-operator, k8sgpt, prometheus-operator, net-kourier, spark-operator, crossplane-provider-aws-s3, kubernetes-csi-external-resizer, weaviate, percona-server-mongodb-operator, crossplane-provider-family-aws, terraform, terraform-provider-acme, gostatsd...