GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: telegraf, reports-server, snyk-cli, spire-server, kyverno, backup-restore-operator, flux, prometheus-operator, containerd, kots, zot, aactl, cert-manager, prometheus, kaf, k3d, k3s, cilium, minio, zitadel, terraform, loki, nerdctl, elastic-agent-fips, kine,...

GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: nerdctl, containerd, prometheus-operator, kots, minio, zot, spire-server, flux, aactl, k3s, telegraf, loki, snyk-cli, k3d, kaf, kyverno, kine...

CVE-2026-57497 vulnerabilities

Vulnerabilities for packages: rke2-runtime, kubo, k3s, ipfs-cluster, rke2-runtime-fips...

GHSA-G35J-M5XG-VH3Q vulnerabilities

Vulnerabilities for packages: rke2-runtime, kubo, k3s, ipfs-cluster, rke2-runtime-fips...

GHSA-G35J-M5XG-VH3Q vulnerabilities

Vulnerabilities for packages: kubo, ipfs-cluster, k3s...

CVE-2026-57497 vulnerabilities

Vulnerabilities for packages: kubo, ipfs-cluster, k3s...

GO-2026-5973 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression in github.com/k3s-io/k3s. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from...

EUVD-2026-39512

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression...

K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

GHSA-JXR7-MQHW-9P98 K3s: ZIP Archive Path Traversal Vulnerability in etcd Snapshot Decompression

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

GHSA-MQR9-HJR8-2M9W vulnerabilities

Vulnerabilities for packages: k3s...

CVE-2023-26248 vulnerabilities

Vulnerabilities for packages: k3s...

GHSA-MQR9-HJR8-2M9W vulnerabilities

Vulnerabilities for packages: rke2-runtime, k3s, rke2-runtime-fips...

CVE-2023-26248 vulnerabilities

Vulnerabilities for packages: rke2-runtime, k3s, rke2-runtime-fips...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kubescape, reports-server, fscrypt, snyk-cli, knative-serving-fips, skaffold-fips, backup-restore-operator, prometheus-elasticsearch-exporter, flux-image-automation-controller, frankenphp-8.4, vitess, frankenphp-8.2, kots, cert-manager, gitea, prometheus-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux-source-controller, terragrunt, fulcio, crossplane-provider-azure-storage, external-dns, opentelemetry-collector, pulumi-language-yaml, prometheus, k3s, zarf, hcloud, k8sgpt, chisel, step-kms-plugin, steampipe, argo-events, kaf, tflint, containerd, caddy,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: argocd-image-updater, flux-source-controller, aactl, loki, cloud-provider-aws, gitea, nerdctl, external-dns, opentelemetry-collector, zot, mattermost, fscrypt, kubernetes, prometheus, istio, k3s, knative-serving, telegraf, trivy, zarf, cilium-cli, helm, kubescape,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: aactl, loki, cloud-provider-aws, nerdctl, external-dns, podman, opentelemetry-collector, zot, mattermost, fscrypt, kubernetes, prometheus, istio, k3s, knative-serving, telegraf, cilium-cli, helm, kyverno, kine, cilium, kots, rancher, docker-cli-buildx, spire-server,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, flux-source-controller, aactl, loki, cloud-provider-aws, gitea, nerdctl, external-dns, docker-machine-driver-harvester, opentelemetry-collector, zot, mattermost, fscrypt, kubernetes, prometheus, istio, k3s, knative-serving, telegraf, trivy, zarf...

GHSA-78MQ-XCR3-XM33 vulnerabilities

Vulnerabilities for packages: nfpm, argocd-image-updater, argo-cd, flux-source-controller, gomplate, pulumi-language-dotnet, aactl, chezmoi, syft, terragrunt, loki, cloud-provider-aws, apko, gitea, nerdctl, pulumi-kubernetes-operator, external-dns, podman, gptscript, opentelemetry-collector,...