63 matches found
CVE-2026-89039
A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...
CVE-2026-89039
The k6 MCP server is vulnerable to a path traversal flaw in the convert_playwright_script prompt via the playwright_script argument. While @-prefixed paths are restricted to the current working directory, bare paths follow an undocumented code path with no restrictions, allowing callers to read a...
CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6
A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...
CVE-2026-89039 Arbitrary file read via the convert_playwright_script prompt in mcp-k6
A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...
EUVD-2026-92434
A caller who can invoke the convertplaywrightscript prompt in mcp-k6 can pass a bare file path as the playwrightscript argument and receive the contents of any file readable by the user running the server, including SSH keys and cloud credentials in that user's home directory path traversal. The...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: mc-fips, influx, minio-fips, s5cmd-fips, gatekeeper, crossplane-provider-sql-fips, terraform-mcp-server, cert-manager-csi-driver-fips, gatekeeper-fips, mongodb-k8s-operator-version-upgrade-post-start-hook-fips, pgwatch, quic-go-fips, timescaledb-parallel-copy,...
GHSA-5W89-2C2X-6X66 vulnerabilities
Vulnerabilities for packages: s5cmd-fips, cert-manager-csi-driver-fips, kubernetes-release-fips, loki, oauth2-proxy, docker-credential-gcr, kyverno-policy-reporter-plugins-trivy-fips, dive, syft, ini-file-fips, kubevirt-cdi-uploadproxy, vault-env, newrelic-nri-statsd, quic-go,...
OPENSUSE-SU-2026:10484-1 k6-1.7.1-1.1 on GA media
These are all security issues fixed in the k6-1.7.1-1.1 package on the GA media of openSUSE Tumbleweed...
Malicious code in opengov-k6-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d6d3e0e21551377d17f0e85338f6ea9650b7c18f717b6e1060b1d50962ed112 The package opengov-k6-core was found to contain malicious code. Source: ghsa-malware 1370c540f2157e1e42d9edb109b0b6c57f27d35cfcfd8ebef2a5dc2d44db6e3...
MAL-2026-2027 Malicious code in opengov-k6-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d6d3e0e21551377d17f0e85338f6ea9650b7c18f717b6e1060b1d50962ed112 The package opengov-k6-core was found to contain malicious code. Source: ghsa-malware 1370c540f2157e1e42d9edb109b0b6c57f27d35cfcfd8ebef2a5dc2d44db6e3...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: crossplane-provider-gcp-fips, minio-fips, gatekeeper, gatekeeper-fips, kube-arangodb-fips, ceph-csi-operator-fips, loki, k6-operator-fips, gitlab-cng-fips, headlamp, kube-vip-cloud-provider, apm-server, backup-restore-operator-fips, descheduler-fips,...
k6-1.5.0-1.1 on GA media (moderate)
k6-1.5.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10030-1 Rating: moderate Cross-References: CVE-2025-61729 CVSS scores: CVE-2025-61729 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-61729 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affect...
OPENSUSE-SU-2026:10030-1 k6-1.5.0-1.1 on GA media
These are all security issues fixed in the k6-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed...
GHSA-5MH9-3JWC-RP59 vulnerabilities
Vulnerabilities for packages: terraform-mcp-server, crossplane-provider-sql-fips, cert-manager-csi-driver-fips, gatekeeper-fips, quic-go-fips, karma, ceph-csi-operator-fips, k6-operator-fips, velero-plugin-for-csi-fips, trust-manager-fips, headlamp, nvidia-nsight-compute-13.1, oauth2-proxy,...
GHSA-WCW9-47FP-RRFR vulnerabilities
Vulnerabilities for packages: hello-world-golang, ghaudit, cert-manager-cmctl, docker-credential-gcr, kube-logging-operator-custom-runner, kwok, flyte, runc, tfsec, sigstore-scaffolding, kapp, falcosidekick, stern, terraform-provider-azuread, kpt, sonobuoy, pvc-autoresizer, age,...
GHSA-FRHW-MQJ2-WXW2 vulnerabilities
Vulnerabilities for packages: chart-testing, cert-manager-cmctl, flyte, falcosidekick, kpt, go-tools, undock, bank-vaults, contour, oauth2-proxy, nfpm, dataplaneapi, q, spegel, wireguard-go, git-credential-oauth, kubeflow-katib, kyverno-policy-reporter-ui, mockgen, nri-prometheus, kubevela, chise...
CVE-2025-47912 vulnerabilities
Vulnerabilities for packages: hello-world-golang, ghaudit, cert-manager-cmctl, docker-credential-gcr, kube-logging-operator-custom-runner, kwok, flyte, runc, tfsec, sigstore-scaffolding, kapp, falcosidekick, stern, terraform-provider-azuread, kpt, sonobuoy, pvc-autoresizer, age,...
CVE-2025-58185 vulnerabilities
Vulnerabilities for packages: hello-world-golang, ghaudit, cert-manager-cmctl, docker-credential-gcr, kube-logging-operator-custom-runner, kwok, flyte, runc, tfsec, sigstore-scaffolding, kapp, falcosidekick, stern, terraform-provider-azuread, kpt, sonobuoy, pvc-autoresizer, age,...
CVE-2025-58186 vulnerabilities
Vulnerabilities for packages: hello-world-golang, ghaudit, cert-manager-cmctl, docker-credential-gcr, kube-logging-operator-custom-runner, kwok, flyte, runc, tfsec, sigstore-scaffolding, kapp, falcosidekick, stern, terraform-provider-azuread, kpt, sonobuoy, pvc-autoresizer, age,...