CVE-2025-23260

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the ClusterRole. A successful exploit of this vulnerability may lead to information disclosure...

PT-2025-26762

Name of the Vulnerable Software and Affected Versions: NVIDIA AIStore versions prior to 2.3.0 Description: The issue is related to a vulnerability in the AIS Operator of NVIDIA AIStore, where a user can gain elevated access to the k8s cluster by using the ServiceAccount attached to the ClusterRol...

CVE-2025-50182 vulnerabilities

Vulnerabilities for packages: ggshield, az, py3-pip, confluent-docker-utils, py3-cassandra-medusa, superset, kubeflow-pipelines, jupyter-base-notebook, k8s-sidecar, airflow, emissary, dask-gateway, kubeflow-katib, pypy-3.10, dask-kubernetes, mlflow, jwt-tool, kserve, reflex,...

CVE-2025-50181 vulnerabilities

Vulnerabilities for packages: ggshield, az, py3-pip, datadog-agent, confluent-docker-utils, py3-cassandra-medusa, superset, kubeflow-pipelines, jupyter-base-notebook, k8s-sidecar, airflow, emissary, dask-gateway, kubeflow-katib, pypy-3.10, dask-kubernetes, mlflow, jwt-tool, kserve,...

GHSA-48P4-8XCF-VXJ5 vulnerabilities

Vulnerabilities for packages: ggshield, az, py3-pip, confluent-docker-utils, py3-cassandra-medusa, superset, kubeflow-pipelines, jupyter-base-notebook, k8s-sidecar, airflow, emissary, dask-gateway, kubeflow-katib, pypy-3.10, dask-kubernetes, mlflow, jwt-tool, kserve, reflex,...

GHSA-PQ67-6M6Q-MJ2V vulnerabilities

Vulnerabilities for packages: ggshield, az, py3-pip, datadog-agent, confluent-docker-utils, py3-cassandra-medusa, superset, kubeflow-pipelines, jupyter-base-notebook, k8s-sidecar, airflow, emissary, dask-gateway, kubeflow-katib, pypy-3.10, dask-kubernetes, mlflow, jwt-tool, kserve,...

MAL-2025-4566 Malicious code in k8s-lint-action (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b445cff5be01caddf1be7a89f1cea09fce4135e635b83655ff150c35b8940e86 Any computer that has this package installed or running should be considered...

CVE-2025-46342

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selectors in their match statements are mistakenly not applied during admission review request processing due to a missing error...

CVE-2025-46342

Kyverno CVE-2025-46342 affects policy rules using namespace selectors in match statements. Prior to versions 1.13.5 and 1.14.0, a missing error propagation in GetNamespaceSelectorsFromNamespaceLister (pkg/utils/engine/labels.go) may cause those rules to be ignored during admission review, bypassi...

GHSA-JRR2-X33P-6HVC Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements

Summary Due to a missing error propagation in function GetNamespaceSelectorsFromNamespaceLister in pkg/utils/engine/labels.go it may happen that policy rules using namespace selectors in their match statements are mistakenly not applied during admission review request processing. As a consequence...

PT-2025-18296 · Kyverno · Kyverno

Name of the Vulnerable Software and Affected Versions: Kyverno versions prior to 1.13.5 and 1.14.0 Description: The issue concerns a policy engine where policy rules using namespace selectors in their match statements may not be applied correctly due to a missing error propagation in the...

GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: aws-s3-controller, hcloud, lvm-driver, rancher-telemetry, terraform, kubernetes-dashboard, flux-notification-controller, kube-metrics-adapter, vault-benchmark, fq, verticadb-operator, spicedb, distribution, spiffe-helper, kubescape, falcosidekick, authservice, hydra,...

GHSA-VVGC-356P-C3XW vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-snapshotter, kubernetes-dashboard-api, dgraph, opa-fips-envoy, nri-kafka, terraform-provider-random-fips, contour-fips, kubernetes-dns-node-cache-fips, gitea, cri-tools, terraform-provider-grafana, rancher-helm, wal-g,...

CVE-2025-24375

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: shfmt, linkerd2-proxy-init, hcloud, lvm-driver, terraform, kubernetes-dashboard, flux-notification-controller, kube-metrics-adapter, incert, helm-docs, fq, distribution, kubescape, falcosidekick, authservice, ini-file, hello-world-golang, flux-kustomize-controller,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: shfmt, linkerd2-proxy-init, hcloud, lvm-driver, terraform, kubernetes-dashboard, flux-notification-controller, kube-metrics-adapter, incert, helm-docs, fq, distribution, kubescape, falcosidekick, authservice, ini-file, hello-world-golang, flux-kustomize-controller,...

CVE-2025-24375 MySQL K8s charm could leak credentials for root-level user `serverconfig`

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2025-24375

The CVE-2025-24375 entry concerns the Charmed MySQL K8s operator (and machine operator) with credential leakage risk. Root cause: the operator calls the mysql-shell/DDL scripts by writing a temporary script file containing full URIs with user credentials, created with read permissions (0644); unp...

CVE-2025-24375 MySQL K8s charm could leak credentials for root-level user `serverconfig`

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2024-53349

Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster...