CVE-2025-24375

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2025-22871 vulnerabilities

Vulnerabilities for packages: aws-signer-notation-plugin, kyverno-notation-aws, kubernetes-event-exporter, render-template, amass, extism, ingress-nginx-controller, litestream, glab, k3s, rabbitmq-cluster-operator, libnvidia-container, nri-mongodb, pombump, dbmate, crossplane-provider-keycloak,...

GHSA-G9PC-8G42-G6VQ vulnerabilities

Vulnerabilities for packages: aws-signer-notation-plugin, kyverno-notation-aws, kubernetes-event-exporter, render-template, amass, extism, ingress-nginx-controller, litestream, glab, k3s, rabbitmq-cluster-operator, libnvidia-container, nri-mongodb, pombump, dbmate, crossplane-provider-keycloak,...

CVE-2025-24375 MySQL K8s charm could leak credentials for root-level user `serverconfig`

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2025-24375

The CVE-2025-24375 entry concerns the Charmed MySQL K8s operator (and machine operator) with credential leakage risk. Root cause: the operator calls the mysql-shell/DDL scripts by writing a temporary script file containing full URIs with user credentials, created with read permissions (0644); unp...

CVE-2025-24375 MySQL K8s charm could leak credentials for root-level user `serverconfig`

Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-shell scripts can leak database users credentials. The method mysql-operator calls mysql-shell application rely on writing to a temporary...

CVE-2024-53349

Insecure permissions in kuadrant v0.11.3 allow attackers to gain access to the service account's token, leading to escalation of privileges via the secretes component in the k8s cluster...

MAL-2025-2348 Malicious code in k8s-deploy-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84c86c15f129692c3b73b16951c9f12754789e3a5ea36e3e5d517e05c7e0231b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventstore, aws-signer-notation-plugin, kubernetes-event-exporter, render-template, k8s-device-plugin, extism, litestream, lazydocker, nri-discovery-kubernetes, kube-vip, pombump, argo-events, crossplane-provider-keycloak, velero-plugin-for-csi, frp,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: k8sgpt-operator, fuse-overlayfs-snapshotter, gops, kubernetes-event-exporter, terraform, gcsfuse, render-template, amass, gosu, yam, mongo-tools, golangci-lint, pulumi-language-java, flux-image-automation-controller, spark-operator, cortex,...

GHSA-RPMJ-RPGJ-QMPM vulnerabilities

Vulnerabilities for packages: sccache, sdp-k8s-injector, berg, lychee, nushell, linkerd-extension-init, rustup, linkerd2, zed...

CVE-2024-45336 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventstore, aws-signer-notation-plugin, kube-vip-fips, aws-load-balancer-controller-fips, kubernetes-event-exporter, render-template, k8s-device-plugin, extism, kube-oidc-proxy, litestream, kube-logging-logging-operator,...

CVE-2024-11274

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

CVE-2024-11274 URL Redirection to Untrusted Site ('Open Redirect') in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

CVE-2024-11274 URL Redirection to Untrusted Site ('Open Redirect') in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventstore, falcoctl, kyverno-notation-aws, kubernetes-event-exporter, terraform, gcsfuse, tekton-chains, amass, k8ssandra-client, crossplane-provider-aws-s3, nsc, mongo-tools, extism, crossplane-provider-aws-eks, litestream, glab, pulumi-language-java,...

PT-2024-9581 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.1 through 17.4.6 GitLab CE/EE versions 17.5 through 17.5.4 GitLab CE/EE versions 17.6 through 17.6.2 Description: An issue was discovered in GitLab CE/EE where the injection of Network Error Logging NEL headers in the...

CVE-2024-53862 Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, Archived Workflows can be retrieved with a fake or spoofed token via the GET Workflow endpoint: /api/v1/workflows/namespace/name or when using...

MAL-2024-11048 Malicious code in k8s-apps-wordpress (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40a470c4b317b1c3a7ca0ef77aa42d47d230d8b4d2cfe94f870ae1232c927327 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

openSUSE 15 Security Update : coredns (openSUSE-SU-2024:0319-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2024:0319-1 advisory. Update to version 1.11.3: optimize the performance for high qps 6767 bump deps Fix zone parser error handling 6680 Add alternate option to forwar...