AZL-100932 CVE-2026-83530 affecting package keda 2.14.1-18

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...

GHSA-6C5V-HQJR-5XXP vulnerabilities

Vulnerabilities for packages: dapr, opentelemetry-collector-contrib, argo-events, nuclio-controller-fips, trufflehog-fips, dapr-fips, nuclio-controller, guac, argo-events-fips, versitygw, falcosidekick-fips, minio-fips, minio, trufflehog, telegraf, keda, bento, versitygw-fips, bento-fips,...

GHSA-6C5V-HQJR-5XXP vulnerabilities

Vulnerabilities for packages: guac, sftpgo-plugin-pubsub, dapr, trufflehog, opentelemetry-collector-contrib, falcosidekick, telegraf, keda, minio, argo-events, bento...

Important: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-3 This version is a rebuild of 2.19.0 using a newer base image, Go modules and Go compiler, and two bug fixes. See the release notes for more information.

Custom Metrics Autoscaler Operator for Red Hat OpenShift updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...

CVE-2026-79921 affecting package keda for versions less than 2.14.1-18

CVE-2026-79921 affecting package keda for versions less than 2.14.1-18. A patched version of the package is available...

AZL-99243 CVE-2026-84304 affecting package keda 2.14.1-18

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...

CLEANSTART-2026-DC71490 Security fixes in keda 2.20.2-r1

Package keda version 2.20.2-r1 fixes 1 vulnerabilities: ghsa-gcjh-h69q-9w9g...

CVE-2026-53572

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

AZL-96989 CVE-2026-53572 affecting package keda 2.14.1-18

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572

KEDA (Kubernetes-based Event Driven Autoscaling) is affected by a PostgreSQL connection string parameter injection in pkg/scalers/postgresql_scaler.go prior to version 2.20.0 . The root cause is that escapePostgreConnectionParameter() only quotes values containing a literal space, leaving tabs, n...

EUVD-2026-64131

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-health-monitor, kubernetes-csi-external-snapshotter, fluent-operator, kapp-controller, zot, calico, hubble, kwok, hubble-ui, helm-operator, metallb, cilium, cert-manager, cluster-api-ipam-provider-in-cluster, kube-metrics-adapter, cass-operato...

CVE-2026-73500 affecting package keda for versions less than 2.14.1-17

CVE-2026-73500 affecting package keda for versions less than 2.14.1-17. A patched version of the package is available...

GO-2026-5940 vulnerabilities

Vulnerabilities for packages: keda-http-add-on, keda-http-add-on-fips...

GO-2026-5662 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, istio, telegraf, loki, mcp-grafana, tempo, certificate-transparency, prometheus-pushgateway, minio, minio-operator, cloud-sql-proxy, mc, splunk-otel-collector, minio-object-browser, trillian, datadog-agent, aws-otel-collector, karma, keda, jaeger...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: metrics-server, prometheus-operator, grafana, istio, loki, prometheus, opentelemetry-collector, tempo, certificate-transparency, prometheus-pushgateway, minio, minio-operator, node-problem-detector, k8sgpt, cloud-sql-proxy, mc, splunk-otel-collector,...

CLEANSTART-2026-AT48963 Security fixes in keda-fips 2.19.0-r2

Package keda-fips version 2.19.0-r2 fixes 8 vulnerabilities: CVE-2026-42151, CVE-2026-42154, CVE-2026-40179, CVE-2026-44903, ghsa-8rm2-7qqf-34qm...

CLEANSTART-2026-HA77289 Security fixes in keda-fips 2.19.0-r1

Package keda-fips version 2.19.0-r1 fixes 8 vulnerabilities: CVE-2026-42151, CVE-2026-42154, CVE-2026-40179, CVE-2026-44903, ghsa-8rm2-7qqf-34qm...