OpenShift KMS Plugin for Key Vault server request forgery vulnerability

Version 3 of the OpenShift KMS Plugin for Key Vault contains a server-side request forgery vulnerability. This vulnerability arises because the Kroxylicious Azure Key Vault KMS provider fails to validate the format of vaultName values extracted from network-reassembled EDEK bytes. As a result,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: gatus, kine, neuvector-sigstore-interface, flux-image-automation-controller, terraform-provider-acme, prometheus-operator, crossplane-provider-aws-memorydb, crossplane-provider-keycloak, docker-cli-buildx, eksctl, ksops, cloudflared, external-secrets-operator, kargo,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: gatus, nri-haproxy, xeol, boring-registry, kuberay-operator, cluster-api-ipam-provider-in-cluster, kine, neuvector-sigstore-interface, flux-image-automation-controller, redka, metacontroller, amass, kubelet-csr-approver, kubernetes-dashboard-metrics-scraper,...

GO-2026-4503 vulnerabilities

Vulnerabilities for packages: step-issuer, age, argo-workflows, crossplane-provider-sql, kine, envoy-gateway, temporal-server, mattermost, sftpgo, amass, croc, jitsucom-bulker, db-operator, openfga, trufflehog, ratify, timestamp-authority, dex, openbao, apko, cerbos, dgraph, ksops, nuclei,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: lazydocker, nri-haproxy, pluto, wire-go, neuvector-sigstore-interface, prometheus-operator, docker-machine-driver-harvester, docker-cli-buildx, eksctl, kind, clickhouse-operator, gobuster, delve, polaris, swagger, kube-bench, terraform-mcp-server, yunikorn-k8shim,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: step-issuer, age, argo-workflows, crossplane-provider-sql, kine, envoy-gateway, temporal-server, mattermost, sftpgo, amass, croc, jitsucom-bulker, db-operator, openfga, trufflehog, ratify, timestamp-authority, dex, openbao, apko, cerbos, dgraph, ksops, nuclei,...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: wire-go, redka, metacontroller, prometheus-operator, spicedb-operator, docker-cli-buildx, smarter-device-manager, delve, velero-plugin-for-csi, skopeo, otel-cli, vault-env, yunikorn-k8shim, timoni, iptables-wrappers, cluster-api-provider-vsphere, ferretdb, velero,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

GHSA-7WWX-XJ66-R44X vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

GHSA-HJX7-FPXX-MJ48 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

CVE-2025-58185 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: lazydocker, crossplane, boring-registry, kube-rbac-proxy, gosu, wire-go, neuvector-sigstore-interface, redka, metacontroller, amass, jitsucom-bulker, kubelet-csr-approver, php-fpmexporter, kwok, kubernetes-dashboard-metrics-scraper, docker-machine-driver-harvester,...