GO-2026-6094 vulnerabilities

Vulnerabilities for packages: opentelemetry-operator, rke2-cloud-provider, cluster-api-helm-controller, vcluster, kyverno-notation-aws, tetragon, cluster-api-gcp-controller, metallb, yunikorn-k8shim, kyverno, flux-notification-controller, cert-manager-istio-csr, helm-operator, kube-rbac-proxy,...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: guac, prometheus-mongodb-exporter, docker-compose, flux, gitsign, metrics-server-fips, kube-rbac-proxy-fips, newrelic-infra-operator, newrelic-nri-kube-events, runc, kubernetes-csi-external-provisioner, timoni, helm-operator, prometheus-statsd-exporter-fips,...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, minio, restic, terragrunt, pulumi-language-dotnet, vcluster, dex, opentelemetry-collector-contrib, fulcio, gomplate, tempo, terraform-docs, opa, temporal, cloudnative-pg, grafana-agent-operator, trivy, ferretdb, grpc-health-probe,...

CLEANSTART-2026-DI87691 Security fixes in kube-rbac-proxy-fips 0.22.0-r1

Package kube-rbac-proxy-fips version 0.22.0-r1 fixes 1 vulnerabilities: CVE-2026-41178...

CVE-2026-15581 Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

CVE-2026-15581

CVE-2026-15581 : A flaw in the TrustyAI Service (TAS) deployment allows any pod on the cluster network to bypass authentication and directly access the TAS backend API, enabling reading, tampering, or deletion of monitoring data and configurations, and injection of arbitrary data into the service...

CVE-2026-15581 Trustyai-service-operator: trustyai-service-operator: tas internal service bypasses kube-rbac-proxy, exposing unauthenticated quarkus api cluster-wide

A flaw was found in the TrustyAI Service TAS deployment. This vulnerability allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. An attacker can exploit this to read, tamper with, or delete monitoring data and configurations, and inject arbitrary...

CLEANSTART-2026-JB31481 Security fixes in kube-rbac-proxy-fips 0.17.1-r1

Package kube-rbac-proxy-fips version 0.17.1-r1 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

CVE-2026-15063

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-15063

The CVE-2026-15063 affects the gorch service in the trustyai-service-operator. The issue is that, even with authentication enabled, gorch exposes unproxied orchestrator and detector metrics ports, reachable from any pod on the cluster network. This bypasses kube-rbac-proxy authentication, enablin...

CVE-2026-15063

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-15063 Trustyai-service-operator: trustyai service operator: gorch port bypass when auth is enabled

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-15063

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing th...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-lambda, external-dns, crossplane-provider-aws-s3, crossplane-provider-aws-cloudwatchlogs, nova, kubo, traefik, terraform-provider-acme, kube-rbac-proxy, chezmoi, crossplane-provider-aws-firehose, wolfictl, terraform-provider-aws,...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana, nemo, crossplane-provider-aws-dynamodb-fips, grafana-alloy, gitlab-cng, gpu-operator-fips, nova, omni, descheduler, flux, splunk-otel-collector-fips, opa-envoy, gitlab-runner, cert-manager-webhook-pdns, goose-fips, peerdb-flow,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: terraform-provider-grafana, nemo, crossplane-provider-aws-dynamodb-fips, grafana-alloy, gitlab-cng, gpu-operator-fips, nova, omni, descheduler, flux, splunk-otel-collector-fips, opa-envoy, gitlab-runner, cert-manager-webhook-pdns, goose-fips, peerdb-flow,...

CLEANSTART-2026-BH03809 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the kube-rbac-proxy-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

CLEANSTART-2026-UJ17204 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the kube-rbac-proxy-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

EUVD-2019-13441

Malware in sbrugna...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: argo-cd, guac, aws-sigv4-proxy, overmind, gitlab-cng, prometheus-mongodb-exporter, flux, sbom-scorecard, kube-conformance, nvidia-nsight-compute-12.8, hugo-fips, spegel, newrelic-infra-operator, newrelic-nri-kube-events, blob-csi, runc, amazon-k8s-cni,...