47 matches found
CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10
CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. A patched version of the package is available...
CVE-2026-81869 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10
CVE-2026-81869 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. An upgraded version of the package is available that resolves this issue...
CVE-2026-83530 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10
CVE-2026-83530 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. An upgraded version of the package is available that resolves this issue...
CVE-2026-84445 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10
CVE-2026-84445 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10. An upgraded version of the package is available that resolves this issue...
AZL-100935 CVE-2026-83530 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10
A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation would occur proportional to the size of the input before the limit would be checked / enforced...
AZL-99246 CVE-2026-84304 affecting package kube-vip-cloud-provider 0.0.10-8
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connectio...
AZL-98376 CVE-2026-37236 affecting package kube-vip-cloud-provider for versions less than 0.0.10-10
grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: cluster-api-azure-controller, hubble-ui, hubble, zot, tekton-pipelines, cluster-autoscaler, rancher-system-agent, metrics-server, metallb, cluster-api-helm-controller, fluent-operator, rancher, tkn, cluster-api-provider-vsphere, kuma, kyverno-notation-aws,...
CVE-2026-73500 affecting package kube-vip-cloud-provider for versions less than 0.0.10-8
CVE-2026-73500 affecting package kube-vip-cloud-provider for versions less than 0.0.10-8. A patched version of the package is available...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: podinfo, aws-sigv4-proxy, opensearch-k8s-operator, hubble-ui, hubble, secrets-store-csi-driver, undock, aws-signer-notation-plugin, pvc-autoresizer, wuzz, esbuild, dynamic-localpv-provisioner, neuvector-sigstore-interface, yace, kapp, wgcf, traefik, rancher-loglevel,...
CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7
CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7. A patched version of the package is available...
AZL-93219 CVE-2026-56852 affecting package kube-vip-cloud-provider for versions less than 0.0.10-7
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
CVE-2026-25680 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
CVE-2026-25680 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...
CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...
CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...
AZL-87885 CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87891 CVE-2026-27136 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87876 CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering...
AZL-87873 CVE-2026-39821 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode"xn--example-.com" incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna...