GHSA-77FJ-VX54-GVH7 vulnerabilities

Vulnerabilities for packages: gotenberg, temporal-ui-server, kube-metrics-adapter, kube-metrics-adapter-fips, temporal-fips, snyk-cli, temporal-ui-server-fips, temporal, fq...

CVE-2026-40890 vulnerabilities

Vulnerabilities for packages: gotenberg, temporal-ui-server, kube-metrics-adapter, kube-metrics-adapter-fips, temporal-fips, snyk-cli, temporal-ui-server-fips, temporal, fq...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: kaf, gitlab-pages, redka, libnvidia-container, kubescape, nerdctl, coredns, dask-gateway, external-secrets-operator, kubernetes, snyk-cli, external-dns, kine, prometheus, hubble, zot, karpenter, runc, aws-flb-cloudwatch, k8s-device-plugin, fuse-overlayfs-snapshotter,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kaf, rabbitmq-messaging-topology-operator, kubernetes-ingress-defaultbackend, certificate-transparency, vale, kubescape, kind, incert, git-credential-oauth, sftpgo-plugin-eventstore, prometheus, sftpgo, weaviate, pgtimetable, cert-manager-cmctl, smokescreen, contour,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: kaf, crossplane-provider-azure-storage, rabbitmq-messaging-topology-operator, gitlab-pages, neuvector-scanner, certificate-transparency, kubescape, cri-tools, crossplane-provider-azure-authorization, falcoctl, sftpgo-plugin-eventstore, kubernetes-csi-driver-nfs,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: sbomqs, mariadb-operator-fips, k8s-device-plugin-fips, bazelisk, request-1279, metrics-agent, minc, aws-flb-kinesis-fips, jfrog-cli, cert-manager-cmctl-fips, migrate, terraform, terraform-provider-azuread-fips, amazon-eks-ami-fips,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: minc, cert-manager-cmctl-fips, amazon-eks-ami-fips, vale, hubble, falcoctl, gitlab-cng, longhorn-cli, crossplane-provider-aws-servicediscovery-fips, secrets-store-csi-driver-provider-aws-fips, configmap-reload, external-dns, protoc-gen-connect-go,...

CVE-2026-35611 vulnerabilities

Vulnerabilities for packages: cinc-auditor, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, kube-fluentd-operator, kube-logging-operator, ruby3.4-fluentd-kubernetes-daemonset...

GHSA-H27X-RFFW-24P4 vulnerabilities

Vulnerabilities for packages: cinc-auditor, logstash, ruby3.2-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, ruby4.0-fluentd-kubernetes-daemonset, kube-fluentd-operator, kube-logging-operator, ruby3.4-fluentd-kubernetes-daemonset...

CVE-2026-35611 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, kube-fluentd-operator, ruby3.2-fluentd-kubernetes-daemonset, cinc-auditor, logstash, gitlab-rails-ce-fips, ruby4.0-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, gitlab-rails-ce, ruby3.4-fluentd-kubernetes-daemonset...

GHSA-H27X-RFFW-24P4 vulnerabilities

Vulnerabilities for packages: kube-logging-operator, kube-fluentd-operator, ruby3.2-fluentd-kubernetes-daemonset, cinc-auditor, logstash, gitlab-rails-ce-fips, ruby4.0-fluentd-kubernetes-daemonset, ruby3.3-fluentd-kubernetes-daemonset, gitlab-rails-ce, ruby3.4-fluentd-kubernetes-daemonset...

CLEANSTART-2026-NG75665 During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Multiple security vulnerabilities affect the kube-state-metrics package. During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions. See references for individual vulnerability details...

CLEANSTART-2026-BM53321 attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing

Multiple security vulnerabilities affect the kube-state-metrics package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing. See references for individual vulnerability details...

CLEANSTART-2026-QN98167 html

Multiple security vulnerabilities affect the kube-state-metrics package. The html. See references for individual vulnerability details...

CLEANSTART-2026-WY13161 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the kube-state-metrics package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, rabbitmq-messaging-topology-operator, gitlab-pages, crossplane-provider-aws-memorydb, certificate-transparency, blob-csi, crossplane-provider-aws-sns, grafana-pyroscope, kubescape, conftest, loki, cri-tools, cloudprober,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, rabbitmq-messaging-topology-operator, gitlab-pages, crossplane-provider-aws-memorydb, certificate-transparency, blob-csi, crossplane-provider-aws-sns, grafana-pyroscope, kubescape, conftest, loki, cri-tools, cloudprober,...

CVE-2026-39883 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatch, headlamp, sftpgo-plugin-kms, migrate, terraform, amazon-eks-ami-fips, crossplane-provider-aws-elasticache-fips, restic-fips, spicedb-operator-fips, crossplane-provider-azure-orbital, reports-server, kubeflow-pipelines, etcd-fips,...

GHSA-HFVC-G4FC-PQHX vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudwatch, headlamp, sftpgo-plugin-kms, migrate, terraform, amazon-eks-ami-fips, crossplane-provider-aws-elasticache-fips, restic-fips, spicedb-operator-fips, crossplane-provider-azure-orbital, reports-server, kubeflow-pipelines, etcd-fips,...