913 matches found
AZL-77517 CVE-2025-30204 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...
Kubernetes kube-apiserver Vulnerable to Race Condition
A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies ...
CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20
CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20. A patched version of the package is available...
GHSA-3F6R-QH9C-X6MM vulnerabilities
Vulnerabilities for packages: direnv, overmind, fluent-operator, atlantis, kubernetes-dashboard-api, cadvisor, nginx-prometheus-exporter, sftpgo-plugin-auth, kserve-rest-proxy, gitsign, linkerd2-proxy-init, kube-metrics-adapter, kustomize, prometheus-adapter, trillian, cass-operator, podman,...
GHSA-7WRW-R4P8-38RX vulnerabilities
Vulnerabilities for packages: direnv, overmind, fluent-operator, atlantis, kubernetes-dashboard-api, cadvisor, nginx-prometheus-exporter, sftpgo-plugin-auth, kserve-rest-proxy, gitsign, linkerd2-proxy-init, kube-metrics-adapter, kustomize, prometheus-adapter, trillian, cass-operator, podman,...
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: yam, wire-go, dask-gateway, fq, nri-haproxy, kine, memcached-exporter, nri-couchbase, protoc-gen-go-grpc, configmap-reload, sbomqs, direnv, govulncheck, vault-k8s, src-fingerprint, vt-cli, nri-prometheus, k8ssandra-operator, gomplate, cadvisor, kwok, hubble-ui,...
GHSA-J6M3-GC37-6R6Q vulnerabilities
Vulnerabilities for packages: yam, wire-go, dask-gateway, fq, nri-haproxy, kine, memcached-exporter, nri-couchbase, protoc-gen-go-grpc, configmap-reload, sbomqs, direnv, govulncheck, vault-k8s, src-fingerprint, vt-cli, nri-prometheus, k8ssandra-operator, gomplate, cadvisor, kwok, hubble-ui,...
GHSA-5FQ7-4MXC-535H vulnerabilities
Vulnerabilities for packages: docker-credential-ecr-login, prometheus-mongodb-exporter-fips, pulumi-kubernetes-operator, mockery, nvidia-container-toolkit, k3d, newrelic-infra-operator, trillian, gostatsd, flyte, harbor-scanner-trivy-fips, step-ca-fips, azure-aad-pod-identity-mic, flannel,...
AZL-57108 CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...
GO-2025-3431 kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest
kube-audit-rest's example logging configuration could disclose secret values in the audit log in github.com/RichardoC/kube-audit-rest...
CVE-2025-24884
kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...
CVE-2025-24884
The CVE-2025-24884 entry concerns kube-audit-rest, a simple logger for Kubernetes API mutations. When the here-described full-elastic-stack example vector is used, previous values of Kubernetes secrets could be disclosed in audit messages due to the logger capturing sensitive data. Fixed in versi...
CVE-2025-24884 kube-audit-rest's example logging configuration could disclose secret values in the audit log
kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...
CVE-2025-24884 kube-audit-rest's example logging configuration could disclose secret values in the audit log
kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16...
PT-2025-5591 · Unknown +1 · Kube-Audit-Rest +1
Name of the Vulnerable Software and Affected Versions: kube-audit-rest versions prior to 1.0.16 Description: The issue concerns a simple logger of mutation/creation requests to the k8s API, where the previous values of Kubernetes secrets would have been disclosed in the audit messages if the...
kube-audit-rest 安全漏洞
kube-audit-rest is a Kubernetes audit logging by Richard Tweed Personal Developer. A security vulnerability exists in kube-audit-rest versions prior to 1.0.16, which stems from the fact that previous values of kubernetes secrets are leaked in audit messages if the full-elastic-stack example vecto...
kube-audit-rest's example logging configuration could disclose secret values in the audit log
If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages...
CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3
CVE-2024-45338 affecting package kube-vip-cloud-provider for versions less than 0.0.10-3. A patched version of the package is available...