8948 matches found
EUVD-2026-36641
Grafana Operator: Privilege escalation from namespace admin to cluster admin via GrafanaDashboard jsonnetLib fileName...
Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-tls-match-cn` Annotation
A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of...
Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation
A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...
KubePi <= v1.6.4 LoginLogsSearch - Unauthorized Access
KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds. id: CVE-2023-22478 info: name: KubePi = v1.6.4 LoginLogsSearch - Unauthorized Access autho...
MinIO Operator Console Authentication Bypass
MinIO Console is a graphical user interface for the for MinIO Operator. MinIO itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. id: CVE-2021-41266 info: name: MinIO Operator...
KubeView <=0.1.31 - Information Disclosure
KubeView through 0.1.31 is susceptible to information disclosure. An attacker can obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication and retrieves certificate files that can be used for authentication as kube-admin. An attacker can thereby possib...
Kubernetes API Server - YAML Parsing DoS (Billion Laughs)
The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption Billion Laughs attack, leading to API server crash. id: CVE-2019-11253 info: name: Kubernetes API Serv...
GHSA-CP6G-7HQX-QXHP vulnerabilities
Vulnerabilities for packages: dapr, slsa-verifier, bento, promxy, tetragon, weaviate, ksops, teleport, terraform-provider-pagerduty, kubescape-operator, tekton-chains, loki, grafana, datadog-agent, external-secrets-operator, ratify, grafana-mimir, argo-cd, cortex, grafana-pyroscope,...
CVE-2026-2303 vulnerabilities
Vulnerabilities for packages: dapr, slsa-verifier, bento, promxy, tetragon, weaviate, ksops, teleport, terraform-provider-pagerduty, kubescape-operator, tekton-chains, loki, grafana, datadog-agent, external-secrets-operator, ratify, grafana-mimir, argo-cd, cortex, grafana-pyroscope,...
Kubernetes Dashboard <1.10.1 - Authentication Bypass
Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster. id: CVE-2018-18264 info: name: Kubernetes Dashboard 1.10.1 - Authentication Bypass author: edoardottt severity: high description: | Kubernetes...
KubeOperator Foreground `kubeconfig` - File Download
KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used t...
Debug Endpoint pprof - Exposure Detection
The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8,...
Malicious code in disksweep (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a6449a8f35de848928e7f17d88c87db80e5aee40e8b53c375e07fc7d43cc05e On every import disksweep, the package's top-level src/disksweep/init.py lines 18-24 calls ctypes.CDLL on a 2.9 MB Windows binary parser.pyd shipped...
MAL-2026-6081 Malicious code in disksweep (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a6449a8f35de848928e7f17d88c87db80e5aee40e8b53c375e07fc7d43cc05e On every import disksweep, the package's top-level src/disksweep/init.py lines 18-24 calls ctypes.CDLL on a 2.9 MB Windows binary parser.pyd shipped...
MAL-2026-6083 Malicious code in syncagents (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aebf468a6887fb09002d4ae4aceab77e347034b389b02e252844f7d0d81fabd6 The PyPI package 'syncagents' impersonates the legitimate PyPI package 'agentsync' — the README, PKG-INFO, CHANGELOG, and project URLs all point at...
GHSA-C653-97M9-RCG9 vulnerabilities
Vulnerabilities for packages: solr, knative-kafka-broker-fips, kayenta, opensearch, cassandra, spark, elasticsearch-fips, spark-kubernetes-operator, kserve-modelmesh, management-api-for-apache-cassandra-5.0, pinot-fips, request-9047-keycloak-fips, druid, kafbat-ui, kayenta-fips, kafka, reposilite...
CVE-2026-50010 vulnerabilities
Vulnerabilities for packages: solr, knative-kafka-broker-fips, kayenta, opensearch, cassandra, spark, elasticsearch-fips, spark-kubernetes-operator, kserve-modelmesh, management-api-for-apache-cassandra-5.0, pinot-fips, request-9047-keycloak-fips, druid, kafbat-ui, kayenta-fips, kafka, reposilite...
Important: Red Hat Security Advisory: Red Hat Developer Hub 1.9.5 release.
Red Hat Developer Hub 1.9.5 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
Ingress-Nginx Controller - Remote Code Execution
A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. Note...
SUSE SLES15 Security Update : kubernetes (SUSE-SU-2026:2342-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2342-1 advisory. This update for kubernetes fixes the following issues - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport...