GO-2026-5410 vulnerabilities

Vulnerabilities for packages: atlantis-fips, kyverno-policy-reporter-fips, ory-kratos, argo-cd-fips, argo-rollouts-fips, argo-events, argo-rollouts, argo-events-fips, atlantis, bento, ory-kratos-fips, goreleaser, kyverno-policy-reporter, kubernetes-event-exporter, kubernetes-event-exporter-fips,...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: argo-rollouts, kyverno-policy-reporter, bento, kubewatch, argo-cd, kubernetes-event-exporter, goreleaser, argo-events, atlantis...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, conftest, harbor-scanner-trivy, cert-exporter, crossplane-provider-aws-cloudformation, trino, crossplane-provider-aws-sqs, vault-k8s, zarf, crossplane, istio, kubeflow-pipelines, nri-couchbase, newrelic-nri-statsd,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: conftest, crossplane-provider-aws-cloudformation, pvc-autoresizer, postgres-operator, restic, blobfuse2, s5cmd, vault-k8s, kubeflow-pipelines, nri-couchbase, runc, newrelic-nri-statsd, telegraf, custom-pod-autoscaler, cosign, lvm-driver, rancher-telemetry,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, src-fingerprint, flux, gh, sigstore-scaffolding, ksops, scorecard, rekor, step-ca, opentelemetry-collector-contrib, kargo, kubernetes-event-exporter, flux-image-reflector-controller, zarf, gomplate, tkn,...

CLEANSTART-2026-RJ04514 Security fixes in kubernetes-event-exporter 1.7-r1

Package kubernetes-event-exporter version 1.7-r1 fixes 46 vulnerabilities: ghsa-wf45-q9ch-q8gh, ghsa-p77j-4mvh-x3m3, ghsa-gxhx-2686-5h9g, CVE-2026-41602, CVE-2026-33186...

CLEANSTART-2026-WL45158 Security fixes in kubernetes-event-exporter 1.7-r0

Package kubernetes-event-exporter version 1.7-r0 fixes 2 vulnerabilities: CVE-2025-47911, CVE-2025-58190...

CLEANSTART-2026-HY96164 Security fixes in kubernetes-event-exporter-fips 1.7-r0

Package kubernetes-event-exporter-fips version 1.7-r0 fixes 46 vulnerabilities: ghsa-wf45-q9ch-q8gh, ghsa-p77j-4mvh-x3m3, ghsa-gxhx-2686-5h9g, CVE-2026-41602, CVE-2026-33186...

GHSA-GXHX-2686-5H9G vulnerabilities

Vulnerabilities for packages: argo-rollouts, kyverno-policy-reporter, bento, kubewatch, argo-cd, kubernetes-event-exporter, goreleaser, argo-events, atlantis...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-snapshotter, crossplane-provider-aws-osis-fips, kubevirt-cdi-uploadserver, beats-fips, external-secrets-operator, crossplane-provider-aws-ecs-fips, crossplane-provider-aws-kafka, cri-tools, crossplane-provider-aws-secretsmanager,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, crossplane-provider-aws-cloudformation, k8ssandra-client, crossplane-provider-aws-sqs, istio, terraform, aactl, kubernetes-csi-driver-hostpath, crossplane-provider-aws-firehose, neuvector-scanner,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, crossplane-provider-aws-cloudformation, k8ssandra-client, crossplane-provider-aws-sqs, istio, terraform, aactl, kubernetes-csi-driver-hostpath, crossplane-provider-aws-firehose, neuvector-scanner,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: prometheus-operator, aws-s3-controller, github-mcp-server, istio, hcloud, cosign, lvm-driver, rancher-telemetry, terraform, kubernetes-dashboard, docker-credential-gcr, flux-notification-controller, timescaledb-parallel-copy, incert, vault-benchmark,...

CVE-2025-68476 KEDA has Arbitrary File Read via Insufficient Path Validation in HashiCorp Vault Service Account Credential

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to versions 2.17.3 and 2.18.3, an Arbitrary File Read vulnerability has been identified in KEDA, potentially affecting any KEDA resource that uses TriggerAuthentication to configure HashiCorp Vault authentication. The...

GHSA-4F99-4Q7P-P3GH vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, prometheus-beat-exporter, neuvector-dbgen, neuvector-dbgen-fips, aws-flb-cloudwatch-fips, gostatsd, kubeflow-fips, prometheus-mongodb-exporter-fips, consul-fips, aws-flb-kinesis, docker-credential-gcr, kubeflow, falcoctl-fips,...

CVE-2025-65637 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, prometheus-beat-exporter, neuvector-dbgen, neuvector-dbgen-fips, aws-flb-cloudwatch-fips, gostatsd, kubeflow-fips, prometheus-mongodb-exporter-fips, consul-fips, aws-flb-kinesis, docker-credential-gcr, kubeflow, falcoctl-fips,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: nova, opa-fips-envoy, nri-kafka, terraform-provider-random-fips, contour-fips, aws-flb-cloudwatch-fips, kubernetes-dns-node-cache-fips, gitea, nri-jmx, rancher-helm, cloud-provider-azure-fips, helm-diff-fips, external-dns-fips, spire-server-fips, gogatekeeper,...

Moderate: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat 2.14.1-467 OpenShift Update

Custom Metrics Autoscaler Operator for Red Hat OpenShift Security Update to fix Moderate CVE-2024-24791 The Custom Metrics Autoscaler Operator for Red Hat OpenShift is an optional operator based upon the Kubernetes Event Driven Autoscaler KEDA, which allows workloads to be scaled by using...

Low: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update

Custom Metrics Autoscaler Operator for Red Hat OpenShift including security updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...

CVE-2024-31391

The CVE-2024-31391 issue affects the Apache Solr Operator (versions 0.3.0–0.8.0). When bootstraping security with basic authentication, the operator creates accounts (including k8s-oper) and uses health probes (liveness/readiness/startup) to check Solr. By default, probe endpoints can be exempt f...