GitLab 15.10 < 18.3.6 / 18.4 < 18.4.4 / 18.5 < 18.5.2 (CVE-2025-11224)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stor...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.14.2 security update

Red Hat Advanced Cluster Management for Kubernetes 2.14 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. Red Hat Advanced Cluster Management for Kubernetes 2.14 images Red Hat Advanced Cluster Management for Kubernetes provides...

Important: Red Hat Security Advisory: multicluster engine for Kubernetes v2.9.2 security update

The multicluster engine for Kubernetes 2.9 General Availability release images, which add new features and enhancements, bug fixes, and updated container images. The multicluster engine for Kubernetes v2.9 images The multicluster engine for Kubernetes provides the foundational components that are...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, buf, paranoia, kube-vip, src-fingerprint, vault-k8s, crossplane-provider-aws-cloudfront, step-ca, mcp-grafana, vt-cli, minio-operator, crossplane-provider-aws-iam, kots, boring-registry, nri-apache, oauth2-proxy, mongo-tools,...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, buf, paranoia, kube-vip, src-fingerprint, vault-k8s, crossplane-provider-aws-cloudfront, step-ca, mcp-grafana, multus-cni, vt-cli, minio-operator, crossplane-provider-aws-iam, kots, boring-registry, nri-apache, oauth2-proxy, mongo-tools,...

GHSA-H355-32PF-P2XM vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, buf, paranoia, kube-vip, src-fingerprint, vault-k8s, crossplane-provider-aws-cloudfront, step-ca, mcp-grafana, vt-cli, minio-operator, crossplane-provider-aws-iam, kots, boring-registry, nri-apache, oauth2-proxy, mongo-tools,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, buf, paranoia, kube-vip, src-fingerprint, vault-k8s, crossplane-provider-aws-cloudfront, step-ca, mcp-grafana, multus-cni, vt-cli, minio-operator, crossplane-provider-aws-iam, kots, boring-registry, nri-apache, oauth2-proxy, mongo-tools,...

Arbitrary Code Execution

ingress-nginx is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper sanitization of the rules.http.paths.path Ingress field, where attacker-controlled values can inject arbitrary NGINX configuration, enabling execution of commands in the ingress-nginx controller context...

TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure

Cybersecurity researchers have called attention to a "massive campaign" that has systematically targeted cloud native environments to set up malicious infrastructure for follow-on exploitation. The activity, observed around December 25, 2025, and described as "worm-driven," leveraged exposed Dock...

openSUSE Security Advisory (SUSE-SU-2026:0399-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 43 Update: k9s-0.50.18-1.fc43

Kubernetes CLI To Manage Your Clusters In Style!...

SUSE CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

SUSE SLES15: kubernetes1.33-client / kubernetes1.33-client-bash-completion / etc (SUSE-SU-2026:0399-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:0399-1 advisory. This update for kubernetes-old rebuilds it against the current GO security release. Tenable has extracted the preceding...

CVE-2026-25804 Antrea has invalid enforcement order for network policy rules caused by integer overflow

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies wi...

Antrea has invalid enforcement order for network policy rules caused by integer overflow

Impact Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. If a user creates ...

Security update for kubernetes-old

This update for kubernetes-old rebuilds it against the current GO security release. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your product: openSUSE Leap...

SUSE-SU-2026:0399-1 Security update for kubernetes-old

This update for kubernetes-old rebuilds it against the current GO security release...

CVE-2026-25538

Devtron is an open source tool integration platform for Kubernetes. In version 2.0.0 and prior, a vulnerability exists in Devtron's Attributes API interface, allowing any authenticated user including low-privileged CI/CD Developers to obtain the global API Token signing key by accessing the...

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx, related to insufficient validation of incoming data, allows a perpetrator to gain unauthorized access to protected information and execute arbitrary code within the controller’s context.

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx is related to insufficient validation of incoming data. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information and execute arbitrary code within the controller’...

Kubernetes ingress-nginx 安全漏洞

Kubernetes ingress-nginx is a Kubernetes entry controller open source by the Cloud Native Computing Foundation. It uses NGINX as a reverse proxy and load balancer. There is a security vulnerability in Kubernetes ingress-nginx. This vulnerability stems from the...