10635 matches found
AZL-70547 CVE-2025-31133 affecting package kubernetes for versions less than 1.28.4-21
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, runc would not perform sufficient verification that the source of the bind-mount i.e., the container's /dev/null was...
GHSA-PWHC-RPQ9-4C8W containerd affected by a local privilege escalation via wide permissions on CRI directory
Impact An overly broad default permission vulnerability was found in containerd. - /var/lib/containerd was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store -...
containerd affected by a local privilege escalation via wide permissions on CRI directory
Impact An overly broad default permission vulnerability was found in containerd. - /var/lib/containerd was created with the permission bits 0o711, while it should be created with 0o700 - Allowed local users on the host to potentially access the metadata store and the content store -...
Security Bulletin: IBM Financial Transaction Manager is impacted by a DNS cache poisoning vulnerability in RedHat Proxy for Kubernetes RBAC authorization
Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerability. Vulnerability Details CVEID:CVE-2025-40778 DESCRIPTION: Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into t...
CVE-2025-64171
MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...
EUVD-2025-37859
MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...
CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator
MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...
marin3r 安全漏洞
marin3r is a lightweight CRD-based kubernetes control panel open-sourced by Red Hat 3scale SRE. A security vulnerability exists in marin3r 0.13.3 and earlier versions, which stems from a cross-namespace secret access vulnerability in DiscoveryServiceCertificate that could lead to bypassing RBAC a...
Important: Red Hat Security Advisory: Red Hat Developer Hub 1.7.2 release.
Red Hat Developer Hub 1.7.2 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...
Improper Authentication Exposure
github.com/chaos-mesh/chaos-mesh is vulnerable to improper authentication exposure. The vulnerability is due to the Chaos Controller Manager exposing an unauthenticated GraphQL debugging server to the entire Kubernetes cluster, which allows an attacker to kill arbitrary processes in any pod...
CVE-2025-58187 vulnerabilities
Vulnerabilities for packages: spiffe-helper, terraform-provider-time, cortex, k6, container-object-storage-interface, pulumi-language-java, velero-plugin-for-microsoft-azure, gke-gcloud-auth-plugin, shfmt, terraform-docs, petname, maru, custom-pod-autoscaler-operator, azure-ipam, nats, nerdctl,...
GHSA-QH38-484V-W52X vulnerabilities
Vulnerabilities for packages: rancher-machine, spiffe-helper, azure-ipam, fulcio, prometheus-mongodb-exporter, cilium-fips, prometheus-blackbox-exporter-fips, crossplane, prometheus-alertmanager-fips, rootlesskit, helm-set-status, container-object-storage-interface-fips, stakater-reloader-fips,...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Node DOS vulnerability in Kubernetes [CVE-2025-0426]
Summary IBM Watson Speech Services Cartridge is vulnerable to a Node DOS vulnerability in Kubernetes, due to a flaw in the kubelet read-only HTTP endpoint CVE-2025-0426. Kubernetes is used in our speech-utilities. This vulnerabilitiy has been addressed. Please read the details for remediation...
Improper Certificate Validation
KubernetesClient is vulnerable to Improper Certificate Validation. The vulnerability is due to inadequate verification of the certificate trust chain, which allows an attacker to present a forged certificate and perform man-in-the-middle attacks or impersonate the Kubernetes API server...
Moderate: Red Hat Security Advisory: Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.9.1
Assisted installer RHEL 8 components for the multicluster engine for Kubernetes 2.9.1 General Availability release, with updates to container images. Assisted Installer RHEL 8 integrates components for the general multicluster engine for Kubernetes 2.9.1 release that simplify the process of...
Moderate: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.9.1
Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.9.1 General Availability release, with updates to container images. Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.9.1 release that simplify the process of...
GHSA-7F5H-V6XP-FCQ8 vulnerabilities
Vulnerabilities for packages: reflex, k8s-sidecar, open-webui, mlflow, kserve, airflow...
CVE-2025-62727 vulnerabilities
Vulnerabilities for packages: reflex, k8s-sidecar, open-webui, mlflow, kserve, airflow...