CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: docker, eksctl, zot, k3s, trivy-operator, kubescape, cluster-api-helm-controller, kaniko, fuse-overlayfs-snapshotter, buildkitd, trivy, helm-set-status, grype, neuvector-scanner, rancher-agent, wolfictl, k9s, scorecard, spegel, chartmuseum, helm-push, steampipe, syft...

CLEANSTART-2026-PS05327 Security fix for CVE-2025-53547 applied in: consul-k8s-fips 1.5.9-r0, harbor 2.13.4-r2, harbor 2.14.2-r1, k8sgpt 0.4.26-r2, kubevela 1.10.8-r0

CVE-2025-53547 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZE96570 Security fix for ghsa-9h84-qmv7-982p applied in: cert-manager-cmctl 2.3.0-r0, cert-manager-cmctl-fips 2.1.1-r0, cert-manager-cmctl-fips 2.3.0-r0, chartmuseum-fips 0.14.0-r1, chartmuseum-fips 0.15.0-r4, harbor 2.13.4-r2, harbor 2.14.2-r1, harbor-fips 2.10.3-r0, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, k8sgpt 0.4.26-r0, kubevela 1.10.8-r0

ghsa-9h84-qmv7-982p affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GF48427 Security fix for ghsa-5xqw-8hwv-wg92 applied in: cert-manager-cmctl-fips 2.1.1-r0, chartmuseum-fips 0.14.0-r1, chartmuseum-fips 0.15.0-r4, kubevela 1.10.8-r0

ghsa-5xqw-8hwv-wg92 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WI36826 Security fix for ghsa-4hfp-h4cw-hj8p applied in: cert-manager-cmctl-fips 2.1.1-r0, chartmuseum-fips 0.14.0-r1, chartmuseum-fips 0.15.0-r4, kubevela 1.10.8-r0

ghsa-4hfp-h4cw-hj8p affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KS29431 Security fix for CVE-2026-32285 applied in: gitlab-runner 18.11.1-r0, grafana-alloy 1.13.1-r1, kubevela 1.10.8-r0, prometheus 3.11.0-r0, tempo 2.10.3-r0, tempo 2.9.1-r1, tempo-fips 2.10.3-r0, tempo-fips 2.9.1-r1, terragrunt-fips 0.94.0-r3, terragrunt-fips 0.95.1-r3, terragrunt-fips 0.96.1-r3, terragrunt-fips 0.98.0-r4

CVE-2026-32285 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LO90472 Security fix for ghsa-x744-4wpc-v9h2 applied in: cadvisor-fips 0.55.1-r0, kubevela 1.10.8-r0, melange 0.56.1-r1, paranoia 0.2.1-r0, spire-server-fips 1.15.1-r1

ghsa-x744-4wpc-v9h2 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YF91950 Security fix for ghsa-m7cr-m3pv-hgrp applied in: apko 1.2.13-r0, argo-cd 3.1.16-r1, argo-cd 3.2.12-r0, argo-cd 3.2.7-r3, argo-cd 3.3.11-r0, argo-cd 3.3.5-r2, argo-cd-fips 3.1.14-r2, argo-events 1.9.10-r1, argo-workflows 4.0.5-r0, argo-workflows-fips 4.0.6-r1, external-secrets-fips 0.17.0-r2, kubevela 1.10.8-r0, kyverno 1.18.1-r2, pulumi-kubernetes-operator 2.7.0-r0

ghsa-m7cr-m3pv-hgrp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WC68837 Security fix for CVE-2025-32387 applied in: kubevela 1.10.8-r0

Security vulnerability affects the kubevela package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-EE09812 Security fix for CVE-2025-32386 applied in: kubevela 1.10.8-r0

Security vulnerability affects the kubevela package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-GA19307 Security fix for ghsa-fqw6-gf59-qr4w applied in: helm-operator 1.42.2-r0, k8sgpt 0.4.33-r0, kubevela 1.10.8-r0, newrelic-infrastructure-agent 1.73.1-r1, tigera-operator 1.42.0-r0

ghsa-fqw6-gf59-qr4w affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

PT-2026-101986

Security vulnerability affects the kubevela package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100414

Security vulnerability affects the kubevela package. This issue is resolved in later releases. See references for vulnerability details...

SUSE CVE-2026-55108

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...

GO-2026-6312 KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela

KubeVela Terraform remote loader DoS via unbounded file read in github.com/oam-dev/kubevela...

CVE-2026-55108

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...

CVE-2026-55108

creationtimestamp| type| source ---|---|--- 2026-08-28 18:35:46+00:00| published-proof-of-concept| https://github.com/kubevela/kubevela/security/advisories/GHSA-fmgp-q6jx-gg3x 2026-08-30 14:02:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muckkxgqnj27...

KubeVela Terraform remote loader DoS via unbounded file read

Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...

GHSA-FMGP-Q6JX-GG3X KubeVela Terraform remote loader DoS via unbounded file read

Summary KubeVela's Terraform remote configuration loader can be abused to make vela-core read an unbounded byte stream into memory, causing an out-of-memory kill and a control-plane denial of service. The issue is reachable when a user with permission to create or update a core.oam.dev/v1beta1...

CVE-2026-55108 KubeVela Terraform remote loader DoS via unbounded file read

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...