GO-2023-2095 vulnerabilities

Vulnerabilities for packages: metrics-server, kind, kubeflow-katib...

GO-2023-2043 vulnerabilities

Vulnerabilities for packages: metrics-server, kind, kubeflow-katib...

GO-2023-2041 vulnerabilities

Vulnerabilities for packages: metrics-server, kind, kubeflow-katib...

GO-2026-5208 vulnerabilities

Vulnerabilities for packages: snyk-cli, kube-metrics-adapter, temporal, temporal-ui-server, fq...

GO-2024-3205 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, fq...

GO-2026-5264 vulnerabilities

Vulnerabilities for packages: prometheus-operator, grafana, minio-operator, certificate-transparency, prometheus, amazon-cloudwatch-agent-operator, datadog-agent, fluent-bit-plugin-loki, jaeger, cloud-sql-proxy, karma, node-problem-detector, prometheus-pushgateway, minio, istio, metrics-server,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: gogatekeeper, golangci-lint, kuma, docker-credential-acr-env, victoriametrics-cluster, delve, jaeger-operator, podinfo, opa-envoy, slsa-verifier, external-secrets-operator, crossplane-provider-aws-sqs, jitsucom-bulker, pulumi-language-java, secrets-store-csi-driver,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: sbom-scorecard, go-md2man, scorecard, aws-flb-kinesis, gke-gcloud-auth-plugin, cass-operator, nri-discovery-kubernetes, wait-for-port, gosu, ip-masq-agent, mage, slsa-verifier, kind, go-licenses, cni-plugins, aws-flb-firehose, amass, docker-credential-ecr-login,...

CLEANSTART-2026-DY70483 Security fixes in metrics-server 0.8.1-r4

Package metrics-server version 0.8.1-r4 fixes 13 vulnerabilities: CVE-2026-33186, CVE-2026-42154, CVE-2026-39883, ghsa-hrxh-6v49-42gf, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-NI09803 Security fixes in metrics-server 0.8.1-r5

Package metrics-server version 0.8.1-r5 fixes 6 vulnerabilities: CVE-2026-42154, CVE-2026-42151, CVE-2026-44903, ghsa-wg65-39gg-5wfj, ghsa-fw8g-cg8f-9j28...

CLEANSTART-2026-FH61032 Security fixes in metrics-server 0.8.1-r2

Package metrics-server version 0.8.1-r2 fixes 13 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-42154, ghsa-8rm2-7qqf-34qm...

CLEANSTART-2026-IJ26025 Security fixes in metrics-server 0.8.1-r3

Package metrics-server version 0.8.1-r3 fixes 13 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-42151, CVE-2026-42154...

CVE-2026-64934

CVE-2026-64934 affects the Mira Hormone Monitor ecosystem, specifically the Mira Android App and related cloud API. The root cause is reliance on the firmware version reported by the companion app without independent attestation from the device itself. An authenticated attacker could submit arbit...

CVE-2026-64934

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to...

CVE-2026-72542

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

CVE-2026-72542 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

CVE-2026-72542

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

EUVD-2026-56012

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

CVE-2026-72542 Windmill Labs Windmill - Missing Authorization

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The jobmetrics handlers accept no authorization extractor, bypassing workspace-level acce...

CVE-2026-72542

Windmill Labs Windmill (up to version 1.783.0) has a missing-authorization vulnerability. Authenticated operators can write job progress and read job metrics for any job in the workspace because the job_metrics handlers do not perform an authorization check, bypassing workspace-level access contr...