GO-2025-3372 vulnerabilities

Vulnerabilities for packages: grafana-mimir, kube-bench-fips, sigstore-scaffolding-fips, pulumi-language-yaml, kubeflow-fips, kyverno-notation-aws, flux-image-reflector-controller-fips, nfs-subdir-external-provisioner-fips, opa-fips-envoy, cluster-proportional-autoscaler-fips, step-ca-fips,...

GO-2024-2883 vulnerabilities

Vulnerabilities for packages: fulcio, cortex, prometheus-alertmanager, timestamp-authority, rekor, grafana-mimir...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dex, ferretdb, terraform-provider-google, kargo, hubble-ui, spire-server, cloudnative-pg, spicedb, cilium-cli, temporal, kots, opentelemetry-collector, certificate-transparency, cert-manager-cmctl, guac, opa, smarter-device-manager, spegel, vcluster, k8sgpt, tflint,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: up, policy-controller, rclone, cortex, flux-image-reflector-controller, tekton-chains, spire-server, buildkitd, flux-source-controller, nuclei, opentelemetry-collector, guac, hugo, k8sgpt, kubescape, fluent-bit-plugin-loki, harbor-registry, druid,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, policy-controller, flux-image-reflector-controller, tekton-chains, kargo, spire-server, crossplane-provider-family-azure, gitsign, vexctl, buildkitd, flux-source-controller, nuclei, opentelemetry-collector,...

SUSE CVE-2026-47671

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

CLEANSTART-2026-SP48916 Security fixes in grafana-mimir-fips 3.0.5-r1

Package grafana-mimir-fips version 3.0.5-r1 fixes 12 vulnerabilities: ghsa-hfvc-g4fc-pqhx, ghsa-w8rr-5gcm-pp58, CVE-2026-39883, CVE-2026-39882, CVE-2026-27140...

CLEANSTART-2026-RY66554 Security fixes in grafana-mimir-fips 3.0.4-r1

Package grafana-mimir-fips version 3.0.4-r1 fixes 1 vulnerabilities: CVE-2026-34986...

CLEANSTART-2026-JG10359 Security fixes in grafana-mimir 3.0.2-r0

Package grafana-mimir version 3.0.2-r0 fixes 9 vulnerabilities: CVE-2025-68121, ghsa-9h8m-3fm2-qjrq, CVE-2025-61732, CVE-2026-24051, CVE-2026-25679...

CLEANSTART-2026-QD77000 Security fixes in grafana-mimir-fips 3.0.2-r0

Package grafana-mimir-fips version 3.0.2-r0 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2025-68121, CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-PI73299 Security fixes in grafana-mimir 3.0.2-r1

Package grafana-mimir version 3.0.2-r1 fixes 2 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-IS30019 Security fixes in grafana-mimir-fips 2.17.10-r0

Package grafana-mimir-fips version 2.17.10-r0 fixes 3 vulnerabilities: ghsa-w8rr-5gcm-pp58, CVE-2026-27141, CVE-2026-39882...

CLEANSTART-2026-PK62931 Security fixes in grafana-mimir-fips 3.0.2-r1

Package grafana-mimir-fips version 3.0.2-r1 fixes 2 vulnerabilities: CVE-2026-24051, ghsa-9h8m-3fm2-qjrq...

CVE-2026-47671

Nhost CLI prior to 1.46.0 exposes an unauthenticated, cross-origin-configurable configserver via nhost dev. The hidden configserver serves Mimir GraphQL with dummy authorization and permissive CORS (Access-Control-Allow-Origin: *). An attacker-controlled web page can reach localhost and perform q...

CVE-2026-47671 Nhost CLI local configserver allows cross-origin unauthenticated read/write access to local development configuration and secrets

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: spire-server-fips, crossplane-provider-azure-powerbidedicated, crossplane-provider-azure-orbital, crossplane-function-patch-and-transform, crossplane-provider-aws-s3-fips, scorecard, k8s-image-swapper-fips, terraform-fips, coredns, vertical-pod-autoscaler,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: spire-server-fips, crossplane-provider-azure-powerbidedicated, crossplane-provider-azure-orbital, crossplane-function-patch-and-transform, crossplane-provider-aws-s3-fips, scorecard, k8s-image-swapper-fips, terraform-fips, coredns, vertical-pod-autoscaler,...

PT-2026-46881

Name of the Vulnerable Software and Affected Versions Nhost CLI affected versions not specified Description The hidden configserver used by nhost dev exposes the Mimir GraphQL API with permissive CORS and dummy authorization directives. This allows any process capable of reaching the developer's...

CLEANSTART-2026-CY26398 Security fixes for CVE-2026-34986, ghsa-78h2-9frx-2jm8, ghsa-hfvc-g4fc-pqhx, ghsa-mh2q-q3fh-2475, ghsa-w8rr-5gcm-pp58, ghsa-xmrv-pmrh-hhx2 applied in versions: 3.0.5-r0, 3.0.6-r0

Multiple security vulnerabilities affect the grafana-mimir-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MJ36694 Security fixes for CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-27141, CVE-2026-33186, CVE-2026-39882, ghsa-9h8m-3fm2-qjrq, ghsa-p77j-4mvh-x3m3, ghsa-w8rr-5gcm-pp58 applied in versions: 2.17.10-r0, 3.0.2-r0, 3.0.2-r1

Multiple security vulnerabilities affect the grafana-mimir-fips package. These issues are resolved in later releases. See references for individual vulnerability details...