GO-2022-0587 vulnerabilities

Vulnerabilities for packages: opa...

GO-2022-0574 vulnerabilities

Vulnerabilities for packages: opa...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-fips-envoy, opa-envoy...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: zot, policy-controller, conftest-fips, zarf, conftest, policy-controller-fips, kubescape, kots, spire-server-fips, tfsec, snyk-cli, opa, spire-server, k8sgpt, cosign, cosign-fips...

GO-2025-4100 vulnerabilities

Vulnerabilities for packages: kaniko-fips, newrelic-infrastructure-agent-fips, apm-server, steampipe, osv-scanner, falco-no-driver, xeol, k8ssandra-client, consul-k8s-fips, xeol-fips, manifest-tool, newrelic-infrastructure-agent, tw, consul-k8s, opa-fips-envoy, rancher, dagger, spegel,...

GO-2025-3372 vulnerabilities

Vulnerabilities for packages: grafana-mimir, portieris-fips, sigstore-scaffolding, portieris, google-osconfig-agent, kube-bench-fips, smarter-device-manager-fips, sriov-network-device-plugin, nfs-subdir-external-provisioner-fips, skaffold, amass, caddy, step-issuer, kyverno, opa-envoy,...

GO-2025-4175 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-plugins-trivy-fips, cass-operator-fips, azure-service-operator-fips, azuredisk-csi-fips, gcp-compute-persistent-disk-csi-driver-fips, hubble-ui-backend-fips, kserve-rest-proxy, nvidia-nsight-compute-13.0, kube-metrics-adapter-fips,...

GO-2022-0574 vulnerabilities

Vulnerabilities for packages: opa...

GO-2026-4506 vulnerabilities

Vulnerabilities for packages: opa-envoy...

GO-2024-3141 vulnerabilities

Vulnerabilities for packages: opa, conftest, kubescape, snyk-cli, zarf, tfsec, zot, spire-server, k8sgpt, policy-controller, kots, cosign...

GO-2024-2978 vulnerabilities

Vulnerabilities for packages: dagger, rqlite, dbmate, opa, conftest, k3s, sigstore-scaffolding, kots, trivy, spicedb, step-ca, step, terraform-provider-google, terraform-docs, opentelemetry-collector, osv-scanner, k8sgpt-operator, zarf, grafana-agent-operator, grafana-mimir, k8sgpt, kaniko,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, render-template, docker-cli, aws-otel-collector, flux, spark-operator, undock, timescaledb-tune, eksctl, cerbos, rancher-system-agent, k8sgpt, kubernetes-dashboard-web, dive, gcsfuse, rabbitmq-messaging-topology-operator, aactl, fulci...

CVE-2026-73285

RustFS (distributed object storage in Rust) up to version 1.0.0-rc.1 is affected. The external OPA authorization configured via RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs incorrectly sets PreparedIamAuth.needs_existing_object_tag for PreparedIamMode::Opa, which can cause maybe_merge_object...

EUVD-2026-57229

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

CVE-2026-73285 RustFS: OPA policy plugin omits ExistingObjectTag conditions, allowing tag-based authorization policies to treat tagged objects as untagged

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFSPOLICYPLUGINURL in crates/iam/src/sys.rs sets PreparedIamAuth.needsexistingobjecttag incorrectly for PreparedIamMode::Opa, causing...

PT-2026-71088

RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS POLICY PLUGIN URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs existing object tag incorrectly for PreparedIamMode::Opa, causing maybe merg...

CVE-2026-64676 Kata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory

Kata Containers is an open source implementation of lightweight Virtual Machines VMs that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory management. In Confidential Containers CoCo deployments, the kata-age...

CVE-2026-56852 affecting package opa for versions less than 0.63.0-5

CVE-2026-56852 affecting package opa for versions less than 0.63.0-5. A patched version of the package is available...

EUVD-2026-48437

Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...

CVE-2026-50197

Summary: CVE-2026-50197 affects zalando/skipper’s OpenPolicyAgent integration. When clients use HTTP/1.1 Transfer-Encoding: chunked or HTTP/2 without Content-Length, the opaAuthorizeRequestWithBody flow exposes an empty raw_body and parsed input.parsed_body to OPA, causing policy checks that rely...