61794 matches found
CVE-2026-34984
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...
CVE-2026-34984
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...
CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...
CVE-2026-34984
Summary: External Secrets Operator (ESO) versions 2.2.0 and earlier are vulnerable due to the v2 template engine’s getHostByName exposure in runtime/template/v2/template.go. An attacker who can create or update templated ExternalSecret resources can trigger controller-side DNS lookups using secre...
EUVD-2026-22190
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...
CVE-2026-34984 External Secrets Operator has DNS exfiltration via getHostByName in its v2 template engine
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...
CVE-2026-40089
Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery SSRF vulnerability in its API client apps/dashboard/lib/api.ts. Installations created using the provided install.sh script includi...
CVE-2026-40179 vulnerabilities
Vulnerabilities for packages: beats, mcp-grafana-fips, minio-fips, cloud-sql-proxy-fips, prometheus-pushgateway, karma-fips, istio-fips, mc, keda-fips, splunk-otel-collector-fips, mc-fips, cloudzero-agent-fips, grafana-pyroscope, prometheus, grafana-pyroscope-fips, minio-object-browser-fips,...
GHSA-VFFH-X6R8-XX99 vulnerabilities
Vulnerabilities for packages: beats, mcp-grafana-fips, minio-fips, cloud-sql-proxy-fips, prometheus-pushgateway, karma-fips, istio-fips, mc, keda-fips, splunk-otel-collector-fips, mc-fips, cloudzero-agent-fips, grafana-pyroscope, prometheus, grafana-pyroscope-fips, minio-object-browser-fips,...
CVE-2026-0209: Operator Precedence Logic Error
Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured...
CVE-2026-34984: Exposure of Sensitive Information to an Unauthorized Actor
External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernetes Secrets. Versions 2.2.0 and below contain a vulnerability in runtime/template/v2/template.go where the v2 template engine removes env and expandenv from Sprig's TxtFuncMap but...
CVE-2026-22683
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities,...
GHSA-R2PG-R6H7-CRF3 External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
Summary The v2 template engine in runtime/template/v2/template.go imports Sprig’s TxtFuncMap and removes env and expandenv, but leaves getHostByName available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated...
External Secrets Operator has DNS-based secret exfiltration via getHostByName in External Secrets v2 template engine
Summary The v2 template engine in runtime/template/v2/template.go imports Sprig’s TxtFuncMap and removes env and expandenv, but leaves getHostByName available to user-controlled templates. Because ESO executes templates inside the controller process, an attacker who can create or update templated...
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service (CVE-2026-34043)
Summary Node.js module serialize-javascript is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in...
PT-2026-32571
Name of the Vulnerable Software and Affected Versions External Secrets Operator versions prior to 2.3.0 Description The v2 template engine in runtime/template/v2/template.go removes env and expandenv from TxtFuncMap but leaves the getHostByName function accessible to user-controlled templates...
GHSA-77V3-R3JW-J2V2 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
CVE-2026-22822 vulnerabilities
Vulnerabilities for packages: external-secrets-operator...
CVE-2026-35206 vulnerabilities
Vulnerabilities for packages: pluto, cilium-cli, cluster-api-helm-controller, k8sgpt, harbor, kubescape, tigera-operator, trivy-operator, zarf, helm-push, helm, flux, kuma, zot, helm-mapkubeapis, tw, helm-operator, k9s, cert-manager-cmctl, k8ssandra-client, flux-source-controller, eksctl, linkerd...
GHSA-HR2V-4R36-88HR vulnerabilities
Vulnerabilities for packages: pluto, cilium-cli, cluster-api-helm-controller, k8sgpt, harbor, kubescape, tigera-operator, trivy-operator, zarf, helm-push, helm, flux, kuma, zot, helm-mapkubeapis, tw, helm-operator, k9s, cert-manager-cmctl, k8ssandra-client, flux-source-controller, eksctl, linkerd...