CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: falcosidekick, rancher-system-agent, rancher-webhook, falcoctl, fscrypt, secrets-store-csi-driver-provider-aws, cri-tools, jitsucom-bulker, nsc, timescaledb-parallel-copy, spqr, kubebuilder, task, harbor, docker-cli-buildx, oauth2-proxy, rekor,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: falcosidekick, rancher-system-agent, rancher-webhook, falcoctl, fscrypt, secrets-store-csi-driver-provider-aws, cri-tools, jitsucom-bulker, nsc, timescaledb-parallel-copy, spqr, kubebuilder, task, harbor, docker-cli-buildx, oauth2-proxy, rekor,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: falcosidekick, rancher-system-agent, rancher-webhook, falcoctl, fscrypt, secrets-store-csi-driver-provider-aws, cri-tools, jitsucom-bulker, nsc, timescaledb-parallel-copy, spqr, kubebuilder, task, harbor, docker-cli-buildx, oauth2-proxy, rekor,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: falcosidekick, rancher-system-agent, rancher-webhook, falcoctl, fscrypt, secrets-store-csi-driver-provider-aws, cri-tools, jitsucom-bulker, nsc, timescaledb-parallel-copy, spqr, kubebuilder, task, harbor, docker-cli-buildx, oauth2-proxy, rekor,...

CVE-2025-58188 vulnerabilities

Vulnerabilities for packages: falcosidekick, rancher-system-agent, rancher-webhook, falcoctl, fscrypt, secrets-store-csi-driver-provider-aws, cri-tools, jitsucom-bulker, nsc, timescaledb-parallel-copy, spqr, kubebuilder, task, harbor, docker-cli-buildx, oauth2-proxy, rekor,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: falcosidekick, rancher-system-agent, rancher-webhook, falcoctl, fscrypt, secrets-store-csi-driver-provider-aws, cri-tools, jitsucom-bulker, nsc, timescaledb-parallel-copy, spqr, kubebuilder, task, harbor, docker-cli-buildx, oauth2-proxy, rekor,...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: multus-cni-fips, vexctl, chartmuseum-fips, x509-certificate-exporter-fips, cert-exporter-fips, rancher-telemetry, capslock, vertical-pod-autoscaler-fips, azuredisk-csi-fips, terraform-provider-sendgrid-fips, kafka-proxy, prometheus-node-exporter, harbor, loki,...

ROS-20251030-02

A vulnerability in the NVIDIA Virtual GPU Manager component of the NVIDIA Virtual GPU driver Virtual GPU is associated with incorrectly assigning permissions to a critical resource. Exploitation of the vulnerability could allow an attacker to cause a denial of service Vulnerability in the NVIDIA...

GHSA-Q8J9-34QF-7VQ7 Silver has unrestricted traffic between Wireguard clients

Summary Sliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to: 1. Leaked/recovered keypair from a beacon being used to attack operators. 2. Port forwardings usable from other implants. Details 1. Sliver treat operators' Wireguard config and...

ROS-20251028-10

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

ROS-20251028-11

A vulnerability in the NVIDIA Container Toolkit container creation and launch software and the NVIDIA GPU Operator resource management software is associated with synchronization errors. NVIDIA GPU Operator resource management software is associated with synchronization errors when using a shared...

langchainlanggraph-checkpoint-sqlite SQL注入漏洞

langchainlanggraph-checkpoint-sqlite is an open source database connectivity Python library from LangChain. An SQL injection vulnerability exists in langchainlanggraph-checkpoint-sqlite version 2.0.10, which stems from improper handling of the filter operator and could lead to an SQL injection...

CVE-2025-47699

Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497 in the Gallagher Morpho integration could allow an authenticated operator with limited site permissions to make critical changes to local Morpho devices. This issue affects Command Centre Server: 9.30 prior to...

CVE-2025-48430

Uncaught Exception CWE-248 in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to vEL9.10.3672 MR7, 9.00 prior to...

CVE-2025-35981

Exposure of Private Personal Information to an Unauthorized Actor CWE-359 in the Command Centre Server allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This issue affects Command Centre Server: 9.30.1874 MR1, 9.20.2337...

CVE-2025-41402

Client-Side Enforcement of Server-Side Security CWE-602 in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks. This issue affects Command Centre Server: 9.30 prior to vEL9.30.2482 MR2, 9.20 prior to vEL9.20.2819 MR4, 9.10 prior to...

GO-2025-3992 NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path in github.com/NVIDIA/gpu-operator

NVIDIA Container Toolkit for all platforms contains an Untrusted Search Path in github.com/NVIDIA/gpu-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2025-3998 NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook in github.com/NVIDIA/gpu-operator

NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook in github.com/NVIDIA/gpu-operator. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...