GO-2025-3488 vulnerabilities

Vulnerabilities for packages: crossplane-function-environment-configs, nri-discovery-kubernetes, crossplane-provider-aws-rds, conftest-fips, metrics-server-fips, cloudprober, amazon-k8s-cni, packer, cluster-api-aws-controller, amazon-cloudwatch-agent-operator, opentelemetry-collector,...

GO-2025-3848 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector...

GO-2024-2899 vulnerabilities

Vulnerabilities for packages: melange, pombump...

GO-2026-5337 vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-notation-aws...

GO-2026-4753 vulnerabilities

Vulnerabilities for packages: rancher, teleport, rancher-agent, dex, mattermost...

GO-2024-2948 vulnerabilities

Vulnerabilities for packages: wolfictl, zot, zarf, k9s, tflint, terragrunt, kubescape, grype, terraform, conftest, trivy, kots, tfsec, snyk-cli...

GO-2024-3277 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, argocd-image-updater...

GO-2026-5235 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, argo-workflows...

GO-2024-2609 vulnerabilities

Vulnerabilities for packages: sbomqs, configmap-reload, pulumi-language-java, actions-runner-controller, docker-credential-acr-env, nri-apache, stakater-reloader, yam, controller-gen, cri-tools, wait-for-port, prometheus-alertmanager, kyverno-policy-reporter, k8sgpt, protoc-gen-go-grpc,...

GO-2026-5074 vulnerabilities

Vulnerabilities for packages: gptscript, osv-scanner, wolfictl, pulumi-language-java, teleport, dagger, skaffold, scorecard, nfpm, pulumi-language-yaml, argo-events, steampipe, grype, kots, gitea, bom, gitsign, gitaly, zot, trivy-operator, k9s, kubevela, kargo, grafana-alloy, crossplane,...

GO-2026-4871 vulnerabilities

Vulnerabilities for packages: keda, neuvector-scanner, contour, pulumi-language-java, go-discover, licenseclassifier, terraform-mcp-server, terraform-provider-aws, protoc-gen-go-grpc, kbld, terraform-provider-random, victoriametrics, cue, custom-pod-autoscaler-operator, step-issuer,...

GO-2026-4762 vulnerabilities

Vulnerabilities for packages: keda, neuvector-scanner, contour, pulumi-language-java, crossplane-provider-aws-sns, crossplane-provider-aws-cloudfront, go-discover, terraform-provider-aws, k8sgpt, terraform-provider-random, tflint, step-issuer, terraform-provider-grafana, docker-compose,...

GO-2025-3754 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws, pulumi-language-java, actions-runner-controller, crossplane-provider-aws-sns, crossplane-provider-aws-cloudfront, tkn, atlantis, crossplane-provider-azure-managedidentity, goreleaser, buildkitd, cosign, crossplane-provider-aws-firehose,...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, pulumi-language-java, terraform-provider-aws, k8sgpt, protoc-gen-go-grpc, tflint, step-issuer, cadvisor, docker-compose, rabbitmq-cluster-operator, memcached-exporter, dagdotdev, rabbitmq-default-user-credential-updater, kube-logging-operator,...

GO-2024-2963 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, pulumi-language-java, terraform-provider-aws, k8sgpt, protoc-gen-go-grpc, tflint, cue, step-issuer, cadvisor, docker-compose, rabbitmq-cluster-operator, memcached-exporter, dagdotdev, rabbitmq-default-user-credential-updater, kube-logging-operator,...

CVE-2026-73420 vulnerabilities

Vulnerabilities for packages: langfuse, langfuse-fips, jitsucom-jitsu...

CLEANSTART-2026-FH61032 Security fixes in metrics-server 0.8.1-r2

Package metrics-server version 0.8.1-r2 fixes 13 vulnerabilities: CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-hrxh-6v49-42gf, CVE-2026-42154, ghsa-8rm2-7qqf-34qm...

DEBIAN-CVE-2026-68398

In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tprecv runs in the L2TP UDP-encap softirq RX path: l2tpudpencaprecv - l2tprecvcommon - pppol2tprecv - pppinput&po-chan It runs under rcureadlock holding...

Malicious code in ventrix-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b68f964850d0777c1f3993c52e3b66dc425b02ee82fb33bcd958514f730926 [email protected] ships a loader that, when the package's default getPlugin export is invoked, performs an HTTP request to the hardcoded endpoint...

MAL-2026-11706 Malicious code in @or-sdk/library (npm)

npm/@or-sdk/library is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...