CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: opentofu, helm-operator-fips, falcoctl, gitlab-operator-fips, helm-operator, gitlab-operator, kyverno-fips, vcluster-fips, oras, helm-set-status, kube-arangodb, cilium-cli, chartmuseum, kgateway, linkerd2, kots, trivy-fips, gatekeeper, kyverno-notation-aws-fips,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: opentofu, helm-operator-fips, falcoctl, gitlab-operator-fips, helm-operator, gitlab-operator, kyverno-fips, vcluster-fips, oras, helm-set-status, kube-arangodb, cilium-cli, chartmuseum, kgateway, linkerd2, kots, trivy-fips, gatekeeper, kyverno-notation-aws-fips,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: opentofu, helm-operator-fips, falcoctl, gitlab-operator-fips, helm-operator, gitlab-operator, kyverno-fips, vcluster-fips, oras, helm-set-status, kube-arangodb, cilium-cli, chartmuseum, kgateway, linkerd2, kots, trivy-fips, gatekeeper, kyverno-notation-aws-fips,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: opentofu, helm-operator-fips, falcoctl, gitlab-operator-fips, helm-operator, gitlab-operator, kyverno-fips, vcluster-fips, oras, helm-set-status, kube-arangodb, cilium-cli, chartmuseum, kgateway, linkerd2, kots, trivy-fips, gatekeeper, kyverno-notation-aws-fips,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: kubevela, neuvector-fips, ctop, helm-operator-fips, helm-operator, zot, helm-set-status, kube-arangodb, chartmuseum, buildkitd, spegel-fips, docker, kgateway, linkerd2, kots, trivy-fips, gatekeeper, grype-fips, rancher-helm, chaos-mesh-fips, kaniko, scorecard,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: kubevela, neuvector-fips, ctop, helm-operator-fips, helm-operator, zot, helm-set-status, kube-arangodb, chartmuseum, buildkitd, spegel-fips, docker, upwind-agent, linkerd2, kots, trivy-fips, gatekeeper, opa, grype-fips, rancher-helm, chaos-mesh-fips, kaniko, scorecar...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: kubevela, nuclei, zot, kyverno-fips, grafana-alloy, chainloop-cli, flux, gitsign, upwind-agent, gitea, tfsec, kots, trivy-fips, grafana-alloy-fips, grype-fips, rancher-fleet, kaniko, gptscript, argocd-image-updater-fips, scorecard, teleport, trufflehog-fips,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: kubevela, nuclei, zot, kyverno-fips, grafana-alloy, chainloop-cli, flux, gitsign, upwind-agent, gitea, tfsec, kots, trivy-fips, grafana-alloy-fips, grype-fips, rancher-fleet, kaniko, gptscript, argocd-image-updater-fips, scorecard, teleport, trufflehog-fips,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: kubevela, nuclei, zot, kyverno-fips, grafana-alloy, chainloop-cli, flux, gitsign, upwind-agent, gitea, tfsec, kots, trivy-fips, grafana-alloy-fips, grype-fips, rancher-fleet, kaniko, gptscript, argocd-image-updater-fips, scorecard, teleport, trufflehog-fips,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: malcontent, witness, redpanda, vcluster, minio, mcp-grafana, k3s, dgraph, loki, kubevela, goreleaser, opentelemetry-collector-contrib, terraform-mcp-server, nuclei, ollama, opentelemetry-collector, gitlab-runner, terragrunt, cri-tools, rclone, lazygit, datadog-agent,...

CVE-2023-50976

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

EUVD-2023-34868

Malicious code in bioql PyPI...

EUVD-2023-28634

Malicious code in bioql PyPI...

EUVD-2023-55703

Malicious code in bioql PyPI...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: kubevela, podinfo, kubernetes-dashboard, crossplane-provider-sql, s5cmd, kepler, step-ca, crossplane-provider-azure-storage, slsa-verifier, velero, kubernetes-dashboard-metrics-scraper-fips, cargobump, glab, kuberay-operator-fips, lazygit, neuvector-dbgen-fips,...

CVE-2023-30450

rpk in Redpanda before 23.1.2 mishandles the redpanda.rpcservertls field, leading to for example situations in which there is a data type mismatch that cannot be automatically fixed by rpk, and instead a user must reconfigure while a cluster is turned off in order to have TLS on broker RPC ports...

CVE-2023-24619

Redpanda before 22.3.12 discloses cleartext AWS credentials. The import functionality in the rpk binary logs an AWS Access Key ID and Secret in cleartext to standard output, allowing a local user to view the key in the console, or in Kubernetes logs if stdout output is collected. The fixed versio...

CVE-2023-50976

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

Authorization

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API...

Redpanda Security Vulnerabilities

Redpanda is a streaming data platform for developers. It is compatible with the Kafka API. Redpanda has a security vulnerability that stems from a lack of authorization checks in the Transactions API. Affected products and versions: Redpanda versions before 23.1.21, 23.2.x versions before 23.2.18...