GO-2025-3845 vulnerabilities

Vulnerabilities for packages: gatus...

GO-2026-4740 vulnerabilities

Vulnerabilities for packages: flyte...

GO-2026-5046 vulnerabilities

Vulnerabilities for packages: dapr, bento, opentelemetry-collector-contrib, splunk-otel-collector...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: docker-machine-driver-harvester, vcluster, emissary, rancher-system-agent, yunikorn-k8shim, cloud-provider-gcp-cloud-controller-manager, mesosphere-vsphere-csi, kubernetes-csi-driver-hostpath, rancher-fleet...

GO-2025-4181 vulnerabilities

Vulnerabilities for packages: caddy...

GO-2026-5527 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GO-2026-5856 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, k8ssandra-client, kube-logging-operator-custom-runner, kubeflow, vexctl, consul-k8s, weaviate, envconsul, kor, grafana-agent-operator, kube-vip, spark-operator, crossplane-provider-family-aws, regclient, rqlite, cert-manager-webhook-pdns,...

GO-2026-5038 vulnerabilities

Vulnerabilities for packages: haproxy-ingress, dynamic-localpv-provisioner, kubeflow-pipelines, vcluster, kubernetes-event-exporter, emissary, kuberay-operator, cass-operator, crossplane-provider-family-azure, crossplane-provider-aws-sqs, crossplane-provider-azure-sql, cluster-autoscaler,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: yq, dynamic-localpv-provisioner, memcached-exporter, flux-source-controller, kubeflow, weaviate, spark-operator, nri-prometheus, kube-state-metrics, runc, rqlite, thanos-operator, k8sgpt, cosign, dive, kubernetes-csi-external-provisioner, gke-gcloud-auth-plugin,...

GO-2026-4865 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter-ui, memcached-exporter, kubernetes-event-exporter, emissary, crossplane-provider-family-azure, flux-source-controller, k8ssandra-client, etcd, migrate, crossplane-provider-azure-sql, kubernetes-csi-driver-hostpath, vexctl, litestream,...

GO-2025-3563 vulnerabilities

Vulnerabilities for packages: linkerd2-proxy-init, yq, cass-operator, crossplane-provider-family-azure, vexctl, golangci-lint, grafana-agent-operator, regclient, ip-masq-agent, cert-manager-webhook-pdns, sealed-secrets, octo-sts, croc, sqlexporter, newrelic-infra-operator, helm-operator,...

GO-2024-3106 vulnerabilities

Vulnerabilities for packages: yq, kubeflow-pipelines, cass-operator, crossplane-provider-family-azure, k8ssandra-client, opentelemetry-collector-contrib, vexctl, terraform-docs, fzf, weaviate, kor, golangci-lint, grafana-agent-operator, kube-vip, spark-operator, crossplane-provider-family-aws,...

CVE-2026-47766: UNIX Symbolic Link (Symlink) Following

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...

PT-2026-72037

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

PT-2026-80164

Name of the Vulnerable Software and Affected Versions NLTK Stanford Wrappers affected versions not specified Description An issue exists that allows for JVM Argument Injection Bypass. This occurs when an attacker can inject arbitrary arguments into the Java Virtual Machine JVM, which is the engin...

Oracle Linux 8 : .NET / 8.0 (ELSA-2026-54538)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54538 advisory. 8.0.130-1.0.1 - Add support for Oracle Linux 8.0.130-1 - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235468 Tenable has extracted t...

.NET 9.0 security, bug fix, and enhancement update

9.0.120-1.0.1 - Add support for Oracle Linux 9.0.120-1 - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235473...

CVE-2026-56862 Limit handshake messages we are willing to accept post-handshake in crypto/tls

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...

CVE-2026-18249 IBM i Is Affected By Multiple Vulnerabilities in IBM Java SDK and IBM Java Runtime

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses...