GO-2025-3367 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, timoni, chezmoi, flux-source-controller, kubescape, skaffold, argo-workflows, pulumi-kubernetes-operator, apko, goreleaser, syft, kubevela, pulumi-language-java, k9s, grafana-alloy, argocd-image-updater, guac, gitea, pulumi-language-dotnet,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, timoni, chezmoi, flux-source-controller, kubescape, skaffold, argo-workflows, pulumi-kubernetes-operator, apko, goreleaser, syft, kubevela, pulumi-language-java, k9s, grafana-alloy, argocd-image-updater, guac, gitea, pulumi-language-dotnet,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, argo-cd, chezmoi, flux-source-controller, kubescape, skaffold, gitlab-runner, teleport, argo-workflows, pulumi-kubernetes-operator, apko, gomplate, external-secrets-operator, cerbos, syft, trivy-operator, witness, kubevela, pulumi-language-java,...

GO-2026-4883 vulnerabilities

Vulnerabilities for packages: aws-otel-collector, apko, docker, goreleaser, trivy-operator, traefik, newrelic-infrastructure-agent, buf, grafana-alloy, neuvector-scanner, opentelemetry-operator, cri-tools, rancher-agent, buildah, datadog-agent, kpt, cluster-api, ko, envoy-gateway, rancher-machine...

GO-2026-4887 vulnerabilities

Vulnerabilities for packages: aws-otel-collector, apko, docker, goreleaser, trivy-operator, traefik, newrelic-infrastructure-agent, buf, grafana-alloy, neuvector-scanner, opentelemetry-operator, cri-tools, rancher-agent, buildah, datadog-agent, kpt, cluster-api, ko, envoy-gateway, rancher-machine...

GO-2026-5668 vulnerabilities

Vulnerabilities for packages: aws-otel-collector, trivy-operator, grafana-alloy, opentelemetry-operator, cri-tools, rancher-agent, buildah, datadog-agent, kpt, ko, envoy-gateway, rancher-machine, podman, zot, skopeo, nerdctl, kots, nuclei, docker-credential-gcr, undock, spire-server, rancher,...

GO-2026-4866 vulnerabilities

Vulnerabilities for packages: gh, flux-source-controller, nova, mountpoint-s3-csi-driver, omnibump, smokescreen, stakater-reloader, mariadb-operator, rabbitmq-messaging-topology-operator, go, apko, metacontroller, external-secrets-operator, local-path-provisioner, dataplaneapi, goreleaser,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kube-bench, sops, kiali, azure-workload-identity-webhook, sftpgo-plugin-pubsub, golangci-lint, rancher-webhook, pulumi-kubernetes-operator, continuity, prometheus-adapter, crossplane-provider-aws-firehose, dynamic-localpv-provisioner, external-secrets-operator,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: sops, gh, chezmoi, teleport, pulumi-kubernetes-operator, crossplane-provider-aws-firehose, external-secrets-operator, falcoctl, traefik, terraform-provider-azapi, pulumi-language-java, step-kms-plugin, docker-cli-buildx, rancher-agent, sealed-secrets,...

GO-2026-5006 vulnerabilities

Vulnerabilities for packages: chezmoi, pulumi-kubernetes-operator, external-secrets-operator, pulumi-language-java, step-kms-plugin, docker-cli-buildx, rancher-agent, flux-image-automation-controller, dagger, kots, caddy, spire-server, rancher, loki, cert-manager, melange, external-dns, mattermos...

GO-2026-5019 vulnerabilities

Vulnerabilities for packages: sops, gh, chezmoi, teleport, pulumi-kubernetes-operator, external-secrets-operator, falcoctl, pulumi-language-java, step-kms-plugin, docker-cli-buildx, rancher-agent, flux-image-automation-controller, rancher-machine, dagger, kots, kargo, flux-notification-controller...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: gitleaks, kube-bench, sops, k8sgateway, vale, sftpgo-plugin-pubsub, azure-workload-identity-webhook, golangci-lint, ferretdb, ipfs-cluster, chart-testing, crossplane-provider-aws-firehose, dynamic-localpv-provisioner, mongodb-kubernetes-operator, traefik,...

PT-2026-72129

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists when the SECURITY SCANNER V4 PSK pre-shared key is not configured. A remote unauthenticated attacker can send POST requests to the security scanner notification endpoint,...

CVE-2026-73850: Improper Neutralization of Special Elements used in an SQL Command

Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...

CVE-2026-16708: External Control of System or Configuration Setting

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...

CVE-2026-19680: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...

CVE-2026-19639: Improper Validation of Specified Quantity in Input

An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope...

CVE-2026-74243: Missing Authentication for Critical Function

A flaw was found in Red Hat Quay. When the SECURITYSCANNERV4PSK pre-shared key is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and inject path traversal characters into Cla...

CVE-2025-7639: Deserialization of Untrusted Data

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...

CVE-2026-19636: Generation of Incorrect Security Tokens

An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation...