GO-2025-3462 vulnerabilities

Vulnerabilities for packages: temporal-fips, temporal-server-fips, temporal, temporal-ui-server-fips, temporal-ui-server, temporal-server...

GO-2026-5208 vulnerabilities

Vulnerabilities for packages: temporal-fips, snyk-cli, kube-metrics-adapter, gotenberg, temporal, kube-metrics-adapter-fips, temporal-ui-server-fips, temporal-ui-server, fq...

GO-2024-2598 vulnerabilities

Vulnerabilities for packages: nri-haproxy, fuse-overlayfs-snapshotter, gke-gcloud-auth-plugin, prometheus-elasticsearch-exporter, prometheus-pushgateway-fips, prometheus-mongodb-exporter-fips, kubernetes-dashboard-fips, yam, prometheus-operator-fips, aws-flb-cloudwatch, configmap-reload,...

GO-2024-2609 vulnerabilities

Vulnerabilities for packages: nri-haproxy, fuse-overlayfs-snapshotter, gke-gcloud-auth-plugin, prometheus-elasticsearch-exporter, prometheus-pushgateway-fips, prometheus-mongodb-exporter-fips, kubernetes-dashboard-fips, yam, prometheus-operator-fips, aws-flb-cloudwatch, configmap-reload,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: prometheus-pushgateway-fips, prometheus-mongodb-exporter-fips, crossplane-provider-azure-managedidentity, kubescape, haproxy-ingress, melange, kubernetes-dashboard, prometheus-postgres-exporter-fips, sops, dex-k8s-authenticator, prometheus-nats-exporter, gobuster,...

GO-2025-3462 vulnerabilities

Vulnerabilities for packages: temporal, temporal-ui-server, temporal-server...

GO-2026-5208 vulnerabilities

Vulnerabilities for packages: snyk-cli, temporal, temporal-ui-server, kube-metrics-adapter, fq...

CLEANSTART-2026-UG13000 Security fixes in temporal-ui-server-fips 2.51.1-r1

Package temporal-ui-server-fips version 2.51.1-r1 fixes 36 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

EUVD-2026-56924

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

Temporal UI Server may set OAuth credential cookies without Secure when TLS terminates at a reverse proxy and forwards callbacks to the UI server over HTTP. This can allow an attacker-controlled scenario to access access-token and possibly refresh-token cookies if the attacker can steer UI hostna...

CVE-2026-67179

Genkit’s Dev UI server (default port 4000) suffers from improper validation of host request headers, enabling DNS rebinding to reach POST /api/runAction from any host on the developer’s network or any site the developer visits. This allows an attacker to execute any registered Genkit action and r...

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

PT-2026-70265

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

CLEANSTART-2026-BQ82502 Security fixes in temporal-ui-server-fips 2.44.0-r0

Package temporal-ui-server-fips version 2.44.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...

CVE-2026-47429

Vitest (a Vite-based testing framework) is affected by CVE-2026-47429 due to an incorrect isFileServingAllowed check in the Vitest UI/API server on Windows for the path /vitest_attachment . This allows a ?..\ path traversal to read files outside the project, and could enable arbitrary script exec...