CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: gitness, drone, harvester-fips, argo-cd-fips, steampipe, kgateway-fips, k8ssandra-client-fips, trivy-operator, eksctl, trivy, tigera-operator, crossplane, vcluster-fips, oras-fips, kubescape-operator, ratify-fips, envoy-gateway, tigera-operator-fips, k9s-fips, zarf,...

CVE-2026-50162 vulnerabilities

Vulnerabilities for packages: gitness, drone, argo-cd-fips, steampipe, kgateway-fips, k8ssandra-client-fips, trivy-operator, eksctl, trivy, tigera-operator, crossplane, vcluster-fips, oras-fips, kubescape-operator, ratify-fips, envoy-gateway, tigera-operator-fips, k9s-fips, zarf, consul-k8s,...

GHSA-8XWF-RJM4-XVHV vulnerabilities

Vulnerabilities for packages: gitness, drone, argo-cd-fips, steampipe, kgateway-fips, k8ssandra-client-fips, trivy-operator, eksctl, trivy, tigera-operator, crossplane, vcluster-fips, oras-fips, kubescape-operator, ratify-fips, envoy-gateway, tigera-operator-fips, k9s-fips, zarf, consul-k8s,...

GHSA-VH4V-2XQ2-G5CG vulnerabilities

Vulnerabilities for packages: gitness, drone, argo-cd-fips, steampipe, kgateway-fips, k8ssandra-client-fips, trivy-operator, eksctl, trivy, tigera-operator, crossplane, vcluster-fips, oras-fips, kubescape-operator, ratify-fips, envoy-gateway, tigera-operator-fips, k9s-fips, zarf, consul-k8s,...

GHSA-XF85-363P-868W vulnerabilities

Vulnerabilities for packages: gitness, drone, harvester-fips, argo-cd-fips, steampipe, kgateway-fips, k8ssandra-client-fips, trivy-operator, eksctl, trivy, tigera-operator, crossplane, vcluster-fips, oras-fips, kubescape-operator, ratify-fips, envoy-gateway, tigera-operator-fips, k9s-fips, zarf,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: gitness, drone, argo-cd-fips, steampipe, kgateway-fips, k8ssandra-client-fips, trivy-operator, eksctl, trivy, tigera-operator, crossplane, vcluster-fips, oras-fips, kubescape-operator, ratify-fips, envoy-gateway, tigera-operator-fips, k9s-fips, zarf, consul-k8s,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: gitness, drone, argo-cd-fips, steampipe, kgateway-fips, k8ssandra-client-fips, trivy-operator, eksctl, trivy, tigera-operator, crossplane, vcluster-fips, oras-fips, kubescape-operator, ratify-fips, envoy-gateway, tigera-operator-fips, k9s-fips, zarf, consul-k8s,...

CVE-2026-2303 vulnerabilities

Vulnerabilities for packages: monstache, promxy-fips, loki-fips, argo-cd-fips, opentelemetry-collector-contrib-fips, harbor-fips, google-cloud-otel-ops-collector, grafana-agent-operator, ory-kratos, external-secrets-operator, tetragon-fips, percona-backup-mongodb-fips, vcluster-fips,...

GHSA-CP6G-7HQX-QXHP vulnerabilities

Vulnerabilities for packages: monstache, promxy-fips, loki-fips, argo-cd-fips, opentelemetry-collector-contrib-fips, harbor-fips, google-cloud-otel-ops-collector, grafana-agent-operator, ory-kratos, external-secrets-operator, tetragon-fips, percona-backup-mongodb-fips, vcluster-fips,...

CVE-2026-42457

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

CVE-2026-42457

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

CVE-2026-42457

Affected software: vCluster Platform. Component/issue: Stored XSS via the name field of a templateRef (root cause: stored XSS in templateRef name). Impact: could lead to arbitrary script execution in the platform’s browser context and, in the worst case, privilege escalation by creating a new Glo...

CVE-2026-42457 vCluster Platform: Stored XSS can lead to privilege escalation

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

CVE-2026-42457 vCluster Platform: Stored XSS can lead to privilege escalation

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

vCluster Platform 跨站脚本漏洞

vCluster Platform is an open-source virtual cluster manager developed by vCluster. Versions prior to vCluster Platform 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-type cross-site scripting in the name field of the...

PT-2026-40945

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: kargo, kwok, rancher-agent, teleport, redis-operator, postgres-operator, kube-arangodb, headlamp, kubeflow-pipelines, envoy-gateway, k9s, kpt, infinispan-operator, k8sgpt-operator, trivy-operator, cri-tools, jitsucom-bulker, cluster-api, emissary,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: kargo, kwok, rancher-agent, teleport, redis-operator, postgres-operator, kube-arangodb, headlamp, kubeflow-pipelines, envoy-gateway, k9s, kpt, infinispan-operator, k8sgpt-operator, trivy-operator, cri-tools, jitsucom-bulker, cluster-api, emissary,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: dkron-fips, keda-fips, temporal, external-secrets-operator, gotrue-fips, gitlab-kas, crossplane, dagger, cosign-fips, livekit-server-fips, seaweedfs-rocksdb-fips, slsa-verifier, grpc-health-probe, commercial-chainloop-backend, ko-fips, packer-fips,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: mcp-grafana, teleport, grafana, ollama, minio, grafana-alloy, rclone, cri-tools, opentelemetry-collector-contrib, datadog-agent, eksctl, dagger, k3s, opentelemetry-collector, dgraph, goreleaser, lazygit, malcontent, terraform-mcp-server, k8sgpt, prometheus, kubevela,...