CVE-2026-48978 vulnerabilities

Vulnerabilities for packages: crossplane, gogatekeeper, argocd-image-updater, envoy-gateway, falcoctl, headlamp, chartmuseum, gitlab-operator, ratify-fips, kyverno-notation-aws, xeol-fips, kargo, helm-exporter, trivy, ocm-kubernetes-controller-fips, cert-manager-cmctl, envoy-gateway-fips,...

CVE-2026-50151 vulnerabilities

Vulnerabilities for packages: crossplane, gogatekeeper, argocd-image-updater, envoy-gateway, falcoctl, headlamp, chartmuseum, gitlab-operator, ratify-fips, kyverno-notation-aws, xeol-fips, kargo, helm-exporter, trivy, ocm-kubernetes-controller-fips, cert-manager-cmctl, envoy-gateway-fips,...

GHSA-JXPM-75MH-9FP7 vulnerabilities

Vulnerabilities for packages: crossplane, gogatekeeper, argocd-image-updater, envoy-gateway, falcoctl, headlamp, chartmuseum, gitlab-operator, ratify-fips, kyverno-notation-aws, xeol-fips, kargo, helm-exporter, trivy, ocm-kubernetes-controller-fips, cert-manager-cmctl, envoy-gateway-fips,...

GHSA-CP6G-7HQX-QXHP vulnerabilities

Vulnerabilities for packages: grafana-mimir, tekton-chains, harbor, consul-fips, datadog-agent, ratify-fips, promxy, authentik-fips, google-cloud-otel-ops-collector, bento, external-secrets-operator-fips, cortex-fips, cilium, grafana-mimir-fips, grafana-agent-operator, percona-backup-mongodb, dap...

CVE-2026-2303 vulnerabilities

Vulnerabilities for packages: grafana-mimir, tekton-chains, harbor, consul-fips, datadog-agent, ratify-fips, promxy, authentik-fips, google-cloud-otel-ops-collector, bento, external-secrets-operator-fips, cortex-fips, cilium, grafana-mimir-fips, grafana-agent-operator, percona-backup-mongodb, dap...

CVE-2026-42457

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

CVE-2026-42457

Affected software: vCluster Platform. Component/issue: Stored XSS via the name field of a templateRef (root cause: stored XSS in templateRef name). Impact: could lead to arbitrary script execution in the platform’s browser context and, in the worst case, privilege escalation by creating a new Glo...

CVE-2026-42457

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

CVE-2026-42457

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

CVE-2026-42457 vCluster Platform: Stored XSS can lead to privilege escalation

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

CVE-2026-42457 vCluster Platform: Stored XSS can lead to privilege escalation

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

PT-2026-40945

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

vCluster Platform Cross-Site Script Vulnerabilities

vCluster Platform is an open-source virtual cluster manager developed by vCluster. Versions prior to vCluster Platform 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-type cross-site scripting in the name field of the...

CVE-2026-42457: Improper Neutralization of Input During Web Page Generation

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: kwok, postgres-operator, skaffold, k3s, velero, redis-operator, kubescape, docker-cli-buildx, k8sgpt, kots, kubernetes-dashboard-api, argo-rollouts, rancher, sonobuoy, k8sgpt-operator, rancher-agent, percona-server-mongodb-operator, gitlab-runner, envoy-gateway,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: kwok, postgres-operator, skaffold, k3s, velero, redis-operator, kubescape, docker-cli-buildx, k8sgpt, kots, kubernetes-dashboard-api, argo-rollouts, rancher, sonobuoy, k8sgpt-operator, rancher-agent, percona-server-mongodb-operator, gitlab-runner, envoy-gateway,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: grafana-mimir, harbor, datadog-agent, grpc-health-probe-fips, sqlexporter-fips, apko-fips, xeol-fips, opencost, rook-fips, trivy, seaweedfs-rocksdb-fips, kyverno-notation-aws-fips, podman, spire-controller-manager-fips, thanos-fips, podman-fips, velero-fips,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib, witness, grafana, dgraph, k3s, grafana-alloy, k8sgpt, rclone, terragrunt, terraform-mcp-server, dagger, weaviate, gitlab-runner, malcontent, redpanda, cri-tools, ollama, loki, datadog-agent, nuclei, vcluster, nfpm, eksctl, lazygit,...

CVE-2026-22806

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created with a limited scope, the scope can be bypassed to access resources outside of it. However, the user...

CVE-2026-22806

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created with a limited scope, the scope can be bypassed to access resources outside of it. However, the user...