CLEANSTART-2026-CK61704 Security fixes for CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.35.17-r0, 1.35.17-r1

Multiple security vulnerabilities affect the weaviate-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YP80658 Security fixes for CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.35.17-r0, 1.36.11-r0

Multiple security vulnerabilities affect the weaviate-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RD75979 Security fixes for CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, ghsa-xmrv-pmrh-hhx2 applied in versions: 1.35.17-r0, 1.37.0-r0

Multiple security vulnerabilities affect the weaviate-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

Improper Neutralization of Special Elements in Data Query Logic

Overview org.springframework.ai:spring-ai-weaviate-store is a Building AI applications with Spring Boot Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the FilterExpressionConverter implementations. An attacker can alter...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, jfrog-cli, kubescape, seaweedfs, backup-restore-operator-fips, docker-cli-buildx-fips, flux-source-controller, flux-source-watcher, kubescape-server, etcd-fips, azurefile-csi, kube-fluentd-operator, podman, external-secrets-operator-fips, nuclei...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips, jfrog-cli, kubescape, seaweedfs, backup-restore-operator-fips, docker-cli-buildx-fips, flux-source-controller, flux-source-watcher, kubescape-server, etcd-fips, azurefile-csi, kube-fluentd-operator, podman, external-secrets-operator-fips, nuclei...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, terraform-provider-sendgrid-fips, gitlab-rails-ce-fips, nrdot-collector-k8s, jfrog-cli, agentbeat-fips, grafana-pyroscope, kuberay-operator-fips, cis-operator, nats-top, rancher-pushprox, virt-controller-fips, argo-rollouts,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding-fips, agentbeat-fips, grafana-pyroscope, gogatekeeper, cloudflared, kubescape, seaweedfs, step, flux-source-controller, kubescape-server, gitlab-runner-fips, knative-kafka-broker-fips, kaniko, flux-kustomize-controller, gcsfuse, podman,...

CLEANSTART-2026-RR25843 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-6g7g-w4f8-9c9x, ghsa-9h8m-3fm2-qjrq, ghsa-j5w8-q4qc-rx2x, ghsa-p77j-4mvh-x3m3 applied in versions: 1.35.2-r0, 1.35.2-r1, 1.35.2-r2

Multiple security vulnerabilities affect the weaviate package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UO45926 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-68121, ghsa-j5w8-q4qc-rx2x applied in versions: 1.35.2-r0

Multiple security vulnerabilities affect the weaviate package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: grafana, k3s, tempo, k8sgpt, maru, datadog-agent, dgraph, malcontent, gitlab-runner, minio, nuclei, opentelemetry-collector-contrib, terragrunt, redpanda, dagger, prometheus, opentelemetry-collector, loki, vcluster, nfpm, mcp-grafana, teleport, lazygit, weaviate,...

Path Traversal

github.com/weaviate/weaviate is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of the fileName field in the transfer logic, which allows an attacker who can invoke the GetFile method while a shard is in the “Pause file activity” state and the...

EUVD-2026-3717

Malicious code in weaviate-js npm...

Malicious code in weaviate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229f83d7066881287b7035e8e71dc5ed74531480ab19cbf47ebd72990bc1525 The package weaviate-js was found to contain malicious code. Source: ghsa-malware bb063c82675f5933564b46d7e49a2c2a7aac395d9a399b1264e3de0aafb29905 An...

MAL-2026-434 Malicious code in weaviate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c229f83d7066881287b7035e8e71dc5ed74531480ab19cbf47ebd72990bc1525 The package weaviate-js was found to contain malicious code. Source: ghsa-malware bb063c82675f5933564b46d7e49a2c2a7aac395d9a399b1264e3de0aafb29905 An...

Malicious Package

Overview weaviate-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

SUSE CVE-2025-67818

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path e.g., /etc/... or use parent directory traversal ../../.. to escape the restore root when a backup is restored, potentially creating or...

SUSE CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...

CVE-2025-67818

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path e.g., /etc/... or use parent directory traversal ../../.. to escape the restore root when a backup is restored, potentially creating or...

CVE-2025-67819

An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files...