GO-2026-6090 vulnerabilities

Vulnerabilities for packages: gatekeeper, buf, yunikorn-web, ctop, amazon-cloudwatch-agent-operator, nri-mssql, github-mcp-server, kubernetes, syft, tetragon, newrelic-fluent-bit-output, grype, azure-workload-identity-webhook, thanos-operator, flux-kustomize-controller, grafana-operator, kine,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: gatekeeper, buf, yunikorn-web, ctop, amazon-cloudwatch-agent-operator, nri-mssql, github-mcp-server, kubernetes, syft, tetragon, newrelic-fluent-bit-output, grype, azure-workload-identity-webhook, thanos-operator, flux-kustomize-controller, grafana-operator, kine,...

CVE-2026-56860 vulnerabilities

Vulnerabilities for packages: gatekeeper, buf, ctop, amazon-cloudwatch-agent-operator, nri-mssql, github-mcp-server, kubernetes, syft, tetragon, newrelic-fluent-bit-output, grype, azure-workload-identity-webhook, thanos-operator, flux-kustomize-controller, grafana-operator, kine,...

GO-2026-6218 vulnerabilities

Vulnerabilities for packages: gatekeeper, buf, ctop, amazon-cloudwatch-agent-operator, nri-mssql, github-mcp-server, kubernetes, syft, tetragon, newrelic-fluent-bit-output, grype, azure-workload-identity-webhook, thanos-operator, flux-kustomize-controller, grafana-operator, kine,...

CVE-2026-45774

A flaw was found in compliance-trestle. The library's profile import mechanism, which handles trestle:// URIs and relative file paths, does not properly validate paths. This allows a remote attacker to craft a malicious OSCAL Open Security Controls Assessment Language profile YAML file containing...

CVE-2026-73643

A flaw was found in js-yaml, a JavaScript YAML parser. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections. This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU...

GHSA-5GJX-96WQ-C8R2 vulnerabilities

Vulnerabilities for packages: helm...

GO-2026-4603 vulnerabilities

Vulnerabilities for packages: langfuse-fips, flux-helm-controller, helm-exporter, crossplane-provider-aws-sqs-fips, request-1279, tetragon, azcopy-fips, k8ssandra-client-fips, sftpgo-plugin-geoipfilter, secrets-store-csi-driver-fips, neuvector-sigstore-interface, terraform-provider-pagerduty-fips...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: nerdctl, flux-helm-controller, azcopy-fips, k8ssandra-client-fips, velero-plugin-for-microsoft-azure-fips, secrets-store-csi-driver-fips, neuvector-sigstore-interface, haproxy-ingress, harbor-fips, caddy-fips, amazon-cloudwatch-agent-operator-fips, minio-operator-fip...

GO-2023-1849 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: osv-scanner, crossplane, k8sgpt, kubescape, k9s, goreleaser, wolfictl, scorecard, nuclei, guac, pulumi-language-yaml, melange, pulumi-language-java, zot, trivy, argo-events, gitsign, syft, chezmoi, dagger, grype, pulumi-kubernetes-operator, src-fingerprint,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: osv-scanner, crossplane, k8sgpt, kubescape, k9s, goreleaser, wolfictl, scorecard, nuclei, guac, pulumi-language-yaml, melange, pulumi-language-java, zot, trivy, argo-events, gitsign, syft, chezmoi, dagger, grype, pulumi-kubernetes-operator, src-fingerprint,...

GO-2026-4910 vulnerabilities

Vulnerabilities for packages: osv-scanner, crossplane, gomplate, trivy-operator, rancher-fleet, teleport, kubescape, k9s, wolfictl, scorecard, trufflehog, nuclei, guac, pulumi-language-yaml, cerbos, melange, pulumi-language-java, zot, trivy, argo-events, gitsign, syft, chezmoi, argo-cd, dagger,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: osv-scanner, kubernetes-dashboard, crossplane-provider-aws-memorydb, kubescape, crossplane-provider-aws-sqs, gatus, containerd, buildah, aactl, melange, pulumi-language-java, ksops, kubernetes, zot, act, flux-notification-controller, syft, buildkitd, hcloud, chezmoi,...

Linux Distros Unpatched Vulnerability : CVE-2026-73643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load o...

CVE-2026-73643

creationtimestamp| type| source ---|---|--- 2026-08-13 18:35:08+00:00| published-proof-of-concept| https://github.com/nodeca/js-yaml/security/advisories/GHSA-pm4m-ph32-ghv5...

CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

UBUNTU-CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

CVE-2026-73643

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...

CVE-2026-73643 js-yaml: Exponential parsing time in the flow collections leads to denial of service

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...