Open Source Vulnerabilities

coder-fips-2.29

crossplane-provider-aws-redshift-fips

crossplane-provider-aws-redshift-fips

kyverno-init-container-fips-1.19

kyverno-init-container-fips-1.19

coder-fips-2.32

coder-fips-2.32

skopeo, skopeo

skopeo, skopeo

kube-conformance-1.34

kube-conformance-1.34

crossplane-provider-aws-signer

crossplane-provider-aws-signer

crossplane-aws-glacier-fips

crossplane-aws-glacier-fips

grpcurl-fips

grpcurl-fips

crossplane-provider-aws-appstream

crossplane-provider-aws-appstream

grpcurl-fips

grpcurl-fips

crossplane-provider-aws-servicediscovery-fips

crossplane-provider-aws-servicediscovery-fips

crossplane-provider-aws-mwaa-fips

crossplane-provider-aws-mwaa-fips

crossplane-provider-aws-macie2-fips

crossplane-provider-aws-macie2-fips

crossplane-2.1, crossplane-2.1

crossplane-2.1, crossplane-2.1

github.com/semaphoreui/semaphore

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

backup-restore-operator-8.1

backup-restore-operator-8.1

github.com/semaphoreui/semaphore

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

crossplane-provider-aws-chime-fips

crossplane-provider-aws-chime-fips

crossplane-2.1, crossplane-2.1

crossplane-2.1, crossplane-2.1

envoy-gateway-fips-1.6-egctl

envoy-gateway-fips-1.6-egctl

crossplane-provider-aws-appconfig

crossplane-provider-aws-appconfig

orval

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

ruby-zip, ruby-zip, ruby-zip

python-tensorboard

CVE-2026-85393 affecting package python-tensorboard 2.16.2-6

rubygem-rubyzip

CVE-2026-85396 affecting package rubygem-rubyzip 2.3.2-1

c-ares, c-ares, c-ares, c-ares

c-ares, c-ares

fluent-bit

CVE-2026-33630 affecting package fluent-bit for versions less than 3.1.10-7

nodejs

CVE-2026-33630 affecting package nodejs 24.18.1-1