Open Source Vulnerabilities

trivy, grafana

Billy is an interface filesystem abstraction for Go

qemu

hw/usb/hcd-ohci

qemu

QEMU 5

qemu

QEMU 5

qemu

heap-based buffer overflow was found in QEMU through 5

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, trivy, grafana, etcd, grafana, grafana, grafana, minio, consul, gatekeeper, gatekeeper-fips, grafana, grafana

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

qemu

In QEMU through 5

qemu

hw/net/xgmac

wazuh-dashboard-dashboards-maps-fips

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, grafana, grafana, grafana, consul, gatekeeper, gatekeeper-fips, grafana, grafana

incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

wazuh-dashboard-dashboards-maps-fips

qemu

In QEMU 5

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, trivy, grafana, consul, grafana, etcd, grafana, grafana, minio, gatekeeper-fips, consul, gatekeeper, grafana, grafana

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

qemu

In QEMU 5

qemu

integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5

qemu

flaw was found in qemu

qemu

ide_atapi_cmd_reply_end in hw/ide/atapi

consul-k8s, consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, etcd, grafana, grafana, consul, gatekeeper-fips, minio, gatekeeper, grafana, grafana

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

qemu

flaw was found in the memory management API of QEMU during the initialization of a memory region cache

qemu

divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2

qemu

hw/ide/pci

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, grafana, grafana, consul, gatekeeper-fips, gatekeeper, grafana, grafana

For certain crafted inputs, a 'ed25519

qemu

pci_change_irq_level in hw/pci/pci

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, grafana, grafana, consul, gatekeeper, gatekeeper-fips, grafana, grafana

in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

qemu

reachable assertion issue was found in the USB EHCI emulation code of QEMU

qemu

issue was discovered in QEMU through 5

qemu

potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, grafana, grafana, consul, gatekeeper-fips, gatekeeper, grafana, grafana

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, grafana, grafana, consul, gatekeeper, gatekeeper-fips, grafana, grafana

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

qemu

patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-bounds read/write access issues previously found in the SDHCI controller emulation code

qemu

use-after-free flaw was found in the MegaRAID emulator of QEMU

qemu

stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU

consul, consul-k8s, consul, step-cli, nats-server-config-reloader, traefik, nodetaint, trivy, consul, grafana, gatekeeper, gatekeeper-fips, grafana

NewNTUnicodeString does not check for string length overflow

qemu

race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, grafana, grafana, consul, gatekeeper, gatekeeper-fips, grafana, grafana

Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh

qemu

flaw was found in the USB redirector device (usb-redir) of QEMU

grafana, grafana, grafana, grafana

OpenFGA is an authorization/permission engine built for developers

qemu

use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6

step-cli, grafana, grafana, grafana, grafana

pgx is a PostgreSQL driver and toolkit for Go

qemu

NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6

grafana, grafana

vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace ...

qemu

NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, grafana, grafana, consul, gatekeeper, gatekeeper-fips, grafana, grafana

malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

grafana, grafana

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy

qemu

flaw was found in the USB redirector device emulation of QEMU in versions prior to 6

grafana

CVE-2021-36156 fix validates the namespace parameter for path traversal sequences after a single URL decode, by double encoding, an attacker can read files at the Ruler API endpoint /loki/api/v1/ru...

qemu

out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6

authentik-2026.5

authentik-2026.5

qemu

information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6