Open Source Vulnerabilities

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, consul, gatekeeper, gatekeeper-fips, grafana, grafana, grafana, grafana

RSA and DSA public key parsers did not enforce size limits on key parameters

qemu

Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6

opentofu, grafana, grafana, grafana, minio, grafana-fips, grafana, grafana

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP

qemu

heap buffer overflow was found in the floppy disk emulator of QEMU up to 6

qemu

NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6

qemu

NULL pointer dereference issue was found in the ACPI code of QEMU

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, consul, gatekeeper, gatekeeper-fips, grafana, grafana, grafana, grafana

When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...

qemu

integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format

qemu

DMA reentrancy issue was found in the Tulip device emulation in QEMU

step-cli, grafana, grafana, grafana, grafana-fips, grafana, grafana

Security fix for GHSA-j88v-2chj-qfwx applied in: step-cli 0.28.7-r3, grafana 12.4.3-r1, grafana 12.2.8-r3, grafana 12.3.6-r2, grafana-fips 12.2.8-r1, grafana 12.1.10-r3, grafana 13.0.0-r1

qemu

vulnerability in the lsi53c895a device affects the latest version of qemu

consul, consul, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, victoria-metrics, victoria-metrics, grafana, consul, grafana, grafana, grafana, consul, gatekeeper, gatekeeper-fips, grafana, grafana

authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

qemu

flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU

grafana, grafana, grafana, grafana, minio, grafana, grafana

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

openstack-keystone-2026.2-fips

openstack-keystone-2026.2-fips

openstack-keystone-2026.2-fips

openstack-keystone-2026.2-fips

configurable-http-proxy

grafana, grafana

Security fix for GHSA-ffqx-q65f-36jf applied in: grafana 12.3.7-r0, grafana 13.0.0-r1

datadog-agent-fips-7.83-core-integrations

grafana, grafana

Security fix for GHSA-p4r4-xvrq-gvmc applied in: grafana 12.3.7-r0, grafana 13.0.0-r1

grafana, grafana, grafana, grafana

Security fix for GHSA-57j5-qwp2-vqp6 applied in: grafana 12.4.3-r1, grafana 12.2.8-r3, grafana 12.3.6-r2, grafana 13.0.0-r1

grafana, grafana, grafana, minio, grafana

Security fix for GHSA-pjcq-xvwq-hhpj applied in: grafana 12.4.3-r1, grafana 12.2.8-r3, grafana 12.3.6-r2, minio 0.20251015.172955-r2, grafana 13.0.0-r1

grafana, grafana, grafana, grafana, minio, grafana, grafana

Security fix for GHSA-wf45-q9ch-q8gh applied in: grafana 12.4.3-r1, grafana 13.0.1-r1, grafana 12.2.8-r3, grafana 12.3.6-r2, minio 0.20251015.172955-r2, grafana 12.1.10-r4, grafana 13.0.0-r1

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

debezium-3.7-connector-jdbc, debezium-3.7-connector-jdbc

consul, consul, consul, step-cli, step-cli, etcd, cosign-fips, cosign-fips, cosign-fips, cosign-fips, kyverno-policy-reporter-ui-fips, opentofu, coredns-fips, cosign-fips, nats-server-config-reloader-fips, prometheus-alertmanager-fips, traefik, nodetaint, trivy, consul, grafana, grafana, etcd, gatekeeper-fips, minio, gatekeeper, grafana, grafana

ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

openstack-ironic-2026.1

openstack-ironic-2026.1

openstack-ironic-2026.1

openstack-ironic-2026.1

consul, consul-k8s, consul, opentofu, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, consul, grafana, grafana, etcd, gatekeeper-fips, gatekeeper, grafana, grafana

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper s...

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

infinite recursion is triggered in Jettison when constructing a JSONArray from a Collection that contains a self-reference in one of its elements

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Jettison before v1

consul, consul, step-cli, opentofu, prometheus-alertmanager-fips, traefik, nodetaint, consul, grafana, grafana, gatekeeper, gatekeeper-fips, grafana, grafana

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

stack overflow in Jettison before v1

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-xw5c-jc7x-gf75 applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2

consul, consul, step-cli, opentofu, prometheus-alertmanager-fips, traefik, nodetaint, consul, grafana, grafana, etcd, gatekeeper-fips, minio, gatekeeper, grafana, grafana

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-wg6q-6289-32hp applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-h383-gmxw-35v2 applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2

consul, consul, step-cli, opentofu, prometheus-alertmanager-fips, traefik, nodetaint, consul, grafana, grafana, etcd, gatekeeper, gatekeeper-fips, grafana, grafana

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-cmxv-58fp-fm3g applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-c3fc-8qff-9hwx applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2

consul, consul, opentofu, step-cli, prometheus-alertmanager-fips, traefik, nodetaint, consul, grafana, grafana, gatekeeper, gatekeeper-fips, minio, grafana, grafana

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

druid-fips, druid-fips, druid-fips, druid-fips, druid-fips

Security fix for GHSA-6hg6-v5c8-fphq applied in: druid-fips 34.0.0-r2, druid-fips 35.0.1-r2, druid-fips 36.0.0-r1, druid-fips 32.0.1-r2, druid-fips 33.0.0-r2