Open Source Vulnerabilities

sqlpad, renovate

Security fix for GHSA-v2v4-37r5-5v8g applied in: sqlpad 7.5.7-r2, renovate 43.123.8-r2

opensearch-dashboards-fips

Handlebars provides the power necessary to let users build semantic templates

wazero, prometheus-operator, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, volume-modifier-for-k8s-fips, argo-events, local-static-provisioner-fips, multus-cni-fips, prometheus, calico, cert-manager, prometheus-operator, karpenter, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, ollama-fips, ollama-fips, azuredisk-csi-fips, kubernetes, modelmesh-runtime-adapter, kubernetes, elastic-beats, prometheus-redis-exporter-fips

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

sqlpad, renovate

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

opensearch-dashboards-fips

Handlebars provides the power necessary to let users build semantic templates

opensearch-dashboards-fips

Handlebars provides the power necessary to let users build semantic templates

opensearch-dashboards-fips

Handlebars provides the power necessary to let users build semantic templates

opensearch-dashboards-fips

Handlebars provides the power necessary to let users build semantic templates

opensearch-dashboards-fips

Handlebars provides the power necessary to let users build semantic templates

opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-442j-39wm-28r2 applied in: opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-7rx3-28cr-v5wh applied in: opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-xjpj-3mr7-gcpf applied in: opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

argo-workflows, opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-2g4f-4pwh-qvx6 applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-23c5-xmqv-rm74 applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r1

argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-3ppc-4f35-3m26 applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r1

opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-xhpv-hc6g-r9c6 applied in: opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

argo-workflows, opensearch-dashboards-fips

Security fix for GHSA-7r86-cg39-jmmj applied in: argo-workflows 3.6.19-r5, opensearch-dashboards-fips 3.5.0-r1

opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-2qvq-rjwj-gvw9 applied in: opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-3mfm-83xf-c92r applied in: opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-9cx6-37pm-9jff applied in: opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

opensearch-dashboards-fips, opensearch-dashboards-fips

Security fix for GHSA-2w6w-674q-4c4q applied in: opensearch-dashboards-fips 3.5.0-r0, opensearch-dashboards-fips 3.5.0-r1

rancher-fleet-agent, postgres-operator, k8sgpt-operator, postgres-operator, k8ssandra-client-fips

spdystream is a Go library for multiplexing streams over SPDY connections

k8sgpt-operator, postgres-operator, postgres-operator, k8ssandra-client-fips

Security fix for GHSA-pc3f-x583-g7j2 applied in: k8sgpt-operator 0.2.27-r1, postgres-operator 1.12.2-r1, postgres-operator 1.13.0-r1, k8ssandra-client-fips 0.5.0-r9

cassandra-reaper-fips

Security fix for GHSA-c4qc-4q9p-m9q9 applied in: cassandra-reaper-fips 3.6.1-r1

node-problem-detector, keda-fips, trillian, elastic-beats, istio-fips

Prometheus is an open-source monitoring system and time series database

litestream, litestream, litestream, litestream, metrics-server-fips, kubernetes-dns-node-cache-fips, argo-events, local-static-provisioner-fips, grafana-alloy-fips, kubevela

Security fix for GHSA-f6x5-jh6r-wrfv applied in: litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, kubernetes-dns-node-cache-fips 1.25.0-r1, argo-events 1.6.3-r1, local-static-provisioner-fips 2.8.0-r0, grafana-alloy-fips 1.12.1-r0, kubevela 1.10.5-r0

apache-hive

Uncontrolled Resource Consumption vulnerability in Apache Commons IO

sonarqube

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial o...

sonarqube

In Jakarta Mail versions prior to 2

37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload

amazon-cloudwatch-agent, metrics-server-fips, metrics-server-fips, trillian-fips, node-problem-detector, keda-fips, trillian, elastic-beats, prometheus-operator

Prometheus is an open-source monitoring system and time series database

cassandra-reaper-fips, logstash-fips

Security fix for GHSA-j288-q9x7-2f5v applied in: cassandra-reaper-fips 3.8.0-r3, logstash-fips 9.0.8-r2

gostatsd

Kubernetes kube-apiserver in versions v1

gostatsd

Security fix for GHSA-8cfg-vx93-jvxw applied in: gostatsd 28.3.0-r0

gostatsd

Security fix for GHSA-33c5-9fx5-fvjm applied in: gostatsd 28.3.0-r0

k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, volume-modifier-for-k8s, gostatsd

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints

k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, volume-modifier-for-k8s, gostatsd

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

rancher-fleet-agent, rancher-fleet-agent, kuberay-operator, kuberay-operator, kubernetes-csi-external-provisioner-fips, kubernetes-csi-external-provisioner-fips, kuberay-operator, kuberay-operator, kuberay-operator, lvm-driver, wave, rancher-fleet-agent, rancher-fleet-agent, step-ca, step-ca, rancher-fleet-agent, fulcio-fips, secrets-store-csi-driver-provider-gcp, secrets-store-csi-driver-provider-gcp, timoni, fulcio-fips, prometheus-pushgateway, prometheus-pushgateway-fips, rancher-fleet-agent, rancher-fleet-agent, step-ca-fips, rabbitmq-cluster-operator, litestream, litestream, metrics-server-fips, syft, amazon-cloudwatch-agent, litestream, litestream, trillian-fips, distribution, ip-masq-agent, melange, consul-fips, consul-fips, crossplane-provider-sql-fips, crossplane-provider-sql-fips, falco-exporter, litestream, litestream, postgres-operator, k8sgpt, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, kumactl, kubernetes-dns-node-cache-fips, node-problem-detector, promxy, promxy, thanos-operator, thanos-operator-fips, cadvisor-fips, cadvisor-fips, consul-k8s-fips, grafana-agent-operator, kube-logging-operator, argo-events, local-static-provisioner-fips, postgres-operator, smarter-device-manager-fips, vault-k8s-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, multus-cni-fips, prometheus, calico, dynatrace-operator, dynatrace-operator, cert-manager, kubernetes-csi-livenessprobe-fips, kubernetes-csi-driver-nfs-fips, kubernetes, kubernetes, modelmesh-runtime-adapter, elastic-beats, mongodb, mongodb, mongodb, mongodb

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

neo4j-fips-2026.10

neo4j-fips-2026.10

neo4j-fips-2026.10

neo4j-fips-2026.10

rancher-fleet-agent, rancher-fleet-agent, kubernetes-csi-external-provisioner-fips, kubernetes-csi-external-provisioner-fips, lvm-driver, step-ca, rancher-fleet-agent, step-ca, rancher-fleet-agent, rancher-fleet-agent, secrets-store-csi-driver-provider-gcp, fulcio-fips, secrets-store-csi-driver-provider-gcp, fulcio-fips, prometheus-pushgateway-fips, rancher-fleet-agent, rancher-fleet-agent, litestream, litestream, metrics-server-fips, litestream, litestream, trillian-fips, amazon-cloudwatch-agent, distribution, litestream, litestream, consul-fips, consul-fips, postgres-operator, crossplane-provider-sql-fips, kubernetes-csi-external-snapshotter-fips, kumactl, node-problem-detector, kubernetes-dns-node-cache-fips, promxy, promxy, cadvisor-fips, cadvisor-fips, consul-k8s-fips, grafana-agent-operator, argo-events, local-static-provisioner-fips, postgres-operator, vault-k8s-fips, distribution-fips, distribution-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, prometheus, calico, cert-manager, dynatrace-operator, dynatrace-operator, kubernetes, kubernetes, modelmesh-runtime-adapter, elastic-beats, mongodb, mongodb, mongodb, mongodb

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

amazon-cloudwatch-agent, metrics-server-fips, node-problem-detector, keda-fips, trillian, elastic-beats

Security fix for GHSA-8rm2-7qqf-34qm applied in: amazon-cloudwatch-agent 1.300065.0-r1, metrics-server-fips 0.8.1-r2, node-problem-detector 1.35.2-r1, keda-fips 2.19.0-r1, trillian 1.7.3-r1, elastic-beats 8.19.14-r0

rancher-fleet-agent, rancher-fleet-agent, kubernetes-csi-external-provisioner-fips, kubernetes-csi-external-provisioner-fips, lvm-driver, step-ca, rancher-fleet-agent, rancher-fleet-agent, step-ca, rancher-fleet-agent, fulcio-fips, secrets-store-csi-driver-provider-gcp, secrets-store-csi-driver-provider-gcp, fulcio-fips, prometheus-pushgateway-fips, rancher-fleet-agent, rancher-fleet-agent, prometheus-mysqld-exporter, litestream, litestream, metrics-server-fips, litestream, litestream, trillian-fips, amazon-cloudwatch-agent, distribution, litestream, litestream, consul-fips, consul-fips, crossplane-provider-sql-fips, postgres-operator, kubernetes-csi-external-snapshotter-fips, kumactl, node-problem-detector, kubernetes-dns-node-cache-fips, promxy, promxy, cadvisor-fips, cadvisor-fips, consul-k8s-fips, grafana-agent-operator, argo-events, local-static-provisioner-fips, postgres-operator, vault-k8s-fips, distribution-fips, distribution-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, prometheus, calico, cert-manager, dynatrace-operator, dynatrace-operator, kubernetes, kubernetes, modelmesh-runtime-adapter, elastic-beats, mongodb, mongodb, mongodb, mongodb

For certain crafted inputs, a 'ed25519

mongodb, mongodb, mongodb, mongodb

MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which can cause a Denial of Service

mongodb, mongodb, mongodb, mongodb

skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring

rancher-fleet-agent, rancher-fleet-agent, kubernetes-csi-external-provisioner-fips, kubernetes-csi-external-provisioner-fips, lvm-driver, step-ca, rancher-fleet-agent, step-ca, rancher-fleet-agent, rancher-fleet-agent, secrets-store-csi-driver-provider-gcp, fulcio-fips, secrets-store-csi-driver-provider-gcp, fulcio-fips, prometheus-pushgateway-fips, rancher-fleet-agent, rancher-fleet-agent, litestream, litestream, metrics-server-fips, litestream, litestream, trillian-fips, amazon-cloudwatch-agent, distribution, litestream, litestream, postgres-operator, crossplane-provider-sql-fips, kubernetes-csi-external-snapshotter-fips, kumactl, node-problem-detector, kubernetes-dns-node-cache-fips, promxy, promxy, cadvisor-fips, cadvisor-fips, consul-k8s-fips, grafana-agent-operator, argo-events, postgres-operator, local-static-provisioner-fips, vault-k8s-fips, distribution-fips, distribution-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, prometheus, calico, cert-manager, dynatrace-operator, dynatrace-operator, kubernetes, kubernetes, modelmesh-runtime-adapter, elastic-beats, mongodb, mongodb, mongodb, mongodb

RSA and DSA public key parsers did not enforce size limits on key parameters

rancher-fleet-agent, rancher-fleet-agent, kuberay-operator, kuberay-operator, kubernetes-csi-external-provisioner-fips, kubernetes-csi-external-provisioner-fips, kuberay-operator, kuberay-operator, kuberay-operator, lvm-driver, wave, rancher-fleet-agent, step-ca, step-ca, rancher-fleet-agent, rancher-fleet-agent, fulcio-fips, secrets-store-csi-driver-provider-gcp, secrets-store-csi-driver-provider-gcp, timoni, fulcio-fips, prometheus-pushgateway, prometheus-pushgateway-fips, rancher-fleet-agent, rancher-fleet-agent, step-ca-fips, rabbitmq-cluster-operator, litestream, litestream, metrics-server-fips, syft, amazon-cloudwatch-agent, litestream, litestream, trillian-fips, distribution, ip-masq-agent, melange, consul-fips, consul-fips, crossplane-provider-sql-fips, falco-exporter, litestream, litestream, postgres-operator, crossplane-provider-sql-fips, k8sgpt, k8sgpt-operator, kubernetes-csi-external-snapshotter-fips, kumactl, node-problem-detector, promxy, kubernetes-dns-node-cache-fips, promxy, thanos-operator, thanos-operator-fips, cadvisor-fips, cadvisor-fips, consul-k8s-fips, grafana-agent-operator, kube-logging-operator, argo-events, local-static-provisioner-fips, postgres-operator, smarter-device-manager-fips, vault-k8s-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, multus-cni-fips, prometheus, calico, dynatrace-operator, dynatrace-operator, cert-manager, kubernetes-csi-livenessprobe-fips, ollama-fips, ollama-fips, kubernetes-csi-driver-nfs-fips, kubernetes, kubernetes, modelmesh-runtime-adapter, elastic-beats, mongodb, mongodb, mongodb, mongodb

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

rancher-fleet-agent, rancher-fleet-agent, kubernetes-csi-external-provisioner-fips, kubernetes-csi-external-provisioner-fips, lvm-driver, step-ca, rancher-fleet-agent, step-ca, rancher-fleet-agent, rancher-fleet-agent, fulcio-fips, secrets-store-csi-driver-provider-gcp, secrets-store-csi-driver-provider-gcp, fulcio-fips, prometheus-pushgateway-fips, rancher-fleet-agent, rancher-fleet-agent, litestream, litestream, metrics-server-fips, litestream, litestream, trillian-fips, amazon-cloudwatch-agent, distribution, litestream, litestream, consul-fips, consul-fips, crossplane-provider-sql-fips, postgres-operator, kubernetes-csi-external-snapshotter-fips, kumactl, kumactl, node-problem-detector, kubernetes-dns-node-cache-fips, promxy, promxy, cadvisor-fips, cadvisor-fips, consul-k8s-fips, grafana-agent-operator, argo-events, postgres-operator, local-static-provisioner-fips, vault-k8s-fips, distribution-fips, distribution-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, prometheus, calico, cert-manager, dynatrace-operator, dynatrace-operator, kubernetes, kubernetes, modelmesh-runtime-adapter, elastic-beats, mongodb, mongodb, mongodb, mongodb

malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop