Open Source Vulnerabilities

argo-events, kaniko, kaniko, argo-cd

go-git is an extensible git implementation library written in pure Go

argo-events, kaniko, kaniko, argo-cd

go-git is an extensible git implementation library written in pure Go

argo-events, kaniko, kaniko, argo-cd

go-git is an extensible git implementation library written in pure Go

argo-events, kaniko, kaniko, argo-cd

go-git is an extensible git implementation library written in pure Go

argo-events, kaniko, kaniko, argo-cd

Security fix for GHSA-m7cr-m3pv-hgrp applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

argo-events, kaniko, kaniko, argo-cd

Security fix for GHSA-crhj-59gh-8x96 applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

argo-events, kaniko, kaniko, argo-cd

Security fix for GHSA-gm2x-2g9h-ccm8 applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

argo-events, kaniko, kaniko, argo-cd

Security fix for GHSA-jhf3-xxhw-2wpp applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

argo-events, kaniko, kaniko, argo-cd

Security fix for GHSA-389r-gv7p-r3rp applied in: argo-events 1.6.3-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0

litestream, litestream, litestream, litestream, k8sgpt, kyverno-policy-reporter-kyverno-plugin

Security fix for GHSA-8r3f-844c-mc37 applied in: litestream 0.3.14-r2, litestream 0.3.14-r3, k8sgpt 0.1.8-r2, kyverno-policy-reporter-kyverno-plugin 1.5.2-r1

knative-operator-fips-1.24-webhook

knative-operator-fips-1.24-webhook

tkn-fips

Security fix for GHSA-mqqf-5wvp-8fh8 applied in: tkn-fips 0.43.0-r2

Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview

changelog.com before commit 7b35e829 Missing Authorization via Preview Routes

sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()

elasticsearch, elasticsearch

Apache Log4j Core's XmlLayout https://logging

elasticsearch, elasticsearch

Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1

elasticsearch, elasticsearch

Apache Log4j Core's Rfc5424Layout https://logging

elasticsearch, elasticsearch

fix for CVE-2025-68161 https://logging

elasticsearch, elasticsearch

Socket Appender in Apache Log4j Core versions 2

helm-fips, dynamic-localpv-provisioner, argo-workflows, fulcio-fips, amazon-cloudwatch-agent, litestream, litestream, litestream, litestream, metrics-server-fips, litestream, litestream, falco-exporter, k8sgpt-operator, kubernetes-dns-node-cache-fips, node-problem-detector, cert-manager-webhook-pdns-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, cert-manager

Security fix for GHSA-p77j-4mvh-x3m3 applied in: helm-fips 3.20.2-r0, dynamic-localpv-provisioner 4.5.0-r1, argo-workflows 3.6.19-r3, fulcio-fips 1.8.7-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, litestream 0.5.14-r1, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, node-problem-detector 1.35.2-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, cert-manager 1.19.4-r1

dynatrace-operator, dynatrace-operator

flaw was found in github

dynatrace-operator, dynatrace-operator

Security fix for GHSA-2464-8j7c-4cjm applied in: dynatrace-operator 1.6.3-r0

k8s-sidecar, k8s-sidecar

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed o...

yunikorn-k8shim-fips, cert-manager

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP

apache-nifi

Security fix for GHSA-f2wh-grmh-r6jm applied in: apache-nifi 2.6.0-r1

apache-nifi

Security fix for GHSA-8297-v2rf-2p32 applied in: apache-nifi 2.6.0-r1

apache-nifi

Security fix for GHSA-995c-6rp3-4m4x applied in: apache-nifi 2.6.0-r1

apache-nifi, apache-nifi

Security fix for GHSA-vf5j-865m-mq7c applied in: apache-nifi 2.6.0-r1, apache-nifi 2.6.0-r2

golang-github-gopacket-gopacket, golang-github-gopacket-gopacket, golang-github-gopacket-gopacket

telegraf

CVE-2026-119299 affecting package telegraf 1.31.0-36

apache-nifi

fix for CVE-2026-41635 was not applied to the 2

apache-nifi

fix for CVE-2026-41409 was not applied to the 2

python-keystonemiddleware, python-keystonemiddleware, python-keystonemiddleware

lxd, lxd

apache-nifi

Apache MINA's AbstractIoBuffer

apache-nifi

fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer

datadog-cluster-agent-fips-7.85

datadog-cluster-agent-fips-7.85

datadog-cluster-agent-fips-7.85

datadog-cluster-agent-fips-7.85

golang-github-gopacket-gopacket, golang-github-gopacket-gopacket, golang-github-gopacket-gopacket

python-keystonemiddleware, python-keystonemiddleware, python-keystonemiddleware, python-keystonemiddleware, python-keystonemiddleware, python-keystonemiddleware, python-keystonemiddleware

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments

FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute

37954679 cak-filemanagement-system save_student.php mysqli_query sql injection

coredns, coredns, velero-plugin-for-microsoft-azure-fips, amazon-cloudwatch-agent, grafana-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, crossplane-provider-keycloak-fips, crossplane-provider-keycloak-fips, argo-events, tigera-operator-fips, vault-k8s-fips, volume-modifier-for-k8s, cloudprober-fips, multus-cni-fips, calico

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

logstash-exporter-fips, atlantis-fips, coredns, coredns, velero-plugin-for-microsoft-azure-fips, amazon-cloudwatch-agent, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, crossplane-provider-keycloak-fips, crossplane-provider-keycloak-fips, argo-events, tigera-operator-fips, volume-modifier-for-k8s, cloudprober-fips, multus-cni-fips, calico

On Unix systems, opening a file in an os