Open Source Vulnerabilities

datadog-agent-7.85-serverless-init

datadog-agent-7.85-serverless-init

datadog-agent-7.85-serverless-init

Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery

datadog-agent-fips-7.85-serverless-init

datadog-agent-fips-7.85-serverless-init

datadog-agent-fips-7.85-serverless-init

SecureDrop: API session token reuse against the Journalist Interface web UI

prometheus

Security fix for GO-2026-5932 applied in: prometheus 3.9.1-r7

mapserver

Security update for mapserver

step-ca, step-ca, fulcio-fips, step-ca-fips, amazon-cloudwatch-agent, litestream, litestream, litestream, litestream, metrics-server-fips, syft, trillian-fips, distribution, ip-masq-agent, melange, litestream, litestream, consul-fips, consul-fips, crossplane-provider-sql-fips, crossplane-provider-sql-fips, falco-exporter, k8sgpt, k8sgpt-operator, postgres-operator, kumactl, node-problem-detector, kubernetes-dns-node-cache-fips, promxy, promxy, thanos-operator, thanos-operator-fips, cadvisor-fips, cadvisor-fips, consul-k8s-fips, grafana-agent-operator, kube-logging-operator, argo-events, postgres-operator, vault-k8s-fips, cert-manager-webhook-pdns-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, multus-cni-fips

Security fix for GHSA-5cv4-jp36-h3mw applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, fulcio-fips 1.8.7-r1, step-ca-fips 0.30.2-r1, amazon-cloudwatch-agent 1.300065.0-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r3, syft 1.43.0-r1, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, ip-masq-agent 2.12.0-r1, melange 0.55.0-r1, litestream 0.5.14-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, falco-exporter 0.8.7-r2, k8sgpt 0.1.8-r2, k8sgpt-operator 0.2.27-r1, postgres-operator 1.12.2-r1, kumactl 2.13.8-r1, node-problem-detector 1.35.2-r1, kubernetes-dns-node-cache-fips 1.25.0-r1, promxy 0.0.96-r2, promxy 0.0.96-r3, thanos-operator 0.3.7-r1, thanos-operator-fips 0.3.7-r1, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, grafana-agent-operator 0.44.3-r1, kube-logging-operator 6.4.0-r1, argo-events 1.6.3-r1, postgres-operator 1.13.0-r1, vault-k8s-fips 1.7.5-r1, cert-manager-webhook-pdns-fips 2.5.5-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, multus-cni-fips 4.3.0-r1

confluent-kafka, cassandra-reaper-fips, cassandra-reaper-fips, cassandra-reaper-fips, keycloak

Security fix for GHSA-72hv-8253-57qq applied in: confluent-kafka 8.2.0-r0, cassandra-reaper-fips 4.0.2-r2, cassandra-reaper-fips 3.8.0-r3, cassandra-reaper-fips 4.1.1-r1, keycloak 26.4.7-r3

keycloak

Security fix for GHSA-cc37-9q2j-3hfv applied in: keycloak 26.4.7-r3

keycloak

Security fix for GHSA-h2qv-fj59-j46j applied in: keycloak 26.4.7-r3

keycloak

Netty is a network application framework for development of protocol servers and clients

keycloak

Netty is a network application framework for development of protocol servers and clients

cassandra-reaper-fips, cassandra-reaper-fips, s3proxy, cassandra-reaper-fips, keycloak

Netty is a network application framework for development of protocol servers and clients

go-fips-1.25, multus-cni-fips

When using http

prometheus-fips, amazon-cloudwatch-agent, grafana-agent-operator, opentelemetry-collector-contrib, prometheus, prometheus

mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS

datadog-agent-7.85-serverless-init

datadog-agent-7.85-serverless-init

datadog-agent-7.85-serverless-init

amazon-cloudwatch-agent, grafana-agent-operator, prometheus

Security fix for GHSA-cp6g-7hqx-qxhp applied in: amazon-cloudwatch-agent 1.300065.0-r1, grafana-agent-operator 0.44.3-r1, prometheus 3.9.1-r6

rancher-fleet-agent, rancher-fleet-agent, kuberay-operator, kuberay-operator, atlantis-fips, kube-vip, kube-vip, kubernetes-csi-external-provisioner-fips, kuberay-operator, kuberay-operator, kuberay-operator, wave, opentelemetry-collector-contrib-fips, step-ca, step-ca, rancher-fleet-agent, rancher-fleet-agent, prometheus-fips, prometheus-fips, fulcio-fips, secrets-store-csi-driver-provider-gcp, fulcio-fips, coredns, fluent-operator-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, weaviate-fips, prometheus-pushgateway-fips, rancher-fleet-agent, step-ca-fips, tekton-pipelines-fips, temporal-server, ollama-fips, ollama-fips, litestream, litestream, metrics-server-fips, amazon-cloudwatch-agent, litestream, litestream, trillian-fips, grafana-operator, distribution, tempo-fips, litestream, litestream, consul-fips, consul-fips, crossplane-provider-sql-fips, crossplane-provider-sql-fips, k8sgpt, k8sgpt-operator, kumactl, node-problem-detector, promxy, kubernetes-dns-node-cache-fips, promxy, volume-modifier-for-k8s-fips, cadvisor-fips, cadvisor-fips, crossplane-provider-keycloak-fips, crossplane-provider-keycloak-fips, grafana-agent-operator, consul-k8s-fips, kube-logging-operator, vault-k8s-fips, distribution-fips, distribution-fips, kaniko, kaniko, prometheus-adapter, volume-modifier-for-k8s, yunikorn-k8shim-fips, multus-cni-fips

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

step-cli

Step CA is an online certificate authority for secure, automated certificate management for DevOps

step-cli

Step CA is an online certificate authority for secure, automated certificate management for DevOps

step-cli

Step CA is an online certificate authority for secure, automated certificate management for DevOps

step-cli

attacker can bypass authorization checks and force a Step CA ACME or SCEP provisioner to create certificates without completing certain protocol authorization checks

step-cli

Slack Nebula before 1

step-cli

Nebula is a scalable overlay networking tool

step-ca, step-ca, step-ca-fips, step-cli

Memory-safety vulnerability in github

step-ca, step-ca, step-ca-fips, step-cli

Memory-safety vulnerability in github

rancher-fleet-agent, rancher-fleet-agent, kuberay-operator, kuberay-operator, atlantis-fips, kubernetes-csi-external-provisioner-fips, kubernetes-csi-external-provisioner-fips, kuberay-operator, kuberay-operator, kuberay-operator, rancher-fleet-agent, step-ca, step-ca, rancher-fleet-agent, rancher-fleet-agent, fulcio-fips, coredns, rancher-fleet-agent, rancher-fleet-agent, step-ca-fips, litestream, litestream, metrics-server-fips, amazon-cloudwatch-agent, litestream, litestream, trillian-fips, grafana-operator, distribution, tempo-fips, litestream, litestream, consul-fips, consul-fips, crossplane-provider-sql-fips, crossplane-provider-sql-fips, falco-exporter, k8sgpt, k8sgpt-operator, kumactl, kube-logging-operator, node-problem-detector, promxy, kubernetes-dns-node-cache-fips, promxy, thanos-operator, thanos-operator-fips, kube-logging-operator, volume-modifier-for-k8s-fips, cadvisor-fips, cadvisor-fips, grafana-agent-operator, crossplane-provider-keycloak-fips, crossplane-provider-keycloak-fips, consul-k8s-fips, kube-logging-operator, smarter-device-manager-fips, vault-k8s-fips, distribution-fips, distribution-fips, kaniko, kaniko, prometheus-adapter, volume-modifier-for-k8s, yunikorn-k8shim-fips, multus-cni-fips

norm

boring-registry-fips, step-cli

golang-jwt is a Go implementation of JSON Web Tokens

fulcio-fips, fulcio-fips, step-cli

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

step-cli

Security fix for GHSA-vrw8-fxc6-2r93 applied in: step-cli 0.27.5-r0

rancher-fleet-agent, rancher-fleet-agent, newrelic-infrastructure-agent, lvm-driver, lvm-driver, rancher-fleet-agent, rancher-fleet-agent, rancher-fleet-agent, fulcio-fips, fluent-operator-fips, rancher-fleet-agent, rancher-fleet-agent, temporal-server, temporal-server, litestream, litestream, litestream, litestream, metrics-server-fips, trillian-fips, distribution, melange, tempo-fips, consul-fips, consul-fips, crossplane-provider-sql-fips, crossplane-provider-sql-fips, falco-exporter, k8sgpt-operator, kubernetes-csi-external-resizer-fips, promxy, promxy, cadvisor-fips, cadvisor-fips, consul-k8s-fips, distribution-fips, distribution-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, multus-cni-fips

Security fix for GHSA-hrxh-6v49-42gf applied in: rancher-fleet-agent 0.15.4-r1, rancher-fleet-agent 0.15.4-r2, newrelic-infrastructure-agent 1.78.1-r2, lvm-driver 1.10.0-r1, lvm-driver 1.10.0-r2, rancher-fleet-agent 0.12.17-r1, rancher-fleet-agent 0.12.17-r2, rancher-fleet-agent 0.13.13-r0, fulcio-fips 1.5.1-r1, fluent-operator-fips 3.10.0-r2, rancher-fleet-agent 0.14.8-r1, rancher-fleet-agent 0.14.8-r2, temporal-server 1.28.4-r1, temporal-server 1.29.7-r1, litestream 0.3.14-r2, litestream 0.3.14-r3, metrics-server-fips 0.8.1-r2, trillian-fips 1.7.3-r1, distribution 3.1.1-r1, melange 0.55.0-r1, tempo-fips 3.0.2-r1, consul-fips 2.0.1-r1, crossplane-provider-sql-fips 0.15.0-r2, crossplane-provider-sql-fips 0.15.0-r3, falco-exporter 0.8.7-r2, k8sgpt-operator 0.2.27-r1, kubernetes-csi-external-resizer-fips 2.2.1-r1, promxy 0.0.96-r3, promxy 0.0.96-r2, cadvisor-fips 0.60.3-r1, consul-k8s-fips 1.8.14-r1, distribution-fips 3.1.1-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, yunikorn-k8shim-fips 1.8.0-r2, multus-cni-fips 4.3.0-r1

datadog-agent-7.85

k8s-sidecar, k8s-sidecar

pyasn1 is a generic ASN

datadog-agent-7.85

k8s-sidecar, k8s-sidecar

pyasn1 is a generic ASN

datadog-agent-7.85

k8s-sidecar, k8s-sidecar

pyasn1 is a generic ASN

datadog-agent-7.85

datadog-agent-7.85

k8s-sidecar, k8s-sidecar

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels

datadog-agent-7.85

datadog-agent-7.85

datadog-agent-7.85

datadog-agent-7.85