Open Source Vulnerabilities

thingsboard, thingsboard

Security fix for GHSA-mgp5-rv84-w37q applied in: thingsboard 4.3.1-r0

thingsboard, thingsboard

Security fix for GHSA-24j9-x2wg-9qv6 applied in: thingsboard 4.3.1-r0

kubernetes-csi-external-provisioner-fips, opentelemetry-collector-contrib-fips, prometheus-fips, prometheus-fips, fulcio-fips, fulcio-fips, fluent-operator-fips, fulcio-fips, fulcio-fips, local-path-provisioner-fips, local-path-provisioner-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, prometheus-pushgateway-fips, weaviate-fips, tekton-pipelines-fips, temporal-server

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

thingsboard, thingsboard

Security fix for GHSA-8mc5-53m5-3qj2 applied in: thingsboard 4.3.1-r0

thingsboard, thingsboard

Security fix for GHSA-95jq-rwvf-vjx4 applied in: thingsboard 4.3.1-r0

thingsboard, thingsboard

Security fix for GHSA-w33c-445m-f8w7 applied in: thingsboard 4.3.1-r0

kubernetes-csi-external-provisioner-fips, opentelemetry-collector-contrib-fips, prometheus-fips, prometheus-fips, fulcio-fips, fulcio-fips, fulcio-fips, fulcio-fips, fulcio-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, fluent-operator-fips, weaviate-fips, local-path-provisioner-fips, local-path-provisioner-fips, prometheus-pushgateway-fips, tekton-pipelines-fips, temporal-server

Previously, resolving relative paths containing parent directory ('

thingsboard, thingsboard

race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be silently delivered to incorrect topics

thingsboard, thingsboard

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat

thingsboard, thingsboard

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token

kubernetes-csi-external-provisioner-fips, opentelemetry-collector-contrib-fips, prometheus-fips, prometheus-fips, fulcio-fips, fulcio-fips, fulcio-fips, fluent-operator-fips, fulcio-fips, fulcio-fips, local-path-provisioner-fips, local-path-provisioner-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, prometheus-pushgateway-fips, weaviate-fips, tekton-pipelines-fips, temporal-server

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

thingsboard, thingsboard

Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat

thingsboard, thingsboard

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614

cluster-autoscaler-1.37

cluster-autoscaler-1.37

cluster-autoscaler-1.37

cluster-autoscaler-1.37

cluster-autoscaler-1.37

thingsboard, thingsboard

Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration

thingsboard, thingsboard

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat, Apache Tomcat Native

kubernetes-csi-external-provisioner-fips, opentelemetry-collector-contrib-fips, prometheus-fips, prometheus-fips, fulcio-fips, fulcio-fips, fulcio-fips, fulcio-fips, fulcio-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, fluent-operator-fips, weaviate-fips, local-path-provisioner-fips, local-path-provisioner-fips, prometheus-pushgateway-fips, tekton-pipelines-fips, temporal-server

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

thingsboard, thingsboard

Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve

thingsboard, thingsboard

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat via invalid chunk extension

thingsboard, thingsboard

Improper Input Validation vulnerability in Apache Tomcat Native, Apache Tomcat

cluster-autoscaler-fips-1.37

kubernetes-csi-external-provisioner-fips, opentelemetry-collector-contrib-fips, prometheus-fips, prometheus-fips, fulcio-fips, fulcio-fips, fulcio-fips, fluent-operator-fips, fulcio-fips, fulcio-fips, local-path-provisioner-fips, local-path-provisioner-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, prometheus-pushgateway-fips, weaviate-fips, tekton-pipelines-fips, temporal-server

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

thingsboard, thingsboard

Use of Java scripting engine enabled (e

thingsboard, thingsboard

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE)

thingsboard, thingsboard

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc

thingsboard, thingsboard

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc

thingsboard, thingsboard

Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc

thingsboard, thingsboard

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer

kubernetes-csi-external-provisioner-fips, opentelemetry-collector-contrib-fips, prometheus-fips, prometheus-fips, fulcio-fips, fulcio-fips, fulcio-fips, fulcio-fips, fulcio-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib-fips, fluent-operator-fips, weaviate-fips, local-path-provisioner-fips, local-path-provisioner-fips, prometheus-pushgateway-fips, tekton-pipelines-fips, temporal-server

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

step-ca, step-ca, step-ca-fips

Security fix for GHSA-xgrm-4fwx-7qm8 applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, step-ca-fips 0.30.2-r1

libpython

Distrust compromised intermediate certificates in ssl module

rancher-fleet-agent, rancher-fleet-agent, rancher-fleet-agent, rancher-fleet-agent, rancher-fleet-agent

Helm is a package manager for Charts for Kubernetes

rancher-fleet-agent, rancher-fleet-agent, rancher-fleet-agent, rancher-fleet-agent, rancher-agent, rancher-agent, rancher-agent, rancher-fleet-agent, rancher-fleet-agent

oras-go is a Go library for managing OCI artifacts

step-ca, step-ca, step-ca-fips

Security fix for GHSA-9jj7-4m8r-rfcm applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, step-ca-fips 0.30.2-r1

libgit2

Updated libgit2 package fixes security vulnerabilities

ruby3.4-kube-logging-operator-fluentd-outputs, ruby3.4-kube-logging-operator-fluentd-outputs

ruby3.4-kube-logging-operator-fluentd-outputs, ruby3.4-kube-logging-operator-fluentd-outputs

nextcloud-server-32

nextcloud-server-32

apache-beam-python-3.11-sdk

apache-beam-python-3.11-sdk

apollo-router-2

apollo-router-2

py3.12-airflow-core-3

py3.12-airflow-core-3

datadog-agent-7.85-fakeintake