Open Source Vulnerabilities

gradle, spark-sc213-jdk17-py312, apache-hive, apache-hive, apache-hive, keycloak

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator

gradle, spark-sc213-jdk17-py312, apache-hive, apache-hive, apache-hive, activemq, keycloak

jackson-databind binds a JSON string to a javax

kubernetes-dns-node-cache, traefik

quic-go is an implementation of the QUIC protocol in Go

traefik

Let's Encrypt client and ACME library written in Go (Lego)

kubernetes-dns-node-cache, traefik

Security fix for GHSA-vvgj-x9jq-8cj9 applied in: kubernetes-dns-node-cache 1.26.8-r4, traefik 3.6.11-r1

wazuh-dashboard-alerting-dashboards-plugin-fips

wazuh-dashboard-alerting-dashboards-plugin-fips

traefik

Security fix for GHSA-qqx8-2xmm-jrv8 applied in: traefik 3.6.11-r1

keycloak

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

keycloak

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

keycloak

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases

keycloak

In Eclipse Vert

keycloak

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform

keycloak

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) condition due to an unbounded memory leak

keycloak

Netty (io

keycloak

Netty (io

spark-sc213-jdk17-py312, elasticsearch, elasticsearch, keycloak

Netty is an asynchronous, event-driven network application framework

spark-sc213-jdk17-py312, elasticsearch, elasticsearch, keycloak

Netty is an asynchronous, event-driven network application framework

rclone, loki, loki, loki, loki, etcd, grafana-rollout-operator, cluster-autoscaler-fips, knative-serving, knative-serving, rclone, rclone, rclone, haproxy-ingress, velero, yunikorn-k8shim, prometheus-alertmanager, temporal-server, temporal-server, cert-manager-cmctl-fips, flux-image-automation-controller, flux-image-automation-controller, kubernetes-event-exporter, cluster-autoscaler, cluster-autoscaler, etcd, thanos, etcd, traefik

OpenTelemetry-Go is the Go implementation of OpenTelemetry

etcd, prometheus, prometheus, velero, amazon-cloudwatch-agent, etcd, etcd

Security fix for GHSA-w67g-5rqw-f597 applied in: etcd 3.5.29-r0, prometheus 3.5.3-r11, prometheus 3.5.3-r12, velero 1.16.2-r15, amazon-cloudwatch-agent 1.300073.0-r0, etcd 3.5.33-r1, etcd 3.5.33-r3

keda, traefik

Security fix for GO-2026-4950 applied in: keda 2.20.2-r0, traefik 3.6.25-r1

dex, opentelemetry-collector-contrib, keda, velero, prometheus-alertmanager, opentofu, dex, wave, cluster-autoscaler, cluster-autoscaler, cluster-autoscaler, cluster-autoscaler, cluster-autoscaler, cluster-autoscaler, cluster-autoscaler, traefik

malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

sccache, sccache

wazuh-dashboard-security-plugin

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, sonarqube, sonarqube, apache-nifi, kafka, trino, trino, trino

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, sonarqube, apache-nifi, kafka, trino, trino, trino

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

spark-sc213-jdk17-py312, spark-sc213-jdk17-py312, sonarqube, apache-nifi, kafka, trino, trino, trino

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

sonarqube, gradle, spark-sc213-jdk17-py312, sonarqube, wildfly, wildfly, apache-hive, apache-nifi, kafka, elasticsearch, elasticsearch, keycloak, gradle, wso2is, wso2is, kafka, solr, wso2is, wso2is, trino, trino, trino

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

sonarqube, apache-zookeeper, gradle, sonarqube, wildfly, wildfly, apache-hive, apache-nifi, kafka, elasticsearch, elasticsearch, keycloak, wso2is, wso2is, kafka, wso2is, wso2is, trino, apache-zookeeper, trino, trino

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

sonarqube, apache-zookeeper, gradle, sonarqube, wildfly, wildfly, apache-hive, apache-nifi, kafka, elasticsearch, elasticsearch, keycloak, wso2is, wso2is, kafka, wso2is, wso2is, trino, apache-zookeeper, trino, trino

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)

dynatrace-operator, dynatrace-operator

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default

dynatrace-operator, dynatrace-operator

Security fix for GHSA-p436-gjf2-799p applied in: dynatrace-operator 1.7.3-r1

rabbitmq-cluster-operator, velero, velero, argo-cd-fips, dynatrace-operator, dynatrace-operator, rancher-fleet-agent, dynatrace-operator, dynatrace-operator

spdystream is a Go library for multiplexing streams over SPDY connections

rabbitmq-cluster-operator, velero, argo-cd-fips, dynatrace-operator, dynatrace-operator

Security fix for GHSA-pc3f-x583-g7j2 applied in: rabbitmq-cluster-operator 2.19.2-r1, velero 1.16.2-r4, argo-cd-fips 3.3.7-r0, dynatrace-operator 1.7.3-r1

wazuh-dashboard-index-management-dashboards-plugin

nextcloud-server-35

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)

wazuh-dashboard-dashboards-notifications

sonarqube, gradle, spark-sc213-jdk17-py312, sonarqube, apache-hive, apache-nifi, kafka, elasticsearch, elasticsearch, keycloak, gradle, wso2is, wso2is, solr, wso2is, wso2is, trino, trino, trino

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

grafana, minio, minio, elastic-beats, thanos

Security fix for GHSA-vffh-x6r8-xx99 applied in: grafana 13.0.1-r0, minio 0.20250907.161309-r3, minio 0.20250907.161309-r5, elastic-beats 9.3.4-r0, thanos 0.41.0-r0

prometheus, prometheus

Security fix for GHSA-w67g-5rqw-3626 applied in: prometheus 3.5.3-r8, prometheus 3.5.3-r9

prometheus, prometheus

Security fix for GHSA-2464-8j7c-4mjw applied in: prometheus 3.5.3-r8, prometheus 3.5.3-r9

prometheus, prometheus, prometheus, prometheus

flaw was found in github

storybook

TuxCare security update for storybook (2 CVEs)

com.fasterxml.jackson.core:jackson-databind

TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)

loki, loki, loki, loki, grafana, grafana, minio, minio, keda, elastic-beats, elastic-beats, thanos

Prometheus is an open-source monitoring system and time series database

cluster-autoscaler-fips, weaviate-fips, eks-distro-kube-apiserver, eks-distro-kube-apiserver, kyverno, openbao, thanos

Security fix for GHSA-8wmf-6v46-5gfg applied in: cluster-autoscaler-fips 1.33.6-r2, weaviate-fips 1.38.19-r1, eks-distro-kube-apiserver 1.36.8-r1, kyverno 1.19.1-r1, openbao 2.6.3-r1, thanos 0.39.2-r7

verus, verus