Open Source Vulnerabilities

python3

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory

grafana, grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

grafana, grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

gatekeeper-fips, grafana, grafana, gatekeeper, minio, grafana, grafana, cloudflared

Security fix for GHSA-9h8m-3fm2-qjrq applied in: gatekeeper-fips 3.20.1-r1, grafana 12.2.6-r0, grafana 12.2.7-r0, gatekeeper 3.20.1-r1, minio 0.20251015.172955-r1, grafana 12.1.8-r0, grafana 12.1.9-r0, cloudflared 2025.11.1-r2

minio, grafana, grafana, grafana, grafana, grafana, grafana

Security fix for GHSA-6g7g-w4f8-9c9x applied in: minio 0.20251015.172955-r1, grafana 12.0.9-r1, grafana 12.1.6-r0, grafana 12.1.8-r1, grafana 12.2.4-r1, grafana 12.2.6-r1, grafana 12.3.4-r0

trivy

Security fix for GHSA-whqx-f9j3-ch6m applied in: trivy 0.67.2-r1

trivy

Security fix for GHSA-4qg8-fj49-pxjh applied in: trivy 0.67.2-r1

coredns-fips, step-cli, gatekeeper, gatekeeper-fips, trivy, newrelic-k8s-metadata-injection, nats-server-fips, kyverno-policy-reporter-ui-fips, nats-server-fips, grafana, nats-server-fips, grafana, grafana, grafana, grafana, grafana, grafana

Actions which insert URLs into the content attribute of HTML meta tags are not escaped

grafana, trivy, grafana, grafana, grafana

go-git is a highly extensible git implementation library written in pure Go

coredns-fips, step-cli, gatekeeper, gatekeeper-fips, trivy, newrelic-k8s-metadata-injection, nats-server-fips, kyverno-policy-reporter-ui-fips, nats-server-fips, grafana, nats-server-fips, grafana, grafana, grafana, grafana, grafana, grafana

On Unix platforms, when listing the contents of a directory using File

traefik, traefik, trivy

Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default

consul, coredns-fips, step-cli, trivy, gatekeeper, gatekeeper-fips, minio, gcp-compute-persistent-disk-csi-driver-fips, grafana, grafana, grafana, grafana, grafana, grafana, grafana, trivy, grafana

gRPC-Go is the Go language implementation of gRPC

coredns-fips, step-cli, gatekeeper, gatekeeper-fips, trivy, newrelic-k8s-metadata-injection, nats-server-fips, kyverno-policy-reporter-ui-fips, nats-server-fips, grafana, nats-server-fips, grafana, grafana, grafana, grafana, grafana, grafana

url

coredns-fips, grafana, grafana, grafana, grafana

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints

coredns-fips, grafana, grafana, grafana, grafana

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

unzip

Info-ZIP UnZip 6

unzip

Info-ZIP UnZip 6

unzip

heap-based buffer overflow exists in Info-Zip UnZip version <= 6

unzip

Buffer overflow in the zi_short function in zipinfo

unzip

Buffer overflow in the list_files function in list

unzip

unzip 6

unzip

Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6

unzip

Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6

unzip

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6

unzip

Info-ZIP UnZip 6

unzip

Info-ZIP UnZip 6

falcosidekick, falcosidekick-fips

Security fix for GHSA-v23v-6jw2-98fq applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0

unzip

flaw was found in Unzip

unzip

flaw was found in Unzip

unzip

flaw was found in unzip

grafana, grafana, grafana, grafana-fips, grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

falcosidekick, falcosidekick-fips, trivy

Security fix for GHSA-cgrx-mc8f-2prm applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, trivy 0.67.2-r0

py3-werkzeug

Werkzeug is a Web Server Gateway Interface web application library

py3-werkzeug

Werkzeug is a comprehensive WSGI web application library

falcosidekick, falcosidekick-fips, trivy

Security fix for GHSA-pwhc-rpq9-4c8w applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, trivy 0.67.2-r0

py3-werkzeug

Improper parsing of HTTP requests in Pallets Werkzeug v2

grafana, grafana, grafana, grafana, grafana, grafana-fips, grafana, grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

falcosidekick, falcosidekick-fips

Security fix for GHSA-265r-hfxg-fhmg applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0

falcosidekick, falcosidekick-fips, trivy

Security fix for GHSA-m6hq-p25p-ffr2 applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, trivy 0.67.2-r0

falcosidekick, falcosidekick-fips

Security fix for GHSA-x84c-p2g9-rqv9 applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0

step-cli, nats-server-config-reloader-fips, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-config-reloader-fips, nats-server-fips, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-config-reloader-fips, nats-server-config-reloader-fips, nats-server-fips, grafana, nats-server-config-reloader-fips, grafana, grafana, kyverno-policy-reporter-ui-fips

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

falcoctl-fips, falcosidekick, falcosidekick-fips

Security fix for GHSA-4vq8-7jfc-9cvp applied in: falcoctl-fips 0.11.0-r0, falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0

coredns-fips, step-cli, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-config-reloader-fips, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, nats-server-config-reloader-fips, nats-server-config-reloader-fips, grafana, nats-server-config-reloader-fips, nats-server-fips, grafana, grafana, kyverno-policy-reporter-ui-fips, grafana

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

coredns-fips, step-cli, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, nats-server-config-reloader-fips, nats-server-config-reloader-fips, grafana, nats-server-fips, grafana, grafana, kyverno-policy-reporter-ui-fips, grafana

tar

opentofu, trivy, grafana, grafana, grafana-fips, grafana, grafana-fips, grafana-fips, grafana, grafana, loki, loki, grafana, grafana

Security fix for GHSA-xmrv-pmrh-hhx2 applied in: opentofu 1.11.13-r1, trivy 0.69.3-r1, grafana 12.2.8-r1, grafana 12.3.6-r0, grafana-fips 12.2.8-r0, grafana 12.1.10-r3, grafana-fips 12.3.6-r0, grafana-fips 13.0.0-r0, grafana 12.0.10-r2, grafana 12.1.7-r2, loki 3.6.10-r1, grafana 12.2.5-r1, grafana 12.4.2-r0

nats-server-fips, falcosidekick, falcosidekick-fips

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", "

traefik, opentofu, opentofu, opentofu, grafana, grafana, grafana, gatekeeper, gatekeeper-fips, grafana, grafana, grafana, grafana, grafana, grafana-fips, grafana, grafana-fips, loki, loki, grafana, grafana

OpenTelemetry-Go is the Go implementation of OpenTelemetry

falcosidekick, falcosidekick-fips

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information

step-cli, nats-server-config-reloader-fips, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-fips, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, grafana, grafana, grafana, kyverno-policy-reporter-ui-fips, grafana

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

grafana, trivy, grafana

go-git is an extensible git implementation library written in pure Go