A medium severity security vulnerability (CVE-2026-41178) affects the Kubernetes package related to OpenTelemetry-Go, the Go implementation of OpenTelemetry. The vulnerability impacts versions prior to 1.34.13-r2 and results in an availability impact without compromising confidentiality or integrity. A patch is available in version 1.34.13-r2.
A security vulnerability in Kubernetes allows a panic condition when parsing an invalid SVCB or HTTPS resource record (RR) if the size of a parameter value causes an overflow in the message buffer. This can lead to denial of service due to application crash.
A vulnerability in the Kubernetes package allowed a malicious GOPROXY to forge up to two sumdb tiles. This flaw enabled bypassing the GOSUMDB verification, allowing attacker-controlled module content to be persisted in the local Go module cache. The issue affects Kubernetes versions prior to 1.34.13-r2 and has been assigned CVE-2026-56865 with a high severity rating.
A security vulnerability in the Kubernetes package allows a malicious GOSUMDB to serve arbitrary module content that is not recorded in the transparency log. This flaw affects Kubernetes versions prior to 1.34.13-r2. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating network exploitable impact with no privileges or user interaction required. A fix is available in version 1.34.13-r2.
A high-severity security vulnerability (CVE-2025-52881) affects the Kubernetes package via the runc CLI tool, which is used for spawning and running containers according to the OCI specification. The vulnerability impacts versions of Kubernetes prior to 1.34.13-r2. A fix is available in version 1.34.13-r2.
A security vulnerability identified as CVE-2026-84303 affects the Kubernetes package through its use of gRPC-Go, the Go language implementation of gRPC. The vulnerability impacts versions of Kubernetes prior to 1.34.13-r2. A fix has been released in version 1.34.13-r2. The CVSS 4.0 base score is 6.3, indicating a medium severity level.
A high-severity security vulnerability (CVE-2026-84445) affects the Kubernetes package due to an issue in gRPC-Go, the Go language implementation of gRPC. The vulnerability impacts versions of Kubernetes prior to 1.34.13-r2. A fix is available in version 1.34.13-r2.
A high-severity security vulnerability (CVE-2026-84304) affects the Kubernetes package through its use of gRPC-Go, the Go language implementation of gRPC. The vulnerability impacts versions of Kubernetes prior to 1.34.13-r2. A fix is available in version 1.34.13-r2.
A security vulnerability in the wso2am package affects Apache CXF’s OIDC relying-party component, which could redirect users to an attacker-controlled URL after successful authentication. This flaw is present in versions prior to 4.7.0-r5 and has a medium severity rating with a CVSS score of 6.1. The issue has been fixed in version 4.7.0-r5.
A security vulnerability in the wso2am package involves StaxUtils placing no limit on the total number of elements or characters in an XML document by default. This can lead to denial of service conditions due to resource exhaustion. The issue affects versions prior to 4.7.0-r5 and has a high severity rating. A patch is available in version 4.7.0-r5 to address this vulnerability.
A security vulnerability in the wso2am package involves Apache CXF's STSTokenValidator, which checks if a SAML assertion is signed by a trusted certificate before sending it to the Security Token Service (STS). Versions prior to 4.7.0-r5 are affected. The vulnerability has a high severity score and can cause denial of service (availability impact). A fix is available in version 4.7.0-r5.
A security vulnerability exists in the wso2am package due to a flaw in Apache CXF's FIQL query parser. The vulnerability relates to how the parser searches for operators in query expressions, potentially causing denial of service. Versions prior to 4.7.0-r5 are affected. A fix is available in version 4.7.0-r5.
A high-severity vulnerability exists in the wso2am package due to improper verification of cryptographic signatures in Apache CXF's JAX-RS XML Security module. This flaw affects versions prior to 4.7.0-r5 and could allow an attacker to compromise the integrity of signed data. The vulnerability has been fixed in version 4.7.0-r5.
A security vulnerability in the wso2am package affects versions prior to 4.7.0-r5. The flaw involves improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider, allowing a remote attacker to obtain multiple valid access tokens from a single authorization code through concurrent token exchange requests. This vulnerability has a high severity rating with a CVSS score of 8.1. A fix is available in version 4.7.0-r5.
A security vulnerability in the wso2am package involves Apache CXF's parser for multipart/MTOM attachment part headers not fully enforcing configured limits on header size and count. This flaw affects versions prior to 4.7.0-r5. The vulnerability has a high severity score and could impact availability. A fix is available in version 4.7.0-r5.
A high-severity security vulnerability (CVE-2026-78384) affects the wso2am package in versions prior to 4.7.0-r5. The issue involves the CompressionUtils component and has a CVSS 3.1 score of 7.5, indicating network attack vector with low complexity and no privileges or user interaction required. Confidentiality impact is high, but integrity and availability are not affected. A patch is available in version 4.7.0-r5.
A critical security vulnerability in wso2am versions prior to 4.7.0-r5 allows bypass of the max_age authentication-freshness check in the OidcClientCodeRequestFilter due to a timing unit mismatch and incorrect comparison logic. This flaw could enable attackers to circumvent authentication freshness validation, potentially leading to unauthorized access. The issue is fixed in version 4.7.0-r5.
A critical security vulnerability exists in the wso2am package due to Apache CXF's Netty-based HTTP client transport not verifying that the hostname in the server's TLS certificate matches the host being called. This flaw affects versions prior to 4.7.0-r5 and can lead to high-impact confidentiality and integrity breaches. The issue has been fixed in version 4.7.0-r5.
A critical security vulnerability in the wso2am package involves Apache CXF's STSTokenValidator and Security Token Service (STS) caching validated security tokens using a non-cryptographic 32-bit hash of the token. This flaw affects versions prior to 4.7.0-r5 and could allow attackers to compromise token validation integrity. The vulnerability has a CVSS score of 9.1, indicating high severity with network attack vector and no required privileges or user interaction. A fix is available in version 4.7.0-r5.
A high-severity vulnerability (CVE-2026-114151) exists in Microsoft.DiaSymReader.Native versions prior to 18.9.1-beta1.26515.1 used by certain .NET runtimes on Windows. The flaw involves an out-of-bounds stack write triggered by a crafted PDB LF_DECIMAL payload processed through ISymUnmanagedConstant.GetValue. This affects .NET runtime versions 8.0.0 up to but not including 8.0.34, 9.0.0 up to 9.0.23, 10.0.0 up to 10.0.15, and 11.0.0-preview.1 up to 11.0.0 on Windows x86, x64, and Arm64 architectures. The native stack-trace reading path in .NET does not invoke the vulnerable method, so not all .NET usage is affected. Patches are available in the specified fixed versions.