Grafana versions 12.2.0 through before 12.2.5 and 12.3.0 through before 12.3.3 have a cross-site scripting (XSS) vulnerability in the Explore Traces view. This occurs because stack traces can be rendered as raw HTML, allowing malicious JavaScript injection if an attacker can insert JavaScript into the stack trace field. The issue affects only datasources using the Jaeger HTTP API; Jaeger gRPC and Tempo datasources are not affected. A patch is available in versions 12.2.5 and 12.3.3.
Gitea versions prior to 1.23.0-rc0 contain a vulnerability that allows attackers to add attachments with forbidden file extensions by manipulating attachment names through the attachment API. This flaw was fixed in version 1.23.0-rc0. The vulnerability has a high severity with a CVSS score of 8.2.
### Impact
`CiliumNetworkPolicy`s which use `egress.toGroups.aws.securityGroupsIds` to reference AWS security group IDs that do not exist or are not attached to any network interface may unintentionally allow broader outbound access than intended by the policy authors. In such cases, the toCIDRset section of the derived policy is not generated, which means outbound traffic may be permitted to more destinations than originally intended.
### Patches
This issue has been patched in:
* Cilium v1.18.4
* Cilium v1.17.10
* Cilium v1.16.17
### This issue affects:
- Cilium v1.18 between v1.18.0 and v1.18.3 inclusive
- Cilium v1.17 between v1.17.0 and v1.17.9 inclusive
- Cilium v1.16.16 and below
### Workarounds
There is no workaround to this issue.
### Acknowledgements
The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to @SeanEmac for reporting this issue and to @fristonio for the patch.
### For more information
If you think you have found a vulnerability affecting Cilium, we strongly encourage you to report it to our security mailing list at [security@cilium.io](mailto:security@cilium.io). This is a private mailing list for the Cilium security team, and your report will be treated as top priority.
A vulnerability in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL allows a low privilege authenticated user to escalate privileges to the rds_superuser role by creating a crafted function executed with elevated permissions. This affects versions of the AWS Go Wrapper prior to 1.0.2 and 1.1.1. A fix is available in versions 1.0.2 and 1.1.1.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.18.24. See the following advisory for the container images for this release:
https://access.redhat.com/errata/RHBA-2025:15714
All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
A memory exhaustion vulnerability exists in containerd's CRI Attach implementation due to a goroutine leak. Repeated use of the CRI Attach feature, such as via 'kubectl attach', can cause containerd to consume increasing amounts of host memory. This issue has been fixed in containerd versions 1.7.29, 2.0.7, 2.1.5, and 2.2.0. Users are advised to upgrade to these versions. As a workaround, admission controllers can be configured to limit access to pod attach operations.
OpenTofu versions prior to 1.10.7 are vulnerable to denial of service during the 'tofu init' process when installing module packages from attacker-controlled sources. Maliciously crafted TLS certificate chains or tar archives can cause unbounded memory usage, high CPU consumption, or crashes. These issues do not allow code execution or data disclosure but can disrupt the installation process and degrade system performance. The vulnerabilities stem from underlying Go standard library components used by OpenTofu. OpenTofu 1.10.7 includes fixes by upgrading to Go 1.24.9. Versions 1.9 and 1.8 remain vulnerable with no upstream fix available. Operators are advised to upgrade or carefully review dependencies before installation.
CVE-2024-25621 is a local privilege escalation vulnerability in containerd caused by overly broad default permissions on certain directories. Specifically, /var/lib/containerd, /run/containerd/io.containerd.grpc.v1.cri, and /run/containerd/io.containerd.sandbox.controller.v1.shim were created with permissions that allowed local users to access sensitive metadata and volume contents, potentially leading to privilege escalation. The issue has been fixed in containerd versions 1.7.29, 2.0.7, 2.1.5, and 2.2.0. Users are advised to update to these versions or manually restrict directory permissions as a workaround. Running containerd in rootless mode is also a mitigation option.
ZITADEL's Organization V2Beta API contains Insecure Direct Object Reference (IDOR) vulnerabilities that allow authenticated administrators of one organization to access and modify data of other organizations within the same instance. The vulnerability affects organization-level data such as name, domains, and metadata but does not impact users, projects, or applications. Versions from 4.0.0-rc.1 up to 4.6.2 are affected. The issue is fixed in version 4.6.3 and later. Mitigation includes upgrading to the patched version or disabling the vulnerable API endpoints via reverse proxy or WAF.
Jellysweep versions prior to 0.13.0 contain a vulnerability in the /api/images/cache endpoint that allows authenticated users to supply a URL parameter which the server uses to download arbitrary content. This flaw enables potential server-side request forgery (SSRF) by making the server fetch unintended resources. The issue is fixed in version 0.13.0 where the vulnerable library was moved to internal use.
An unauthenticated access vulnerability in lakeFS allows anyone to retrieve aggregate API usage metrics from the /api/v1/usage-report/summary endpoint. Although no sensitive data is exposed, this information could reveal service activity or uptime patterns. The issue affects versions prior to 1.71.0 and has a medium severity rating with a CVSS score of 5.3. A fix is available in version 1.71.0. Workarounds include disabling usage reporting or blocking the endpoint via a load balancer or application firewall.
sqls-server/sqls version 0.2.28 contains a command injection vulnerability in the config command. The vulnerability arises because the openEditor function passes the EDITOR environment variable and config file path to a shell command without proper sanitization, allowing arbitrary command execution. This issue has been fixed in a later commit.
A critical vulnerability in the gnark-crypto library's Vector.ReadFrom() function allows an attacker to cause unchecked memory allocation by providing a maliciously crafted input. This leads to an out-of-memory crash and denial of service due to allocation attempts of up to approximately 128 GB of memory. The root cause is the lack of validation on a 4-byte length field read from untrusted input during vector deserialization. The issue is patched in versions 0.18.1 and 0.19.2 of gnark-crypto.
A vulnerability in Zitadel's token verification allowed sessions to be marked as authenticated after only one factor was verified, bypassing the intended second authentication factor. This affects Zitadel versions 4.0.0 to 4.5.0, 3.0.0 to 3.4.2, and several 2.x versions up to but not including 2.71.18. The flaw weakens multifactor authentication by permitting attackers to bypass password verification and authenticate using only the TOTP code. The issue has been fixed in Zitadel versions 4.6.0, 3.4.3, and 2.71.18 and later. Users are advised to upgrade to these patched versions to mitigate the risk.
Zitadel versions 2.0.0 to 2.71.17, 3.0.0 to 3.4.2, and 4.0.0 to 4.4.0 are vulnerable to brute-force attacks on OTP, TOTP, and passwords. The vulnerability allows attackers to impersonate users by repeatedly attempting authentication factors. Although Zitadel supports a lockout mechanism to prevent brute-force attacks, it is not enabled by default and can cause denial of service if activated. The lockout policy was also not fully implemented in newer resource-based APIs. The issue has been fixed in versions 2.71.18, 3.4.3, and 4.6.0 by enforcing lockout policies and introducing a delay mechanism to slow down repeated failed attempts.
ZITADEL versions 2.0.0 through 2.71.17, 3.0.0 through 3.4.2, and 4.0.0 through 4.5.0 are vulnerable to an account takeover via malicious header injection. The vulnerability arises because ZITADEL uses the Forwarded or X-Forwarded-Host HTTP headers to build password reset confirmation links. An attacker who can manipulate these headers can cause the reset link to point to a malicious domain, capturing the secret reset code and potentially resetting the user's password. Accounts with Multi-Factor Authentication or Passwordless authentication are protected against this attack. Patched versions are available that validate these headers properly.
A denial of service (DoS) vulnerability exists in the event endpoint of Consul and Consul Enterprise due to the lack of a maximum limit on the Content-Length header. This flaw allows an attacker to potentially exhaust resources by sending excessively large requests. The issue is tracked as CVE-2025-11375 and has been fixed in Consul Community Edition 1.22.0 and Consul Enterprise versions 1.22.0, 1.21.6, 1.20.8, and 1.18.12.
A denial of service (DoS) vulnerability exists in the key/value endpoint of Consul and Consul Enterprise due to improper validation of the Content Length header. This flaw, tracked as CVE-2025-11374, allows an attacker with low privileges to cause service disruption. The issue is resolved in Consul Community Edition 1.22.0 and Consul Enterprise versions 1.22.0, 1.21.6, 1.20.8, and 1.18.12.
Contrast versions prior to 1.12.1 use cryptsetup for secure persistent volumes but are vulnerable to crafted LUKS2 volumes that use null key-encryption algorithms. This allows an attacker to create volumes that open without error and record data in plaintext or with attacker-known keys, exposing confidential data. A partial fix was introduced in cryptsetup 2.8.1 and incorporated in Contrast v1.12.1. Further hardening and integrity protection were added in Contrast v1.13.0.
Sliver's custom Wireguard implementation does not restrict traffic between Wireguard clients, allowing unrestricted communication. This design flaw can lead to keypair leakage and unauthorized access to operator services. An attacker who recovers a beacon's Wireguard private key can connect to the Wireguard listener and create new clients, potentially maintaining persistence within the network. The vulnerability affects all Sliver versions with Wireguard functionality prior to 1.5.44.