Most recent entries from all

bdu:2026-03571

Withdrawn: CLEANSTART-2026-AA33691 — Security fixes in calico-fips 3.28.5-r4

Withdrawn by the publisher.

Affected: CleanStart: calico-fips

Package calico-fips version 3.28.5-r4 fixes 5 vulnerabilities: CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2025-13281

EUVD-2026-263520

fkie_cve-2025-13281

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).

GHSA-r6j8-c6r2-37rr — kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

Affected: Go: k8s.io/kubernetes

msrc_CVE-2025-13281 — Portworx Half-Blind SSRF in kube-controller-manager

msrc_CVE-2025-13281

OESA-2025-2815 — kubernetes security update

Affected: openEuler:20.03-LTS-SP4: kubernetes

Container cluster management. Security Fix(es):

A vulnerability was found in Kubernetes kube-controller-manager up to versions 1.30.14, 1.31.14, 1.32.9, 1.33.5 and 1.34.1. It has been classified as CWE-918 (Server-Side Request Forgery). The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This vulnerability impacts confidentiality, integrity, and availability.(CVE-2025-13281)

WID-SEC-W-2025-2705 — Kubernetes: Schwachstelle ermöglicht Offenlegung von Informationen

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Kubernetes ausnutzen, um Informationen offenzulegen.