Every CVE Search/ Get API key

CVE-2026-33186

gRPC-Go has an authorization bypass via missing leading slash in :path

9.1 CriticalPublic exploitFix available

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.62%Up 1.6 points since Mar 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

gRPC-Go has an authorization bypass via missing leading slash in :path

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Record
CVE-2026-33186
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285, CWE-551
Updated
2026-11-02
EUVDEUVD-2026-13830 9.1

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Record
EUVD-2026-13830
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-p77j-4mvh-x3m3 9.1

gRPC-Go has an authorization bypass via missing leading slash in :path

Impact

What kind of vulnerability is it? Who is impacted?

It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header.

The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present.

Who is impacted? This affects gRPC-Go servers that meet both of the following criteria:

  1. They use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx).
  2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule).

The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server.

Patches

Has the problem been patched? What versions should users upgrade to?

Yes, the issue has been patched. The fix ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string.

Users should upgrade to the following versions (or newer):

  • v1.79.3
  • The latest master branch.

It is recommended that all users employing path-based authorization (especially grpc/authz) upgrade as soon as the patch is available in a tagged release.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods:

1. Use a Validating Interceptor (Recommended Mitigation)

Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs:

func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
    if info.FullMethod == "" || info.FullMethod[0] != '/' {
        return nil, status.Errorf(codes.Unimplemented, "malformed method name")
    }   
    return handler(ctx, req)
}

// Ensure this is the FIRST interceptor in your chain
s := grpc.NewServer(
    grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor),
)

2. Infrastructure-Level Normalization

If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the :path header does not start with a leading slash.

3. Policy Hardening

Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs.

Record
GHSA-p77j-4mvh-x3m3
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285
Updated
2026-11-02
NVD 9.1

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Record
CVE-2026-33186
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285, CWE-551
Updated
2026-11-02
OSVALPINE-CVE-2026-33186 9.1

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Record
ALPINE-CVE-2026-33186
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-03
OSVBELL-CVE-2026-33186 9.1
Record
BELL-CVE-2026-33186
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 48 moreShow less
OSV 9.1

gRPC-Go has an authorization bypass via missing leading slash in :path

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Record
CVE-2026-33186
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285
Updated
2026-11-02
OSVDEBIAN-CVE-2026-33186 9.1

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.

Record
DEBIAN-CVE-2026-33186
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVGHSA-p77j-4mvh-x3m3 9.1

gRPC-Go has an authorization bypass via missing leading slash in :path

Impact

What kind of vulnerability is it? Who is impacted?

It is an Authorization Bypass resulting from Improper Input Validation of the HTTP/2 :path pseudo-header.

The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present.

Who is impacted? This affects gRPC-Go servers that meet both of the following criteria:

  1. They use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx).
  2. Their security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule).

The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server.

Patches

Has the problem been patched? What versions should users upgrade to?

Yes, the issue has been patched. The fix ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string.

Users should upgrade to the following versions (or newer):

  • v1.79.3
  • The latest master branch.

It is recommended that all users employing path-based authorization (especially grpc/authz) upgrade as soon as the patch is available in a tagged release.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods:

1. Use a Validating Interceptor (Recommended Mitigation)

Add an "outermost" interceptor to your server that validates the path before any other authorization logic runs:

func pathValidationInterceptor(ctx context.Context, req any, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (any, error) {
    if info.FullMethod == "" || info.FullMethod[0] != '/' {
        return nil, status.Errorf(codes.Unimplemented, "malformed method name")
    }   
    return handler(ctx, req)
}

// Ensure this is the FIRST interceptor in your chain
s := grpc.NewServer(
    grpc.ChainUnaryInterceptor(pathValidationInterceptor, authzInterceptor),
)

2. Infrastructure-Level Normalization

If your gRPC server is behind a reverse proxy or load balancer (such as Envoy, NGINX, or an L7 Cloud Load Balancer), ensure it is configured to enforce strict HTTP/2 compliance for pseudo-headers and reject or normalize requests where the :path header does not start with a leading slash.

3. Policy Hardening

Switch to a "default deny" posture in your authorization policies (explicitly listing all allowed paths and denying everything else) to reduce the risk of bypasses via malformed inputs.

Record
GHSA-p77j-4mvh-x3m3
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-285
Updated
2026-11-02
OSVOESA-2026-1866 9.1

kata-containers-go security update

This is core component of Kata Container, to make it work, you need a isulad/docker engine.

Security Fix(es):

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.(CVE-2026-33186)

Record
OESA-2026-1866
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-1887 9.1

kata-containers security update

This is core component of Kata Container, to make it work, you need a isulad/docker engine.

Security Fix(es):

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official grpc/authz package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with /) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in google.golang.org/grpc/authz or custom interceptors relying on info.FullMethod or grpc.Method(ctx); AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed :path headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a :path that does not start with a leading slash is immediately rejected with a codes.Unimplemented error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.(CVE-2026-33186)

Record
OESA-2026-1887
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:10107 9.1

Red Hat Security Advisory: rhc security update

Record
RHSA-2026:10107
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:10705 9.1

Red Hat Security Advisory: rhc security update

Record
RHSA-2026:10705
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:10706 9.1

Red Hat Security Advisory: rhc security update

Record
RHSA-2026:10706
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:18068 9.1

Red Hat Security Advisory: Red Hat build of MicroShift 4.18.42 security update

Record
RHSA-2026:18068
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:19135 9.1

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:19135
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:19207 9.1

Red Hat Security Advisory: rhc security update

Record
RHSA-2026:19207
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:19353 9.1

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:19353
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:19719 9.1

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:19719
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:19720 9.1

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:19720
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:19721 9.1

Red Hat Security Advisory: opentelemetry-collector security update

Record
RHSA-2026:19721
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:20322 9.1

Red Hat Security Advisory: Red Hat build of MicroShift 4.19.32 security update

Record
RHSA-2026:20322
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:20436 9.1

Red Hat Security Advisory: Red Hat build of MicroShift 4.16.63 security update

Record
RHSA-2026:20436
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:22450 9.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:22450
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:22714 9.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:22714
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:22937 9.1

Red Hat Security Advisory: image-builder security update

Record
RHSA-2026:22937
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:23228 9.1

Red Hat Security Advisory: image-builder security update

Record
RHSA-2026:23228
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:26997 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.18.45 packages and security update

Record
RHSA-2026:26997
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:26999 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.19.35 packages and security update

Record
RHSA-2026:26999
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:27076 9.1

Red Hat Security Advisory: Satellite 6.16.9 Async Update

Record
RHSA-2026:27076
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:27712 9.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:27712
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:27856 9.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:27856
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:28047 9.1

Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (etcd) security update

Record
RHSA-2026:28047
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:29079 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.16.65 packages and security update

Record
RHSA-2026:29079
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:34097 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.17.55 packages and security update

Record
RHSA-2026:34097
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:36796 9.1

Red Hat Security Advisory: Red Hat Edge Manager Version 1.0.3 Security Update

Record
RHSA-2026:36796
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:41019 9.1

Red Hat Security Advisory: Red Hat Edge Manager Version 1.1.3 Security Update

Record
RHSA-2026:41019
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:42150 9.1

Red Hat Security Advisory: Satellite 6.17.9.1 Async Update

Record
RHSA-2026:42150
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:42151 9.1

Red Hat Security Advisory: Satellite 6.18.7.1 Async Update

Record
RHSA-2026:42151
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:42240 9.1

Red Hat Security Advisory: Satellite 6.19.2.1 Async Update

Record
RHSA-2026:42240
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:43225 9.1

Red Hat Security Advisory: OpenShift Container Platform 4.15.67 packages and security update

Record
RHSA-2026:43225
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:48790 9.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:48790
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:54191 9.1

Red Hat Security Advisory: rhc-worker-script security update

Record
RHSA-2026:54191
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:54757 9.1

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security advisory

Record
RHSA-2026:54757
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:56959 9.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:56959
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2026:61245 9.1

Red Hat Security Advisory: osbuild-composer security update

Record
RHSA-2026:61245
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:19135 9.1

Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

  • net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

  • google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

  • github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

  • crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

  • crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

  • crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19135
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:19353 9.1

Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

  • net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

  • google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

  • github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

  • crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

  • crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

  • crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:19353
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:22450 9.1

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

  • golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

  • crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

  • crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

  • net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

  • github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

  • google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

  • github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)

  • github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:22450
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:22714 9.1

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

  • golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

  • crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

  • crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

  • net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

  • github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

  • google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

  • github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)

  • github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:22714
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:22937 9.1

Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

  • golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

  • crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

  • crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

  • net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

  • google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

  • github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:22937
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:23228 9.1

Important: image-builder security update

A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

  • golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

  • crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

  • crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

  • net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

  • google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

  • github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:23228
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2026:48790 9.1

Important: osbuild-composer security update

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

  • github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

  • golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

  • crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

  • crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:48790
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVROOT-APP-GOBINARY-CVE-2026-33186 9.1

CVE-2026-33186 in google.golang.org/grpc - Patched by Root

Root has patched CVE-2026-33186 in the google.golang.org/grpc package for Root:Go. Multiple fixed versions available.

Record
ROOT-APP-GOBINARY-CVE-2026-33186
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02

Affected products

Show 157 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
google.golang.org/grpc
Go
 before 1.79.3
1.79.3
rclone
Alpine:v3.24
 before 1.73.5-r0
1.73.5-r0
opentelemetry-collector
AlmaLinux:10
From an advisory covering 8 CVEs
 before 0.144.0-2.el10_2
0.144.0-2.el10_2
opentelemetry-collector
AlmaLinux:9
From an advisory covering 8 CVEs
 before 0.144.0-2.el9_8
0.144.0-2.el9_8
osbuild-composer
AlmaLinux:8
From an advisory covering 5 CVEs
 before 101.5-1.el8_10.alma.1
101.5-1.el8_10.alma.1
osbuild-composer-core
AlmaLinux:8
From an advisory covering 5 CVEs
 before 101.5-1.el8_10.alma.1
101.5-1.el8_10.alma.1
osbuild-composer-worker
AlmaLinux:8
From an advisory covering 5 CVEs
 before 101.5-1.el8_10.alma.1
101.5-1.el8_10.alma.1
docker
Alpaquita:stream
 24.0.2-r0 up to 29.4.0-r0
29.4.0-r0
ignition
TuxCare:AlmaLinux:9.6
 before 2.21.0-1.el9_6.tuxcare.els3
2.21.0-1.el9_6.tuxcare.els3
ignition-edge
TuxCare:AlmaLinux:9.6
 before 2.21.0-1.el9_6.tuxcare.els3
2.21.0-1.el9_6.tuxcare.els3
Show 290 moreShow less
Affected packages
PackageAffectedFixed
ignition-grub
TuxCare:AlmaLinux:9.6
 before 2.21.0-1.el9_6.tuxcare.els3
2.21.0-1.el9_6.tuxcare.els3
ignition-validate
TuxCare:AlmaLinux:9.6
 before 2.21.0-1.el9_6.tuxcare.els3
2.21.0-1.el9_6.tuxcare.els3
golang-google-grpc
Debian:12
 All versions, plus listed versions
1.33.3-21.38.0+really1.33.3-11.38.0-11.38.0-21.38.0-3
Show 19 moreShow less
1.38.0-41.38.0-51.38.1-11.59.0-11.60.1-11.60.1-21.64.0-11.64.0-21.64.0-31.64.0-41.64.0-51.64.0-61.64.0-71.66.3-11.66.3-21.75.1-11.79.3-11.79.3-1~bpo13+11.81.1-1
 None known
golang-google-grpc
Debian:13
 All versions, plus listed versions
1.64.0-71.66.3-11.66.3-21.75.1-11.79.3-11.79.3-1~bpo13+11.81.1-1
 None known
golang-google-grpc
Debian:14
 before 1.79.3-1, plus listed versions
1.64.0-71.66.3-11.66.3-21.75.1-11.79.3-1~bpo13+1
1.79.3-1
rclone
Mageia:9
From an advisory covering 31 CVEs
 before 1.73.5-1.1.mga9
1.73.5-1.1.mga9
kata-containers-go
openEuler:24.03-LTS-SP3
 before 1.11.1-32.oe2403sp3
1.11.1-32.oe2403sp3
kata-containers
openEuler:24.03-LTS
 before 3.2.0-18.oe2403sp3
3.2.0-18.oe2403sp3
kata-containers
openEuler:24.03-LTS-SP1
 before 3.2.0-18.oe2403sp1
3.2.0-18.oe2403sp1
kata-containers
openEuler:24.03-LTS-SP2
 before 3.2.0-18.oe2403sp2
3.2.0-18.oe2403sp2
kata-containers
openEuler:24.03-LTS-SP3
 before 3.2.0-18.oe2403sp3
3.2.0-18.oe2403sp3
kata-containers
openEuler:20.03-LTS-SP4
 before v1.11.1-20.oe2003sp4
v1.11.1-20.oe2003sp4
kata-containers
openEuler:22.03-LTS-SP4
 before 1.11.1-34.oe2203sp4
1.11.1-34.oe2203sp4
rhc
Red Hat:enterprise_linux:8::appstream
 before 1:0.2.5-6.el8_10
1:0.2.5-6.el8_10
rhc-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 1:0.2.5-6.el8_10
1:0.2.5-6.el8_10
rhc-debugsource
Red Hat:enterprise_linux:8::appstream
 before 1:0.2.5-6.el8_10
1:0.2.5-6.el8_10
rhc
Red Hat:rhel_eus:9.6::appstream
 before 1:0.2.7-1.el9_6.3
1:0.2.7-1.el9_6.3
rhc-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 1:0.2.7-1.el9_6.3
1:0.2.7-1.el9_6.3
rhc-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 1:0.2.7-1.el9_6.3
1:0.2.7-1.el9_6.3
rhc-debuginfo
Red Hat:rhel_eus:9.6::crb
 before 1:0.2.7-1.el9_6.3
1:0.2.7-1.el9_6.3
rhc-debugsource
Red Hat:rhel_eus:9.6::crb
 before 1:0.2.7-1.el9_6.3
1:0.2.7-1.el9_6.3
rhc-devel
Red Hat:rhel_eus:9.6::crb
 before 1:0.2.7-1.el9_6.3
1:0.2.7-1.el9_6.3
rhc
Red Hat:enterprise_linux:9::appstream
 before 1:0.2.7-4.el9_7
1:0.2.7-4.el9_7
rhc-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 1:0.2.7-4.el9_7
1:0.2.7-4.el9_7
rhc-debugsource
Red Hat:enterprise_linux:9::appstream
 before 1:0.2.7-4.el9_7
1:0.2.7-4.el9_7
rhc-debuginfo
Red Hat:enterprise_linux:9::crb
 before 1:0.2.7-4.el9_7
1:0.2.7-4.el9_7
rhc-debugsource
Red Hat:enterprise_linux:9::crb
 before 1:0.2.7-4.el9_7
1:0.2.7-4.el9_7
rhc-devel
Red Hat:enterprise_linux:9::crb
 before 1:0.2.7-4.el9_7
1:0.2.7-4.el9_7
microshift
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-gateway-api
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-gateway-api-release-info
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-greenboot
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-low-latency
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-multus
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-multus-release-info
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-networking
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-olm
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-olm-release-info
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-release-info
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
microshift-selinux
Red Hat:openshift:4.18::el9
 before 0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
0:4.18.42-202605181217.p0.gf4eeb37.assembly.4.18.42.el9
opentelemetry-collector
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:0.144.0-2.el10_2
0:0.144.0-2.el10_2
rhc
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:0.2.7-5.el9_8
1:0.2.7-5.el9_8
rhc-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:0.2.7-5.el9_8
1:0.2.7-5.el9_8
rhc-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 1:0.2.7-5.el9_8
1:0.2.7-5.el9_8
rhc-debuginfo
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 1:0.2.7-5.el9_8
1:0.2.7-5.el9_8
rhc-debugsource
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 1:0.2.7-5.el9_8
1:0.2.7-5.el9_8
rhc-devel
Red Hat:enterprise_linux:9::crb
From an advisory covering 2 CVEs
 before 1:0.2.7-5.el9_8
1:0.2.7-5.el9_8
opentelemetry-collector
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:0.144.0-2.el9_8
0:0.144.0-2.el9_8
opentelemetry-collector
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 8 CVEs
 before 0:0.144.0-2.el10_0
0:0.144.0-2.el10_0
opentelemetry-collector
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 8 CVEs
 before 0:0.144.0-2.el9_6
0:0.144.0-2.el9_6
opentelemetry-collector
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 8 CVEs
 before 0:0.144.0-2.el9_4
0:0.144.0-2.el9_4
microshift
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-ai-model-serving
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-ai-model-serving-release-info
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-gateway-api
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-gateway-api-release-info
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-greenboot
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-low-latency
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-multus
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-multus-release-info
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-networking
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-observability
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-olm
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-olm-release-info
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-release-info
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift-selinux
Red Hat:openshift:4.19::el9
 before 0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
0:4.19.32-202605212036.p0.g27d51c3.assembly.4.19.32.el9
microshift
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
microshift-greenboot
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
microshift-multus
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
microshift-multus-release-info
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
microshift-networking
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
microshift-olm
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
microshift-olm-release-info
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
microshift-release-info
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
microshift-selinux
Red Hat:openshift:4.16::el9
 before 0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
0:4.16.63-202605251227.p0.g1133ac0.assembly.4.16.63.el9
osbuild-composer
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2
0:165.1-2.el10_2
osbuild-composer-core
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2
0:165.1-2.el10_2
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2
0:165.1-2.el10_2
osbuild-composer-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2
0:165.1-2.el10_2
osbuild-composer-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2
0:165.1-2.el10_2
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2
0:165.1-2.el10_2
osbuild-composer-worker
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2
0:165.1-2.el10_2
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2
0:165.1-2.el10_2
osbuild-composer
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8
0:165.1-2.el9_8
osbuild-composer-core
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8
0:165.1-2.el9_8
osbuild-composer-core-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8
0:165.1-2.el9_8
osbuild-composer-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8
0:165.1-2.el9_8
osbuild-composer-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8
0:165.1-2.el9_8
osbuild-composer-tests-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8
0:165.1-2.el9_8
osbuild-composer-worker
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8
0:165.1-2.el9_8
osbuild-composer-worker-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8
0:165.1-2.el9_8
image-builder
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:52.1-1.el10_2
0:52.1-1.el10_2
image-builder-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:52.1-1.el10_2
0:52.1-1.el10_2
image-builder-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:52.1-1.el10_2
0:52.1-1.el10_2
image-builder
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:52.1-1.el9_8
0:52.1-1.el9_8
image-builder-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:52.1-1.el9_8
0:52.1-1.el9_8
image-builder-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:52.1-1.el9_8
0:52.1-1.el9_8
ose-azure-acr-image-credential-provider
Red Hat:openshift:4.18::el8
 before 0:4.18.0-202606160919.p2.g9795abd.assembly.stream.el8
0:4.18.0-202606160919.p2.g9795abd.assembly.stream.el8
ose-azure-acr-image-credential-provider
Red Hat:openshift:4.18::el9
 before 0:4.18.0-202606160919.p2.g9795abd.assembly.stream.el9
0:4.18.0-202606160919.p2.g9795abd.assembly.stream.el9
ose-azure-acr-image-credential-provider
Red Hat:openshift:4.19::el9
 before 0:4.19.0-202606111920.p2.g6282230.assembly.stream.el9
0:4.19.0-202606111920.p2.g6282230.assembly.stream.el9
yggdrasil-worker-forwarder
Red Hat:satellite:6.16::el8
From an advisory covering 8 CVEs
 before 0:0.0.3-5.el8sat
0:0.0.3-5.el8sat
yggdrasil-worker-forwarder
Red Hat:satellite:6.16::el9
From an advisory covering 8 CVEs
 before 0:0.0.3-5.el9sat
0:0.0.3-5.el9sat
dynflow-utils
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:1.6.3-1.1.el8sat
0:1.6.3-1.1.el8sat
dynflow-utils
Red Hat:satellite:6.16::el8
From an advisory covering 8 CVEs
 before 0:1.6.3-1.1.el8sat
0:1.6.3-1.1.el8sat
dynflow-utils
Red Hat:satellite_capsule:6.16::el9
From an advisory covering 8 CVEs
 before 0:1.6.3-1.1.el9sat
0:1.6.3-1.1.el9sat
dynflow-utils
Red Hat:satellite:6.16::el9
From an advisory covering 8 CVEs
 before 0:1.6.3-1.1.el9sat
0:1.6.3-1.1.el9sat
python-pillow
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python-pillow-debugsource
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
python3.11-pillow
Red Hat:satellite_capsule:6.16::el8
From an advisory covering 8 CVEs
 before 0:12.2.0-1.el8pc
0:12.2.0-1.el8pc
opentelemetry-collector
Rocky Linux:10
From an advisory covering 8 CVEs
 before 0:0.144.0-2.el10_2
0:0.144.0-2.el10_2
opentelemetry-collector
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:0.144.0-2.el9_8
0:0.144.0-2.el9_8
osbuild-composer
Rocky Linux:10
From an advisory covering 11 CVEs
 before 0:165.1-2.el10_2.rocky.0.1
0:165.1-2.el10_2.rocky.0.1
osbuild-composer
Rocky Linux:9
From an advisory covering 11 CVEs
 before 0:165.1-2.el9_8.rocky.0.1
0:165.1-2.el9_8.rocky.0.1
image-builder
Rocky Linux:10
From an advisory covering 8 CVEs
 before 0:52.1-1.el10_2.rocky.0.1
0:52.1-1.el10_2.rocky.0.1
image-builder
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:52.1-1.el9_8
0:52.1-1.el9_8
osbuild-composer
Rocky Linux:8
From an advisory covering 5 CVEs
 before 0:101.5-1.el8_10.rocky.0.6
0:101.5-1.el8_10.rocky.0.6
google.golang.org/grpc
Root:Go
 before v1.72.0-aikido.6
v1.72.0-aikido.6v1.71.0-aikido.4v1.71.0-aikido.5v1.72.0-aikido.4v1.72.0-aikido.5v1.61.0-aikido.1v1.65.0-aikido.3v1.78.0-aikido.4v1.78.0-aikido.3v1.72.1-aikido.1v1.73.0-aikido.1v1.57.0-aikido.2v1.71.0-aikido.2v1.78.0-aikido.2v1.72.0-aikido.3v1.69.4-aikido.2v1.65.0-aikido.2v1.79.1-aikido.3v1.77.0-dev-aikido.1v1.79.1-aikido.4v1.65.0-aikido.4v1.71.0-aikido.3v1.77.0-aikido.5v1.65.0-aikido.5v1.76.0-aikido.1v1.59.0-aikido.1v1.69.4-aikido.3v1.72.2-aikido.1
rootio-google.golang.org/grpc
Root:Go
 before v1.72.0-root.io.6
v1.72.0-root.io.6v1.71.0-root.io.4v1.71.0-root.io.5v1.72.0-root.io.4v1.72.0-root.io.5v1.72.0-root.io.1v1.65.0-root.io.1v1.71.0-root.io.1v1.69.4-root.io.1v1.57.0-root.io.1v1.61.0-root.io.1v1.65.0-root.io.3v1.78.0-root.io.4v1.78.0-root.io.1v1.78.0-root.io.3v1.72.1-root.io.1v1.73.0-root.io.1v1.57.0-root.io.2v1.71.0-root.io.2v1.78.0-root.io.2v1.72.0-root.io.3v1.69.4-root.io.2v1.65.0-root.io.2v1.79.1-root.io.3v1.77.0-dev-root.io.1v1.65.0-root.io.4v1.79.1-root.io.4v1.71.0-root.io.3v1.77.0-root.io.5v1.65.0-root.io.5v1.76.0-root.io.1v1.59.0-root.io.1v1.69.4-root.io.3v1.72.2-root.io.1
google-cloud-sap-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 3.12-150100.3.63.1
3.12-150100.3.63.1
google-cloud-sap-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 3.12-150100.3.63.1
3.12-150100.3.63.1
google-cloud-sap-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
 before 3.12-150100.3.63.1
3.12-150100.3.63.1
google-cloud-sap-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
 before 3.12-150100.3.63.1
3.12-150100.3.63.1
google-cloud-sap-agent
openSUSE:Leap 15.6
 before 3.12-150100.3.63.1
3.12-150100.3.63.1
google-cloud-sap-agent
SUSE:Linux Enterprise Module for Public Cloud 12
 before 3.12-6.60.1
3.12-6.60.1
ignition
SUSE:Linux Enterprise Micro 5.3
 before 2.14.0-150400.4.15.1
2.14.0-150400.4.15.1
ignition
SUSE:Linux Enterprise Micro 5.2
 before 2.14.0-150300.6.19.1
2.14.0-150300.6.19.1
ignition
SUSE:Linux Enterprise Micro 5.5
 before 2.17.0-150500.3.15.1
2.17.0-150500.3.15.1
govulncheck-vulndb
openSUSE:Leap 15.6
From an advisory covering 34 CVEs
 before 0.0.20260402T184258-150000.1.158.1
0.0.20260402T184258-150000.1.158.1
ignition
SUSE:Linux Enterprise Micro 5.4
 before 2.15.0-150400.4.14.1
2.15.0-150400.4.14.1
ignition
SUSE:Linux Enterprise Module for HPC 15 SP7
 before 2.14.0-150400.9.15.1
2.14.0-150400.9.15.1
ignition
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 2.14.0-150400.9.15.1
2.14.0-150400.9.15.1
ignition
openSUSE:Leap 15.6
 before 2.14.0-150400.9.15.1
2.14.0-150400.9.15.1
azure-storage-azcopy
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
 before 10.29.1-150400.9.6.1
10.29.1-150400.9.6.1
azure-storage-azcopy
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
 before 10.29.1-150400.9.6.1
10.29.1-150400.9.6.1
azure-storage-azcopy
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
 before 10.29.1-150400.9.6.1
10.29.1-150400.9.6.1
azure-storage-azcopy
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
 before 10.29.1-150400.9.6.1
10.29.1-150400.9.6.1
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 2 CVEs
 before 2.0.0-150200.6.8.1
2.0.0-150200.6.8.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 2 CVEs
 before 3.0.0-150200.6.12.1
3.0.0-150200.6.12.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 2 CVEs
 before 3.0.0-150200.6.6.2
3.0.0-150200.6.6.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 2 CVEs
 before 3.0.0-150200.5.6.2
3.0.0-150200.5.6.2
terraform-provider-local
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 2 CVEs
 before 2.0.0-150200.6.8.1
2.0.0-150200.6.8.1
terraform-provider-null
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 2 CVEs
 before 3.0.0-150200.6.12.1
3.0.0-150200.6.12.1
terraform-provider-random
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 2 CVEs
 before 3.0.0-150200.6.6.2
3.0.0-150200.6.6.2
terraform-provider-tls
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 2 CVEs
 before 3.0.0-150200.5.6.2
3.0.0-150200.5.6.2
terraform-provider-local
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 2.0.0-150200.6.8.1
2.0.0-150200.6.8.1
terraform-provider-null
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 3.0.0-150200.6.12.1
3.0.0-150200.6.12.1
terraform-provider-random
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 3.0.0-150200.6.6.2
3.0.0-150200.6.6.2
terraform-provider-tls
openSUSE:Leap 15.6
From an advisory covering 2 CVEs
 before 3.0.0-150200.5.6.2
3.0.0-150200.5.6.2
golang-github-lusitaniae-apache_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 1.0.10-150002.3.6.1
1.0.10-150002.3.6.1
golang-github-prometheus-prometheus
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 3.5.0-150002.3.8.1
3.5.0-150002.3.8.1
grafana
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 11.6.14+security01-150002.4.14.1
11.6.14+security01-150002.4.14.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 0.26.0-150002.3.6.1
0.26.0-150002.3.6.1
spacecmd
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 5.1.13-150002.3.9.3
5.1.13-150002.3.9.3
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-15
From an advisory covering 17 CVEs
 before 5.1.26-150002.3.12.1
5.1.26-150002.3.12.1
prometheus-blackbox_exporter
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 17 CVEs
 before 0.26.0-150002.3.6.1
0.26.0-150002.3.6.1
uyuni-tools
SUSE:Multi Linux Manager Tools SLE-Micro-5
From an advisory covering 17 CVEs
 before 5.1.26-150002.3.12.1
5.1.26-150002.3.12.1
ignition
SUSE:Linux Micro 6.1
 before 2.19.0-slfo.1.1_3.1
2.19.0-slfo.1.1_3.1
ignition
SUSE:Linux Micro 6.0
 before 2.19.0-3.1
2.19.0-3.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server 16.0
 before 3.12-160000.1.1
3.12-160000.1.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.12-160000.1.1
3.12-160000.1.1
ignition
SUSE:Linux Micro 6.2
 before 2.21.0-160000.3.1
2.21.0-160000.3.1
elemental-register
SUSE:Linux Micro 6.2
 before 1.9.2-160000.1.1
1.9.2-160000.1.1
elemental-toolkit
SUSE:Linux Micro 6.2
 before 2.3.4-160000.1.1
2.3.4-160000.1.1
elemental-system-agent
SUSE:Linux Micro 6.2
 before 0.3.16-160000.1.1
0.3.16-160000.1.1
elemental-toolkit
SUSE:Linux Micro 6.0
From an advisory covering 19 CVEs
 before 2.1.6-1.1
2.1.6-1.1
elemental-operator
SUSE:Linux Micro 6.0
From an advisory covering 9 CVEs
 before 1.6.11-1.1
1.6.11-1.1
elemental-toolkit
SUSE:Linux Micro 6.1
From an advisory covering 19 CVEs
 before 2.2.9-slfo.1.1_1.1
2.2.9-slfo.1.1_1.1
elemental-operator
SUSE:Linux Micro 6.1
From an advisory covering 9 CVEs
 before 1.7.5-slfo.1.1_1.1
1.7.5-slfo.1.1_1.1
elemental-system-agent
SUSE:Linux Micro 6.0
 before 0.3.16-1.1
0.3.16-1.1
google-guest-agent
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 20260430.00-160000.1.1
20260430.00-160000.1.1
google-guest-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 20260430.00-160000.1.1
20260430.00-160000.1.1
google-guest-agent
SUSE:Linux Micro 6.1
From an advisory covering 6 CVEs
 before 20260430.00-slfo.1.1_1.1
20260430.00-slfo.1.1_1.1
elemental-system-agent
SUSE:Linux Micro 6.1
 before 0.3.16-slfo.1.1_1.1
0.3.16-slfo.1.1_1.1
google-osconfig-agent
SUSE:Linux Micro 6.0
From an advisory covering 23 CVEs
 before 20260615.01-1.1
20260615.01-1.1
google-osconfig-agent
SUSE:Linux Micro 6.1
From an advisory covering 22 CVEs
 before 20260615.01-slfo.1.1_1.1
20260615.01-slfo.1.1_1.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server 16.0
From an advisory covering 4 CVEs
 before 3.15-160000.1.1
3.15-160000.1.1
google-cloud-sap-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 4 CVEs
 before 3.15-160000.1.1
3.15-160000.1.1
google-guest-agent
SUSE:Linux Enterprise Server 16.0
From an advisory covering 15 CVEs
 before 20260529.00-160000.1.1
20260529.00-160000.1.1
google-guest-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 15 CVEs
 before 20260529.00-160000.1.1
20260529.00-160000.1.1
google-guest-agent
SUSE:Linux Micro 6.0
From an advisory covering 15 CVEs
 before 20260529.00-1.1
20260529.00-1.1
google-guest-agent
SUSE:Linux Micro 6.1
From an advisory covering 15 CVEs
 before 20260529.00-slfo.1.1_1.1
20260529.00-slfo.1.1_1.1
google-osconfig-agent
SUSE:Linux Enterprise Server 16.0
From an advisory covering 22 CVEs
 before 20260615.01-160000.1.2
20260615.01-160000.1.2
google-osconfig-agent
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 22 CVEs
 before 20260615.01-160000.1.2
20260615.01-160000.1.2
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 12
 before 20250416.02-1.44.1
20250416.02-1.44.1
google-guest-agent
SUSE:Linux Micro 6.1
From an advisory covering 4 CVEs
 before 20260903.01-slfo.1.1_2.1
20260903.01-slfo.1.1_2.1
google-guest-agent
SUSE:Linux Micro 6.0
From an advisory covering 4 CVEs
 before 20260903.01-2.1
20260903.01-2.1
kubevirt
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 7 CVEs
 before 1.7.4-150700.3.24.2
1.7.4-150700.3.24.2
kubevirt-1.6
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 7 CVEs
 before 1.6.6-150700.15.7.1
1.6.6-150700.15.7.1
containerd
SUSE:Linux Micro 6.0
From an advisory covering 6 CVEs
 before 1.7.29-159998.1.1
1.7.29-159998.1.1
alloy
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 1.16.1-150700.15.20.1
1.16.1-150700.15.20.1
azure-storage-azcopy
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 5 CVEs
 before 10.32.4-150400.9.11.1
10.32.4-150400.9.11.1
azure-storage-azcopy
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 5 CVEs
 before 10.32.4-150400.9.11.1
10.32.4-150400.9.11.1
azure-storage-azcopy
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 5 CVEs
 before 10.32.4-150400.9.11.1
10.32.4-150400.9.11.1
azure-storage-azcopy
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 5 CVEs
 before 10.32.4-150400.9.11.1
10.32.4-150400.9.11.1
containerized-data-importer
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 12 CVEs
 before 1.64.0-150700.9.11.1
1.64.0-150700.9.11.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 12
From an advisory covering 22 CVEs
 before 20260529.00-1.61.1
20260529.00-1.61.1
apptainer
SUSE:Linux Enterprise Module for HPC 15 SP7
From an advisory covering 19 CVEs
 before 1.5.1-150600.4.24.1
1.5.1-150600.4.24.1
apptainer
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 19 CVEs
 before 1.5.1-150600.4.24.1
1.5.1-150600.4.24.1
google-osconfig-agent
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 16 CVEs
 before 20260615.01-150000.1.55.1
20260615.01-150000.1.55.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 16 CVEs
 before 20260615.01-150000.1.55.1
20260615.01-150000.1.55.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 16 CVEs
 before 20260615.01-150000.1.55.1
20260615.01-150000.1.55.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 16 CVEs
 before 20260615.01-150000.1.55.1
20260615.01-150000.1.55.1
google-osconfig-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 16 CVEs
 before 20260615.01-150000.1.55.1
20260615.01-150000.1.55.1
google-guest-agent
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 22 CVEs
 before 20260529.00-150000.1.70.1
20260529.00-150000.1.70.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP4
From an advisory covering 22 CVEs
 before 20260529.00-150000.1.70.1
20260529.00-150000.1.70.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP5
From an advisory covering 22 CVEs
 before 20260529.00-150000.1.70.1
20260529.00-150000.1.70.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP6
From an advisory covering 22 CVEs
 before 20260529.00-150000.1.70.1
20260529.00-150000.1.70.1
google-guest-agent
SUSE:Linux Enterprise Module for Public Cloud 15 SP7
From an advisory covering 22 CVEs
 before 20260529.00-150000.1.70.1
20260529.00-150000.1.70.1
containerd
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise Module for Containers 15 SP7
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
containerd
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 4 CVEs
 before 1.7.29-150000.137.1
1.7.29-150000.137.1
golang-google-grpc
Ubuntu:16.04:LTS
 All versions, plus listed versions
0.0~git20150514.0.f5ebd86-10.0~git20150514.0.f5ebd86-20.0~git20151002.0.3e7b7e5-1
 None known
google-guest-agent
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~16.04.020230426.00-0ubuntu2~16.04.320231004.02-0ubuntu1~16.04.120231004.02-0ubuntu1~16.04.220240716.00-0ubuntu1~16.04.020240716.00-0ubuntu1~16.04.0+esm120240716.00-0ubuntu1~16.04.0+esm220240716.00-0ubuntu1~16.04.0+esm3
 None known
golang-google-grpc
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.0.4-11.6.0-21.6.0-31.6.0-3ubuntu0.18.04.1
 None known
google-guest-agent
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~18.04.020210414.00-0ubuntu1~18.04.020210629.00-0ubuntu1~18.04.120220622.00-0ubuntu2~18.04.020220622.00-0ubuntu2~18.04.1
Show 8 moreShow less
20230426.00-0ubuntu2~18.04.020231004.02-0ubuntu1~18.04.220231004.02-0ubuntu1~18.04.320240716.00-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.020241011.01-0ubuntu1~18.04.0+esm120241011.01-0ubuntu1~18.04.0+esm220241011.01-0ubuntu1~18.04.0+esm3
 None known
google-guest-agent
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
20201217.02-0ubuntu1~20.04.020210414.00-0ubuntu1~20.04.020210629.00-0ubuntu1~20.04.020220622.00-0ubuntu2~20.04.020220622.00-0ubuntu2~20.04.2
Show 11 moreShow less
20230426.00-0ubuntu2~20.04.020231004.02-0ubuntu1~20.04.120231004.02-0ubuntu1~20.04.220231004.02-0ubuntu1~20.04.320231004.02-0ubuntu1~20.04.420240716.00-0ubuntu1~20.04.020241011.01-0ubuntu1~20.04.120250116.00-0ubuntu1~20.04.020250116.00-0ubuntu1~20.04.0+esm120250116.00-0ubuntu1~20.04.0+esm220250116.00-0ubuntu1~20.04.0+esm3
 None known
golang-google-grpc
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.22.1-1ubuntu1
 None known
golang-google-grpc
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.29.1-0ubuntu1
 None known
google-guest-agent
Ubuntu:22.04:LTS
 All versions, plus listed versions
20210629.00-0ubuntu120210629.00-0ubuntu220220104.00-0ubuntu120220104.00-0ubuntu220220622.00-0ubuntu2~22.04.0
Show 14 moreShow less
20220622.00-0ubuntu2~22.04.120230426.00-0ubuntu2~22.04.020231004.02-0ubuntu1~22.04.120231004.02-0ubuntu1~22.04.220231004.02-0ubuntu1~22.04.320231004.02-0ubuntu1~22.04.420231004.02-0ubuntu1~22.04.520240716.00-0ubuntu1~22.04.020241011.01-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.020250116.00-0ubuntu1~22.04.120250116.00-0ubuntu1~22.04.220250116.00-0ubuntu1~22.04.320250116.00-0ubuntu1~22.04.4
 None known
google-guest-agent
Ubuntu:24.04:LTS
 All versions, plus listed versions
20230426.00-0ubuntu320231004.02-0ubuntu120231004.02-0ubuntu320240213.00-0ubuntu120240213.00-0ubuntu2
Show 11 moreShow less
20240213.00-0ubuntu320240213.00-0ubuntu3.120240213.00-0ubuntu3.220240716.00-0ubuntu1~24.04.020240716.00-0ubuntu1~24.04.120241011.01-0ubuntu1~24.04.020250116.00-0ubuntu1~24.04.020250116.00-0ubuntu1~24.04.120250116.00-0ubuntu1~24.04.220250116.00-0ubuntu1~24.04.320250116.00-0ubuntu1~24.04.4
 None known
golang-google-grpc
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
1.38.0+really1.33.3-1build11.38.0+really1.33.3-1ubuntu0.24.04.11.38.0+really1.33.3-1ubuntu0.24.04.21.38.0+really1.33.3-1ubuntu0.24.04.2+esm11.38.0+really1.33.3-1ubuntu0.24.04.31.38.0+really1.33.3-1ubuntu0.24.04.3+esm11.38.0+really1.33.3-1ubuntu0.24.04.3+esm2
 None known
golang-google-grpc
Ubuntu:25.10
 All versions, plus listed versions
1.64.0-61.64.0-7
 None known
google-guest-agent
Ubuntu:25.10
 All versions, plus listed versions
20250116.00-0ubuntu220250506.01-0ubuntu120250506.01-0ubuntu1.120250506.01-0ubuntu1.2
 None known
golang-google-grpc
Ubuntu:26.10
 All versions, plus listed versions
1.66.3-21.81.1-1build1
 None known
google-guest-agent
Ubuntu:26.10
 All versions, plus listed versions
20250506.01-0ubuntu220250506.01-0ubuntu320260819.00+~20260819.00-0ubuntu1
 None known
golang-google-grpc
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.64.0-71.66.3-2
 None known
google-guest-agent
Ubuntu:26.04:LTS
 All versions, plus listed versions
20250506.01-0ubuntu120250506.01-0ubuntu220250506.01-0ubuntu2.1
 None known
dnscrypt-proxy
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 2.1.16-bp160.1.1
2.1.16-bp160.1.1
azure-storage-azcopy
openSUSE:Tumbleweed
 before 10.32.2-1.1
10.32.2-1.1
rclone
openSUSE:Tumbleweed
 before 1.73.3-1.1
1.73.3-1.1
amazon-cloudwatch-agent
openSUSE:Tumbleweed
 before 1.300064.0-2.1
1.300064.0-2.1
v2ray-core
openSUSE:Tumbleweed
 before 5.47.0-1.1
5.47.0-1.1
ignition
openSUSE:Tumbleweed
 before 2.26.0-3.1
2.26.0-3.1
k6
openSUSE:Tumbleweed
 before 1.7.1-1.1
1.7.1-1.1
clusterctl
openSUSE:Tumbleweed
 before 1.12.5-1.1
1.12.5-1.1
grafana
openSUSE:Tumbleweed
From an advisory covering 12 CVEs
 before 11.6.14+security01-1.1
11.6.14+security01-1.1
golang-github-prometheus-alertmanager
openSUSE:Tumbleweed
 before 0.31.1-3.1
0.31.1-3.1
kyverno
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 1.17.2-1.1
1.17.2-1.1
alloy
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.15.1-1.1
1.15.1-1.1
distribution
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.1.0-1.1
3.1.0-1.1
trivy
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 0.70.0-1.1
0.70.0-1.1
cri-tools
openSUSE:Tumbleweed
 before 1.36.0-1.1
1.36.0-1.1
apptainer
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.4.5-4.1
1.4.5-4.1
mcphost
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 0.34.0-1.1
0.34.0-1.1
google-osconfig-agent
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 20260511.00-1.1
20260511.00-1.1
shadowsocks-v2ray-plugin
openSUSE:Tumbleweed
 before 5.49.0-1.1
5.49.0-1.1
google-guest-agent
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 20260529.00-1.1
20260529.00-1.1
kubevirt
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.8.3-1.1
1.8.3-1.1
kubevirt-1.8
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 1.8.3-1.1
1.8.3-1.1
docker-stable
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 24.0.9_ce-18.1
24.0.9_ce-18.1
kubevirt1.8
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 1.8.3-1.1
1.8.3-1.1
containerd
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 1.7.33-1.1
1.7.33-1.1
velociraptor
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1
skopeo
openSUSE:Tumbleweed
 before 1.23.0-1.1
1.23.0-1.1
cadvisor
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 0.60.3-1.1
0.60.3-1.1
containerized-data-importer1.65
openSUSE:Tumbleweed
From an advisory covering 13 CVEs
 before 1.65.0-2.1
1.65.0-2.1
traefik
openSUSE:Tumbleweed
 before 3.7.9-1.1
3.7.9-1.1
traefik2
openSUSE:Tumbleweed
 before 2.11.53-1.1
2.11.53-1.1
cf-cli
openSUSE:Tumbleweed
 before 8.18.4+git.0.3fcd823a1-1.1
8.18.4+git.0.3fcd823a1-1.1
pvetui
openSUSE:Tumbleweed
 before 1.4.3-1.1
1.4.3-1.1
kubectl-retina
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 1.3.1-1.1
1.3.1-1.1
kumactl
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 3.0.0-1.1
3.0.0-1.1
timoni
openSUSE:Tumbleweed
From an advisory covering 14 CVEs
 before 0.36.0-1.1
0.36.0-1.1
fortio
openSUSE:Tumbleweed
 before 1.76.0-1.1
1.76.0-1.1
google-cloud-sap-agent
openSUSE:Leap 16.0
 before 3.12-160000.1.1
3.12-160000.1.1
v2ray-core
openSUSE:Leap 16.0
 before 5.47.0-bp160.1.1
5.47.0-bp160.1.1
ignition
openSUSE:Leap 16.0
 before 2.21.0-160000.3.1
2.21.0-160000.3.1
elemental-register
openSUSE:Leap 16.0
 before 1.9.2-160000.1.1
1.9.2-160000.1.1
elemental-toolkit
openSUSE:Leap 16.0
 before 2.3.4-160000.1.1
2.3.4-160000.1.1
elemental-system-agent
openSUSE:Leap 16.0
 before 0.3.16-160000.1.1
0.3.16-160000.1.1
grafana
openSUSE:Leap 16.0
From an advisory covering 24 CVEs
 before 11.6.14+security04-bp160.1.1
11.6.14+security04-bp160.1.1
google-guest-agent
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 20260430.00-160000.1.1
20260430.00-160000.1.1
google-cloud-sap-agent
openSUSE:Leap 16.0
From an advisory covering 4 CVEs
 before 3.15-160000.1.1
3.15-160000.1.1
google-guest-agent
openSUSE:Leap 16.0
From an advisory covering 15 CVEs
 before 20260529.00-160000.1.1
20260529.00-160000.1.1
docker-stable
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 24.0.9_ce-160000.6.1
24.0.9_ce-160000.6.1
google-osconfig-agent
openSUSE:Leap 16.0
From an advisory covering 22 CVEs
 before 20260615.01-160000.1.2
20260615.01-160000.1.2
containerd
openSUSE:Leap 16.0
From an advisory covering 10 CVEs
 before 1.7.33-160000.1.1
1.7.33-160000.1.1
cadvisor
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 0.60.3-bp160.1.1
0.60.3-bp160.1.1
govulncheck-vulndb
openSUSE:Leap 16.0
From an advisory covering 1734 CVEs
 before 0.0.20260723T184607-160000.1.1
0.0.20260723T184607-160000.1.1
containerized-data-importer1.65
openSUSE:Leap 16.0
From an advisory covering 39 CVEs
 before 1.65.0-160000.3.1
1.65.0-160000.3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubJohannesLks/CVE-2026-331862026-04-06
PoC in GitHubbasesixtythree/B63-POC-CVE-2026-331862026-11-02

History

History
RecordedChangedSources
affected, facts
affected, aliases, aliases_more, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33186 is a critical vulnerability (CVSS 9.1) in Grpc, published March 18, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.62%, the 76th percentile. Fixed in google.golang.org/grpc 1.79.3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 239 package rows and 2,564 references. The JSON record has them. Also not on the record: 93 aliases. ID and package lookups still check them. Left out on purpose, here and in the API, to keep responses small: 143 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open