Cloud, containers and DevOps: vulnerabilities and fixes

AWS, Azure, Kubernetes, Docker, Jenkins, GitLab, Terraform and CI/CD tools. 360 CVEs tracked.

Cloud, containers and DevOps has 360 tracked vulnerabilities, 62 critical and 9 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 279. Most recent: 2026-10-23. Highest priority: CVE-2026-63077 (score 100/100).

• CVE-2026-63077 CRITICAL 9.8 EXPLOITED UPGRADE JetBrains TeamCity Deserialization of Untrusted Data Vulnerability
• CVE-2026-85706 CRITICAL 10.0 EXPLOITED UPGRADE GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability
• CVE-2026-60004 CRITICAL 9.8 EXPLOITED UPGRADE Gitea Code Injection Vulnerability
• CVE-2026-82329 CRITICAL 9.8 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-21589 HIGH 7.5 EXPLOITED UPGRADE UPGRADE Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
• CVE-2026-48710 MEDIUM 6.5 EXPLOITED UPGRADE UPGRADE Kludex Starlette HTTP Request/Response Smuggling Vulnerability
• CVE-2026-42018 HIGH 7.5 EXPLOITED UPGRADE JFrog Artifactory Improper Authentication Vulnerability
• CVE-2026-42016 HIGH 8.1 EXPLOITED UPGRADE JFrog Artifactory Incorrect Authorization Vulnerability
• CVE-2023-34844 CRITICAL 9.8 UPGRADE Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape.
• CVE-2026-110063 CRITICAL 10.0 Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allo
• CVE-2026-56162 CRITICAL 10.0 MITIGATE Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a net
• CVE-2026-56163 CRITICAL 10.0 MITIGATE Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized atta
• CVE-2026-58275 CRITICAL 10.0 MITIGATE Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-58630 CRITICAL 10.0 MITIGATE Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a netw
• CVE-2026-62825 CRITICAL 10.0 MITIGATE Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a networ
• CVE-2026-66803 CRITICAL 10.0 MITIGATE Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
• CVE-2026-73240 CRITICAL 9.8 UPGRADE Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Al
• CVE-2026-53975 CRITICAL 9.8 OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attacker
• CVE-2026-61484 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue
• CVE-2026-45618 CRITICAL 10.0 LiquidJS is a Shopify/GitHub Pages compatible template engine
• CVE-2026-50516 CRITICAL 9.4 MITIGATE Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privile
• CVE-2026-59243 CRITICAL 9.8 UPGRADE The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so
• CVE-2026-67324 CRITICAL 9.8 UPGRADE GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pa
• CVE-2026-71289 CRITICAL 9.8 The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose
• CVE-2026-73519 CRITICAL 9.8 WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and publ
• CVE-2026-48168 CRITICAL 10.0 PraisonAI is a multi-agent teams system
• CVE-2026-50515 CRITICAL 9.9 MITIGATE Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a ne
• CVE-2026-105014 CRITICAL 9.1 Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows
• CVE-2026-115812 CRITICAL 9.8 Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and e
• CVE-2026-61486 CRITICAL 9.8 MITIGATE ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affect
• CVE-2026-62835 CRITICAL 9.3 MITIGATE Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
• CVE-2026-69096 HIGH 8.8 OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC bac
• CVE-2026-83938 CRITICAL 10.0 Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized
• CVE-2026-110264 CRITICAL 10.0 An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0
• CVE-2026-54680 CRITICAL 9.9 Logging operator automates the deployment and configuration of Kubernetes logging pipelines
• CVE-2023-2017 HIGH 8.8 UPGRADE Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting bo
• CVE-2026-66384 MEDIUM 5.3 EXPLOITED UPGRADE JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
• CVE-2026-67325 HIGH 8.8 UPGRADE GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's lon
• CVE-2026-50481 CRITICAL 9.9 MITIGATE Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to eleva
• CVE-2026-62830 CRITICAL 9.9 MITIGATE Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
• CVE-2026-66297 HIGH 8.0 UPGRADE Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in live
• CVE-2026-16498 CRITICAL 10.0 The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the st
• CVE-2026-47752 CRITICAL 9.9 Tugtainer is a self-hosted app for automating updates of Docker containers
• CVE-2026-62836 HIGH 8.7 MITIGATE Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an un
• CVE-2026-111812 CRITICAL 10.0 Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request h
• CVE-2026-18245 CRITICAL 9.0 UPGRADE Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote
• CVE-2026-56161 CRITICAL 9.6 MITIGATE Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a netwo
• CVE-2026-67323 HIGH 8.4 UPGRADE GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archi
• CVE-2026-68823 CRITICAL 9.1 MITIGATE Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute cod
• CVE-2022-51026 CRITICAL 9.8 Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attac
• CVE-2026-16326 CRITICAL 10.0 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not properly isolate session state in stateless mode, whi
• CVE-2026-17556 CRITICAL 9.1 UPGRADE A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated atta
• CVE-2026-54725 CRITICAL 9.6 vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible
• CVE-2026-56160 CRITICAL 9.1 MITIGATE Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges ov
• CVE-2026-70375 HIGH 8.8 HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer compon
• CVE-2026-73298 HIGH 8.7 The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-ag
• CVE-2026-73625 HIGH 8.8 UPGRADE GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options gua
• CVE-2026-75885 CRITICAL 9.3 A flaw was found in the OpenShift console
• CVE-2026-47427 HIGH 7.5 UPGRADE GitHub MCP Server is GitHub's official MCP Server
• CVE-2026-57104 HIGH 8.8 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer
• CVE-2026-66907 HIGH 7.5 UPGRADE Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache C
• CVE-2026-69259 HIGH 8.8 UPGRADE Flowise is a drag & drop user interface to build a customized large language model flow
• CVE-2026-71190 HIGH 8.7 In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnera
• CVE-2026-73294 CRITICAL 9.9 Semaphore UI is a web interface for managing DevOps tools
• CVE-2026-76221 HIGH 8.8 UPGRADE GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allow
• CVE-2026-10059 CRITICAL 9.1 A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller
• CVE-2026-16503 CRITICAL 9.1 Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all i
• CVE-2026-67260 HIGH 7.3 UPGRADE Apache Airflow 3.3.0 moved human-in-the-loop tasks from the triggerer to a new `awaiting_input` task state swe
• CVE-2023-22647 CRITICAL 9.9 UPGRADE An Improper Privilege Management vulnerability in SUSE Rancher allowed standard users to leverage their existi
• CVE-2026-114087 HIGH 8.1 Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/
• CVE-2026-67587 HIGH 8.8 UPGRADE Apache Airflow's Task SDK rebuilt a `Callback` object from serialized data by re-running its constructor, whic
• CVE-2026-72526 CRITICAL 9.9 A flaw was found in the multicloud-integrations component
• CVE-2024-3727 HIGH 8.3 A flaw was found in the github.com/containers/image library
• CVE-2026-115414 HIGH 7.8 OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influenc
• CVE-2026-55100 HIGH 8.7 hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API
• CVE-2026-67623 HIGH 8.8 Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arb
• CVE-2026-70340 HIGH 8.1 UPGRADE Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
• CVE-2026-73263 CRITICAL 9.9 Prowler is a cloud security platform
• CVE-2026-73622 HIGH 7.5 UPGRADE GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add()
• CVE-2026-35425 HIGH 8.0 MITIGATE Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a ne
• CVE-2026-47299 HIGH 7.2 UPGRADE Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent all
• CVE-2026-56167 HIGH 8.5 MITIGATE Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over
• CVE-2026-56748 HIGH 8.8 UPGRADE Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a re
• CVE-2026-58076 HIGH 8.8 UPGRADE Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class nam
• CVE-2026-72538 HIGH 8.8 An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve r
• CVE-2026-73623 HIGH 7.5 UPGRADE GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, all
• CVE-2026-75913 CRITICAL 9.3 CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerabil
• CVE-2026-108456 HIGH 7.7 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges ove
• CVE-2026-15996 HIGH 7.5 UPGRADE A denial of service vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated a
• CVE-2026-16492 MEDIUM 5.5 A weakness has been identified in umijs umi up to 4.6.63
• CVE-2026-16756 HIGH 7.5 Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serv
• CVE-2026-18140 HIGH 7.5 UPGRADE Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which
• CVE-2026-52855 CRITICAL 9.9 Wings is the server control plane for Pterodactyl, a free, open-source game server management panel
• CVE-2026-62246 HIGH 8.5 Kamaji is the Hosted Control Plane Manager for Kubernetes
• CVE-2026-62869 HIGH 8.8 MITIGATE Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoo
• CVE-2026-64665 HIGH 8.1 Statamic is a Laravel and Git powered content management system (CMS)
• CVE-2026-65907 CRITICAL 9.1 In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
• CVE-2026-68968 HIGH 7.5 UPGRADE Apache Airflow's Backfill API authorized a request against a Dag id supplied by the caller whenever the `backf
• CVE-2026-71193 CRITICAL 9.6 In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone
• CVE-2026-71195 CRITICAL 9.9 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the call
• CVE-2026-72767 HIGH 8.8 UPGRADE n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability
• CVE-2026-73620 HIGH 8.1 UPGRADE GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create()
• CVE-2026-73624 HIGH 8.1 UPGRADE GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method
• CVE-2026-106765 HIGH 7.5 An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleIma
• CVE-2026-109440 HIGH 8.8 LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers
• CVE-2026-11325 HIGH 8.8 Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived re
• CVE-2026-113788 CRITICAL 9.4 Lagoon is an application delivery platform for Kubernetes
• CVE-2026-16796 HIGH 7.3 Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Pytho
• CVE-2026-18830 HIGH 8.1 Insufficient input validation in Amazon Bedrock AgentCore harness might allow an authenticated remote user to
• CVE-2026-49329 HIGH 7.5 A flaw was found in openshift/oauth-server
• CVE-2026-53942 CRITICAL 9.9 Conda Organization Infrastructure is a centralized location for infrastructure codes
• CVE-2026-60402 CRITICAL 9.9 DOWNGRADE Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kub
• CVE-2026-65906 HIGH 8.8 UPGRADE In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
• CVE-2026-71225 MEDIUM 6.5 MITIGATE DOWNGRADE A flaw was found in libkcapi
• CVE-2022-43760 HIGH 8.4 UPGRADE An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE
• CVE-2026-10090 CRITICAL 9.0 A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat A
• CVE-2026-112407 HIGH 8.8 Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 throu
• CVE-2026-115417 HIGH 7.5 Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in AWS aws-c-mqtt before 0
• CVE-2026-14869 HIGH 8.6 The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the stre
• CVE-2026-16328 HIGH 8.6 In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied,
• CVE-2026-16496 HIGH 8.9 The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP
• CVE-2026-44189 HIGH 7.8 A flaw was found in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider
• CVE-2026-44945 CRITICAL 9.1 A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersona
• CVE-2026-59675 HIGH 7.5 When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enfor
• CVE-2026-65617 HIGH 8.8 UPGRADE A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact c
• CVE-2026-65921 HIGH 8.8 UPGRADE A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be
• CVE-2026-66014 HIGH 8.8 UPGRADE JFrog Artifactory contains an authentication handling weakness in internal request processing that, under spec
• CVE-2026-70431 HIGH 8.8 Jenkins Multijob Plugin 669.v9d96a_d9c71b_0 and earlier provides Groovy scripting features that do not integra
• CVE-2026-106486 HIGH 8.5 UPGRADE UPGRADE Backstage is an open framework for building developer portals
• CVE-2026-114638 HIGH 8.7 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGIN
• CVE-2026-19266 MEDIUM 5.5 A vulnerability was determined in Kirachon context-engine up to 1.9.0
• CVE-2026-42017 HIGH 8.8 UPGRADE An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-priv
• CVE-2026-62200 HIGH 8.8 UPGRADE OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that could allow Git ext t
• CVE-2026-65675 HIGH 7.1 MITIGATE No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a
• CVE-2026-65806 MEDIUM 6.5 UPGRADE Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network
• CVE-2026-65834 MEDIUM 6.8 Capsule is a multi-tenancy and policy-based framework for Kubernetes
• CVE-2026-67322 HIGH 7.5 UPGRADE GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()
• CVE-2026-69106 HIGH 8.8 UPGRADE A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consu
• CVE-2026-70335 HIGH 7.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot a
• CVE-2026-71475 MEDIUM 6.8 DOWNGRADE MITIGATE A flaw was found in insights-client
• CVE-2026-72533 HIGH 8.8 An authentication bypass vulnerability in Portainer CE through 2.44.0 allows authenticated low-privileged user
• CVE-2026-75887 HIGH 7.5 A flaw was found in the OpenShift console
• CVE-2026-16745 HIGH 8.8 A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI)
• CVE-2026-17603 HIGH 8.8 UPGRADE Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set throug
• CVE-2026-18481 HIGH 7.3 Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an au
• CVE-2026-44190 HIGH 7.8 A flaw was found in the Ansible Lightspeed Visual Studio Code extension
• CVE-2026-44191 HIGH 7.8 A flaw was found in the Visual Studio Code Ansible Lightspeed extension
• CVE-2026-48080 HIGH 8.0 OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform
• CVE-2026-49332 HIGH 8.5 A flaw was found in openshift/oauth-proxy
• CVE-2026-50191 HIGH 8.8 4gaBoards is a boards system for realtime project management

FAQ

How do I fix Cloud, containers and DevOps vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Cloud, containers and DevOps being exploited right now?

Yes: 9 Cloud, containers and DevOps CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which Cloud, containers and DevOps CVE should I patch first?

CVE-2026-63077 currently ranks highest (100/100): JetBrains TeamCity Deserialization of Untrusted Data Vulnerability.

Software in this group

People search for: aws, azure, kubernetes, docker, jenkins, terraform, devops.

← Back to latest CVEs