Weave

10 CVEs across 7 Weave products. Browse Weave vulnerabilities, severities, and proof-of-concept exploits.

Weave products with known CVEs

ProductCVEs
Weave Gitops3
Gitops Tools2
Cloud Agent1
Gitops Terraform Controller1
Weave1
Weave Desktop1
Weave Net1
Weave CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2024-25545High7.82024-04-12An issue in Weave Weave Desktop v.7.78.10 allows a local attacker to execute arbitrary code via a crafted script to the nwjs framework component.
CVE-2023-34236High8.52023-07-14Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been…
CVE-2022-23509High7.32023-01-09Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a l…
CVE-2022-23508High8.82023-01-09Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability i…
CVE-2022-35976Medium5.22022-08-18The GitOps Tools Extension for VSCode relies on kubeconfigs in order to communicate with Kubernetes clusters. A specially crafted kubeconfig leads to arbitrary…
CVE-2022-35975Critical9.02022-08-18The GitOps Tools Extension for VSCode can make it easier to manage Flux objects. A specially crafted Flux object may allow for remote code execution in the mac…
CVE-2022-31098Critical9.02022-06-27Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in…
CVE-2020-26278Medium5.82021-01-20Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery…
CVE-2020-35464Critical9.82020-12-15Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of the Weave Cloud Ag…
CVE-2020-11091Medium5.82020-06-03In Weave Net before version 2.6.3, an attacker able to run a process as root in a container is able to respond to DNS requests from the host and thereby insert…