GO-2026-5268 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GO-2026-5575 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws...

GO-2025-3381 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, flux-source-controller, flux...

GO-2025-3660 vulnerabilities

Vulnerabilities for packages: witness, policy-controller, conftest, kyverno-notation-aws, kots, cosign, tfsec, trivy, spire-server...

GO-2026-4377 vulnerabilities

Vulnerabilities for packages: tflint, policy-controller, cosign, goreleaser, trivy, spire-server, witness, tekton-chains, zot, gh, teleport, flux-source-controller, kyverno-notation-aws, zarf, trivy-operator, skaffold, neuvector-sigstore-interface, sigstore-scaffolding, kubescape, falcoctl, ko,...

GO-2026-5694 vulnerabilities

Vulnerabilities for packages: policy-controller, kyverno-notation-aws, kubescape, kyverno, zot, teleport, ratify, slsa-verifier, trivy, trivy-operator, aactl, crossplane...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: flux-source-controller, skopeo, witness, kyverno-notation-aws, gitsign, kots, kubescape, kyverno, tekton-chains, zarf, ratify, podman, falcoctl, undock, slsa-verifier, falco-no-driver, aactl, buildah...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: tflint, policy-controller, kyverno, ratify, goreleaser, slsa-verifier, crossplane, spire-server, tekton-chains, teleport, kyverno-notation-aws, zarf, trivy-operator, aactl, neuvector-sigstore-interface, kubescape, falcoctl, ko, gitsign, tkn...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: flux-source-controller, policy-controller, witness, kyverno-notation-aws, gitsign, zot, teleport, ratify, falcoctl, goreleaser, aactl, tkn...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: authservice, kubernetes-dns-node-cache, juicefs, policy-controller, opentofu, eksctl, tofu-controller, cluster-api-ipam-provider-in-cluster, kor, kuma, ratify, s5cmd, goreleaser, lazygit, docker-credential-gcr, kapp, nerdctl, sriov-network-device-plugin,...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: tflint, policy-controller, ratify, cosign, goreleaser, spire-server, witness, docker-cli-buildx, tekton-chains, zot, gh, teleport, flux-source-controller, kyverno-notation-aws, zarf, aactl, skaffold, neuvector-sigstore-interface, sigstore-scaffolding, kubescape,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: tflint, policy-controller, gitsign, kyverno, ratify, cosign, goreleaser, slsa-verifier, trivy, crossplane, spire-server, witness, tekton-chains, zot, gh, teleport, flux-source-controller, kyverno-notation-aws, zarf, trivy-operator, aactl, skaffold,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: tflint, policy-controller, rekor, ratify, cosign, goreleaser, slsa-verifier, trivy, spire-server, witness, tekton-chains, zot, gh, teleport, flux-source-controller, kyverno-notation-aws, zarf, trivy-operator, aactl, skaffold, neuvector-sigstore-interface,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: tflint, opentofu, eksctl, kor, ratify, kpt, docker-credential-gcr, kapp, aws-otel-collector, polaris, nats-server-config-reloader, nri-memcached, guac, helm-operator, nri-consul, kube-logging-operator, prometheus, libnvidia-container, cis-operator,...

CVE-2026-72819: Improper Control of Generation of Code

Grav CMS before 2.0.13 contains a remote code execution vulnerability in the Flex Objects plugin settings validation that allows authenticated users to execute arbitrary code by uploading a ZIP file containing PHP code. Attackers can bypass routine name validation by using array notation instead ...

CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

CVE-2022-4993 HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template

HTML::FormHandler versions before 0.410000 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error message text built from request data as a Locale::Maketext bracket notation template. adderror hands its first argument to the language...

AZL-95798 CVE-2026-53793 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-72749

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

EUVD-2026-56139

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...