PT-2026-32571

Name of the Vulnerable Software and Affected Versions External Secrets Operator versions prior to 2.3.0 Description The v2 template engine in runtime/template/v2/template.go removes env and expandenv from TxtFuncMap but leaves the getHostByName function accessible to user-controlled templates...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, chart-testing, istio, k8sgpt, cilium-cli, envoy-gateway, kube-arangodb, headlamp, flux, helm, helm-mapkubeapis, kuma, linkerd2, helm-docs, helm-operator, tw, k8ssandra-client, trivy-operator, pluto,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, cert-manager-cmctl, chart-testing, istio, k8sgpt, cilium-cli, envoy-gateway, kube-arangodb, headlamp, flux, helm, helm-mapkubeapis, kuma, linkerd2, helm-docs, helm-operator, tw, k8ssandra-client, trivy-operator, pluto,...

GHSA-77V3-R3JW-J2V2 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

CVE-2026-22822 vulnerabilities

Vulnerabilities for packages: external-secrets-operator...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: flux-source-controller, consul-k8s, headlamp-fips, helm-set-status, k8ssandra-client, flux, flux-source-controller-fips, cert-manager-cmctl, cerbos, helm, trivy-operator-fips, zot, chaos-mesh-fips, zarf-fips, tigera-operator-fips, helm-diff, helm-docs,...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: karpenter, snyk-cli, cert-manager, k8s-device-plugin, istio, kine, cilium-cli, flux, prometheus, aws-flb-cloudwatch, gitlab-pages, cloud-provider-aws, helm, hubble, kyverno, external-dns, kubernetes-dashboard, mattermost, newrelic-fluent-bit-output, coredns, nerdctl,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: karpenter, stakater-reloader, flux-helm-controller, grafana-rollout-operator, aws-privateca-issuer, omnibump, flux-image-reflector-controller, actions-runner-controller, github-mcp-server, envoy-ratelimit, flux, smarter-device-manager, oras, hubble,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: knative-client, omnibump, cilium-cli, nri-postgresql, crossplane, dockerize, incert, timestamp-authority, kafkaexporter, wave, step, nri-kafka, dfc, trivy-operator, act, aws-s3-controller, memcached-exporter, otel-cli, spegel, vault-env, rancher-webhook, gostatsd,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: knative-client, omnibump, cilium-cli, nri-postgresql, crossplane, dockerize, incert, timestamp-authority, kafkaexporter, wave, step, nri-kafka, dfc, trivy-operator, act, aws-s3-controller, memcached-exporter, otel-cli, spegel, vault-env, rancher-webhook, gostatsd,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: syft, knative-client, flux-helm-controller, k8ssandra-operator, kyverno-policy-reporter-ui, docker-cli-buildx, terraform-provider-azapi, kubernetes-csi-node-driver-registrar, aws-efs-csi-driver, cilium-cli, mc, certificate-transparency, crossplane, flux,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: syft, knative-client, flux-helm-controller, k8ssandra-operator, kyverno-policy-reporter-ui, docker-cli-buildx, terraform-provider-azapi, kubernetes-csi-node-driver-registrar, aws-efs-csi-driver, cilium-cli, mc, certificate-transparency, crossplane, flux,...

GHSA-JRG3-GFJW-HM96 vulnerabilities

Vulnerabilities for packages: knative-client, omnibump, cilium-cli, nri-postgresql, crossplane, dockerize, incert, timestamp-authority, kafkaexporter, wave, step, nri-kafka, dfc, trivy-operator, act, aws-s3-controller, memcached-exporter, otel-cli, spegel, vault-env, rancher-webhook, gostatsd,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: flux-source-controller, flux-image-reflector-controller, karma-fips, oras-fips, sftpgo-plugin-eventsearch, nvidia-nsight-compute-13.4, flux-notification-controller, nodetaint-fips, dkron, grafana-rollout-operator, kyverno-policy-reporter-plugins-kyverno-fips,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: flux-source-controller, flux-image-reflector-controller, karma-fips, oras-fips, sftpgo-plugin-eventsearch, nvidia-nsight-compute-13.4, flux-notification-controller, nodetaint-fips, dkron, grafana-rollout-operator, kyverno-policy-reporter-plugins-kyverno-fips,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: atlantis, rancher-helm, aws-node-termination-handler, karma-fips, minio-object-browser-fips, envconsul, commercial-grafana, kube-arangodb-fips, knative-kafka-broker-fips, knative-serving-fips, mc-fips, wal-g, tigera-operator, cloudbeat, cloudbeat-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: atlantis, rancher-helm, envconsul, commercial-grafana, kube-arangodb-fips, knative-serving-fips, wal-g, tigera-operator, cloudbeat, cloudbeat-fips, rclone-fips, prometheus-mongodb-exporter, conftest-fips, image-factory, kpt, rancher-machine, caddy, knative-operator,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: atlantis, rancher-helm, envconsul, commercial-grafana, kube-arangodb-fips, knative-serving-fips, wal-g, tigera-operator, cloudbeat, cloudbeat-fips, rclone-fips, prometheus-mongodb-exporter, conftest-fips, image-factory, kpt, rancher-machine, caddy, knative-operator,...