GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, conftest, harbor-scanner-trivy, cert-exporter, crossplane-provider-aws-cloudformation, trino, crossplane-provider-aws-sqs, vault-k8s, zarf, crossplane, istio, kubeflow-pipelines, nri-couchbase, newrelic-nri-statsd,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, prometheus-operator, crossplane-provider-aws-cloudformation, crossplane-provider-aws-sqs, zarf, istio, pulumi-kubernetes-operator, telegraf, hcloud, cosign, rootlesskit, kubernetes-dashboard, flux-notification-controller, k3...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: conftest, crossplane-provider-aws-cloudformation, pvc-autoresizer, postgres-operator, restic, blobfuse2, s5cmd, vault-k8s, kubeflow-pipelines, nri-couchbase, runc, newrelic-nri-statsd, telegraf, custom-pod-autoscaler, cosign, lvm-driver, rancher-telemetry,...

CVE-2026-56140

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter...

Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

CVE-2021-41280

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

Command injection

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280 OS command injection in Sharetribe Go

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280

CVE-2021-41280 affects Sharetribe Go (OS configuration) where an operating system command injection is possible in affected versions that do not configure the secret SNS notification token via the sns_notification_token parameter. The issue is mitigated by upgrading to version 10.2.1, where the p...