GO-2026-5039 vulnerabilities

Vulnerabilities for packages: temporal-ui-server, flux, hubble, kube-state-metrics, flux-image-reflector-controller, hubble-ui, crossplane-provider-aws-ec2, containerd, gke-gcloud-auth-plugin, kubernetes-csi-livenessprobe, cluster-proportional-autoscaler, kuma, newrelic-nri-statsd,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: flux, crossplane-provider-aws-ec2, containerd, kargo, gptscript, crossplane-provider-azure-managedidentity, rancher, splunk-otel-collector, gitea, pulumi-kubernetes-operator, crossplane-provider-family-azure, crossplane-provider-aws-cloudformation, melange, cosign,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: ferretdb, temporal-ui-server, hubble, esbuild, kubernetes-csi-livenessprobe, cfssl, crossplane-provider-aws-ec2, hubble-ui, gke-gcloud-auth-plugin, kube-vip-cloud-provider, ratify, kuma, gptscript, newrelic-nri-statsd, kube-logging-operator, harbor-registry, gitness,...

CVE-2026-56140

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter...

Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

CVE-2021-41280

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

Command injection

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280 OS command injection in Sharetribe Go

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280

CVE-2021-41280 affects Sharetribe Go (OS configuration) where an operating system command injection is possible in affected versions that do not configure the secret SNS notification token via the sns_notification_token parameter. The issue is mitigated by upgrading to version 10.2.1, where the p...