GO-2026-5039 vulnerabilities

Vulnerabilities for packages: flux, spark-operator, litefs, kube-fluentd-operator, datadog-agent, kapp-controller, kiali, fuse-overlayfs-snapshotter, sftpgo-plugin-eventstore, vcluster, atlantis, golangci-lint, cert-exporter, node-problem-detector, vertical-pod-autoscaler,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: flux, datadog-agent, scorecard, ko, nfpm, trivy-operator, gh, rootlesskit, atlantis, argo-events, go-discover, kyverno, act, crossplane-provider-aws-sns, policy-controller, spire-server, cosign, crossplane-provider-aws-s3, crossplane-provider-aws-firehose, eksctl,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: nri-postgresql, lazygit, rabbitmq-default-user-credential-updater, litefs, spark-operator, kapp-controller, nri-mongodb, scorecard, fuse-overlayfs-snapshotter, restic, hydra, k8sgateway, thanos-operator, azure-service-operator, kubernetes-dashboard-metrics-scraper,...

Improper Input Validation

Apache Camel AWS SNS component is vulnerable to Improper Input Validation. The vulnerability is due to the absence of an inbound header-filtering rule in Sns2HeaderFilterStrategy, which could theoretically allow externally supplied message attributes to be mapped into Camel control headers;...

CVE-2026-56140

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter...

ROOT-APP-MAVEN-CVE-2026-44308 CVE-2026-44308 in io.root.io.awspring.cloud:spring-cloud-aws-sns - Patched by Root

Root has patched CVE-2026-44308 in the io.root.io.awspring.cloud:spring-cloud-aws-sns package for Root:Maven. Multiple fixed versions available...

Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

CVE-2021-41280

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

Command injection

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280 OS command injection in Sharetribe Go

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280

CVE-2021-41280 affects Sharetribe Go (OS configuration) where an operating system command injection is possible in affected versions that do not configure the secret SNS notification token via the sns_notification_token parameter. The issue is mitigated by upgrading to version 10.2.1, where the p...