GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: telegraf, reports-server, snyk-cli, spire-server, kyverno, backup-restore-operator, flux, prometheus-operator, containerd, kots, zot, aactl, cert-manager, prometheus, kaf, k3d, k3s, cilium, minio, zitadel, terraform, loki, nerdctl, elastic-agent-fips, kine,...

BIT-CERT-MANAGER-2026-62290 cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: crossplane, opentelemetry-operator, argocd-image-updater, hubble-ui, tekton-pipelines, kubescape-operator, cloud-provider-gcp-cloud-controller-manager, flux-notification-controller, tekton-chains, tetragon, cluster-api-helm-controller, cluster-api-gcp-controller, tkn...

CVE-2026-62290 vulnerabilities

Vulnerabilities for packages: cert-manager-csi-driver, cert-manager-istio-csr, cert-manager-webhook-pdns, aws-privateca-issuer, percona-server-mongodb-operator, cert-manager-cmctl, step-issuer, mariadb-operator...

CVE-2026-62290 vulnerabilities

Vulnerabilities for packages: cert-manager-google-cas-issuer, cert-manager-cmctl, gitlab-operator-fips, aws-privateca-issuer-fips, cert-manager-webhook-pdns, cert-manager-webhook-pdns-fips, step-issuer, cert-manager-cmctl-fips, gitlab-operator, athenz-cert-manager-issuer, athenz-csi-driver,...

CLEANSTART-2026-TN63389 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-32952, CVE-2026-33811, CVE-2026-33814, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833, CVE-2026-39834, CVE-2026-39835, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42506, CVE-2026-42508, CVE-2026-46595, CVE-2026-46597, CVE-2026-46598, ghsa-pjcq-xvwq-hhpj applied in versions: 1.20.2-r0

Multiple security vulnerabilities affect the cert-manager package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NM43450 Security fixes for CVE-2026-24051, CVE-2026-29181, CVE-2026-32952, CVE-2026-33186, CVE-2026-34986, CVE-2026-39883, ghsa-78h2-9frx-2jm8, ghsa-9h8m-3fm2-qjrq, ghsa-hfvc-g4fc-pqhx, ghsa-mh2q-q3fh-2475, ghsa-mpwr-8vm7-h73f, ghsa-p77j-4mvh-x3m3, ghsa-pjcq-xvwq-hhpj applied in versions: 1.19.2-r0, 1.19.2-r2

Multiple security vulnerabilities affect the cert-manager package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-HQ95461 Security fixes for CVE-2026-42504 applied in versions: 1.19.4-r4

Security vulnerability affects the cert-manager package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-62290

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...

EUVD-2026-45017

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...

CVE-2026-62290 cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials

cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 until 1.19.6 and 1.20.3, Challenge resources under acme.cert-manager.io can be created directly by namespace...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller, keda, crossplane-provider-aws-sns, dgraph, sealed-secrets, litefs, consul-k8s, promxy, headlamp, newrelic-k8s-metadata-injection, pulumi-language-yaml, k3s, kserve, github-mcp-server, newrelic-infrastructure-agent, hcloud, haproxy-ingres...

PYSEC-2026-1602 OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the certmanager.py. component...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: kubescape, reports-server, fscrypt, snyk-cli, knative-serving-fips, skaffold-fips, backup-restore-operator, prometheus-elasticsearch-exporter, flux-image-automation-controller, frankenphp-8.4, vitess, frankenphp-8.2, kots, cert-manager, gitea, prometheus-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: flux-source-controller, terragrunt, fulcio, crossplane-provider-azure-storage, external-dns, opentelemetry-collector, pulumi-language-yaml, prometheus, k3s, zarf, hcloud, k8sgpt, chisel, step-kms-plugin, steampipe, argo-events, kaf, tflint, containerd, caddy,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: flux-source-controller, terragrunt, crossplane-provider-aws-sns, crossplane-provider-aws-route53, crossplane-provider-aws-lambda, fulcio, crossplane-provider-azure-storage, sealed-secrets, external-dns, terraform-provider-acme, opentelemetry-collector,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: argocd-image-updater, flux-source-controller, aactl, loki, cloud-provider-aws, gitea, nerdctl, external-dns, opentelemetry-collector, zot, mattermost, fscrypt, kubernetes, prometheus, istio, k3s, knative-serving, telegraf, trivy, zarf, cilium-cli, helm, kubescape,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: aactl, loki, cloud-provider-aws, nerdctl, external-dns, podman, opentelemetry-collector, zot, mattermost, fscrypt, kubernetes, prometheus, istio, k3s, knative-serving, telegraf, cilium-cli, helm, kyverno, kine, cilium, kots, rancher, docker-cli-buildx, spire-server,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: flux-source-controller, terragrunt, external-dns, opentelemetry-collector, pulumi-language-yaml, prometheus, k3s, zarf, step-kms-plugin, argo-events, kaf, containerd, caddy, prometheus-operator, cert-manager, step, k9s, step-issuer, argo-cd, pulumi-language-dotnet,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, flux-source-controller, aactl, loki, cloud-provider-aws, gitea, nerdctl, external-dns, docker-machine-driver-harvester, opentelemetry-collector, zot, mattermost, fscrypt, kubernetes, prometheus, istio, k3s, knative-serving, telegraf, trivy, zarf...