GO-2026-6225 vulnerabilities

Vulnerabilities for packages: knative-serving-fips, kubeflow-katib, knative-serving, crossplane, crossplane-fips, tekton-pipelines-fips, tekton-pipelines...

GHSA-MF7Q-R4RV-JV94 vulnerabilities

Vulnerabilities for packages: crossplane-function-auto-ready-fips, crossplane-function-auto-ready...

cve-2026-42945-scan

cve-2026-42945-scan Scanner statico per file di configurazione NGINX che rileva il pattern rewrite/set associato a CVE-2026-42945. Lo scanner analizza le configurazioni NGINX con crossplane, percorre i blocchi location, e stampa ogni posizione che appare affetta in questo formato: root@kitploit:...

GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-redshift, crossplane-provider-aws-efs, crossplane-provider-aws-sfn-fips, crossplane-provider-aws-ecrpublic, crossplane-provider-aws-budgets-fips, crossplane-provider-aws-sns-fips, crossplane-provider-aws-organizations-fips,...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-redshift, crossplane-provider-aws-efs, crossplane-provider-aws-sfn-fips, crossplane-provider-aws-ecrpublic, crossplane-provider-aws-budgets-fips, crossplane-provider-aws-sns-fips, crossplane-provider-aws-organizations-fips,...

GO-2026-6162 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, ko, kubescape-server, policy-controller, kyverno, kyverno-notation-aws-fips, trivy-operator, docker-fips, falcoctl, kubescape, goreleaser, neuvector-sigstore-interface-fips, tkn-fips, zot, skaffold-fips, cloudbeat-fips, crossplane, kyverno-fips,...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-dynamodb, hugo, crossplane-provider-aws-memorydb, crossplane-provider-aws-cloudfront, crossplane-provider-azure-sql, crossplane-provider-aws-firehose, crossplane-provider-aws-elasticache, kubevela, crossplane-provider-keycloak, dataplaneapi,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cluster-api-ipam-provider-in-cluster, spicedb-operator, metrics-server, spicedb, tekton-chains, node-feature-discovery, rancher-agent, k3s, kube-metrics-adapter, kube-rbac-proxy, cass-operator, rancher, openbao, yunikorn-k8shim, kubernetes-csi-external-resizer,...

GO-2026-6162 vulnerabilities

Vulnerabilities for packages: goreleaser, tkn, tekton-chains, aactl, trivy-operator, spire-server, kyverno-notation-aws, flux-source-controller, ko, skaffold, policy-controller, kubescape, trivy, zarf, falcoctl, neuvector-sigstore-interface, crossplane, zot, kyverno...

CVE-2026-56858 vulnerabilities

Vulnerabilities for packages: openfga, spiffe-helper-fips, crossplane-provider-aws-redshift, crossplane-provider-aws-efs, crossplane-provider-aws-sfn-fips, k8s-device-plugin, karpenter-fips, kiali-fips, certificate-transparency, kuma, envconsul, longhorn-instance-manager-fips, emqx-exporter,...

GO-2026-5709 vulnerabilities

Vulnerabilities for packages: crossplane, crossplane-fips...

GO-2026-6016 vulnerabilities

Vulnerabilities for packages: crossplane, crossplane-fips...

GO-2026-5320 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-redshift, crossplane-provider-aws-efs, crossplane-provider-aws-sfn-fips, crossplane-provider-aws-ecrpublic, listmonk, crossplane-provider-aws-organizations-fips, crossplane-provider-aws-ssoadmin, crossplane-provider-aws-apigatewayv2-fips,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: headlamp, chartmuseum-fips, manifest-tool, xeol-fips, helm-exporter-fips, argocd-image-updater-fips, cluster-api-helm-controller-fips, cloudbeat, kgateway-fips, linkerd2, helm-operator, k8ssandra-client, chartmuseum, gogatekeeper, cert-manager-cmctl, redpanda-operato...

GO-2026-5880 vulnerabilities

Vulnerabilities for packages: kots, cilium-cli, consul-k8s, ratify-fips, headlamp, kubescape-server, oras, kgateway, kyverno, rancher, rancher-agent, consul-k8s-fips, trivy-operator, falcoctl, headlamp-fips, chartmuseum-fips, tigera-operator, zot, cloudbeat-fips, drone-fips, crossplane,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: kots, gitea, snyk-cli, wolfictl, pulumi-language-yaml, timoni, trivy, kyverno, task, go-licenses, kaniko-fips, pulumi, kubescape, skaffold, goreleaser, flux-image-automation-controller-fips, argo-workflows, nemo, gitea-fips, scorecard, zot, argo-events-fips,...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, crossplane-provider-aws-cognitoidentity, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-ecr-fips, crossplane-provider-aws-efs, crossplane-provider-aws-kinesis-fips, crossplane-provider-aws-eks-fips,...

GO-2026-5764 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, amazon-ecs-agent, crossplane-provider-aws-cognitoidentity, crossplane-provider-aws-cloudwatchlogs, rekor-fips, crossplane-provider-aws-ecr-fips, crossplane-provider-aws-efs, juicefs, task, aws-network-policy-agent-fips,...

GO-2026-5336 vulnerabilities

Vulnerabilities for packages: grafana-fips, coder, skaffold-fips, xeol-fips, argo-events-fips, tfsec, osv-scanner, argocd-image-updater-fips, nuclei, gitaly, pulumi-language-dotnet, cloudbeat, gomplate, gitlab-rails-ce, gitsign, chainloop-cli, src-fingerprint-fips, apko, act, trivy-fips, grype,...