CVE-2026-49834 vulnerabilities

Vulnerabilities for packages: gitsign, ratify, kyverno-notation-aws, falcoctl, tkn, crossplane, kyverno, aactl, tekton-chains, tflint, zarf, kubescape, policy-controller, neuvector-sigstore-interface, trivy, trivy-operator...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, contour-fips, crossplane-provider-aws-inspector, seaweedfs-operator-fips, apko, rabbitmq-cluster-operator-fips, kubernetes-csi-external-snapshotter-fips, helm-diff, kyverno-policy-reporter-plugins-kyverno, traefik, cert-manager-cmctl,...

GHSA-FF52-PH69-CF7X vulnerabilities

Vulnerabilities for packages: cloud-provider-azure, sqlexporter, k8ssandra-client, azuredisk-csi, local-static-provisioner, fuse-overlayfs-snapshotter, guac, flux, govulncheck, crossplane-provider-aws-rds, x509-certificate-exporter, haproxy-ingress, datadog-agent, terraform, tfsec,...

CVE-2026-42505 vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, contour-fips, crossplane-provider-aws-inspector, seaweedfs-operator-fips, apko, rabbitmq-cluster-operator-fips, kubernetes-csi-external-snapshotter-fips, helm-diff, kyverno-policy-reporter-plugins-kyverno, traefik, cert-manager-cmctl,...

CVE-2026-49835 vulnerabilities

Vulnerabilities for packages: gitsign, ratify, kyverno-notation-aws, falcoctl, tkn, crossplane, kyverno, aactl, tekton-chains, tflint, zarf, kubescape, spire-server, policy-controller, neuvector-sigstore-interface, trivy, goreleaser, trivy-operator...

GHSA-9C54-X2G4-V92J vulnerabilities

Vulnerabilities for packages: gitsign, ratify, kyverno-notation-aws, falcoctl, tkn, crossplane, kyverno, aactl, tekton-chains, tflint, zarf, kubescape, spire-server, policy-controller, neuvector-sigstore-interface, trivy, goreleaser, trivy-operator...

GHSA-9C54-X2G4-V92J vulnerabilities

Vulnerabilities for packages: cloudbeat, image-factory, aactl, zarf-fips, neuvector-sigstore-interface-fips, kubescape, ratify-fips, kubescape-server, kyverno, trivy-operator, teleport, cloudbeat-fips, tekton-chains, kubescape-server-fips, chainctl-fips, kyverno-fips, falcoctl, trivy, tbot,...

CVE-2026-49835 vulnerabilities

Vulnerabilities for packages: cloudbeat, image-factory, aactl, zarf-fips, neuvector-sigstore-interface-fips, kubescape, ratify-fips, kubescape-server, kyverno, trivy-operator, teleport, cloudbeat-fips, tekton-chains, kubescape-server-fips, chainctl-fips, kyverno-fips, falcoctl, trivy, tbot,...

GHSA-MPWR-8VM7-H73F vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-servicebus, cert-manager, crossplane-provider-azure-managedidentity, crossplane-provider-azure-servicelinker, splunk-otel-collector, external-secrets-operator-fips, crossplane-provider-azure-network, crossplane-provider-azure-orbital,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-organizations, cloudbeat, zarf-fips, kubescape, glab, crossplane-provider-aws-scheduler, crossplane-provider-aws-cloudfront-fips, apko, slsa-verifier, kyverno-policy-reporter-plugins-kyverno, traefik, crossplane-provider-aws-kendra-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: nerdctl, cloudbeat, zarf-fips, terraform-provider-azurerm, gitlab-rails-ce-fips, kubescape, gitlab-rails-ce, glab, step-ca-fips, crossplane-aws-provider-fips, crossplane-provider-azure-streamanalytics, flux-notification-controller, kyverno, mattermost-fips, nuclei,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: nerdctl, cloudbeat, zarf-fips, terraform-provider-azurerm, gitlab-rails-ce-fips, kubescape, gitlab-rails-ce, glab, step-ca-fips, crossplane-aws-provider-fips, crossplane-provider-azure-streamanalytics, flux-notification-controller, kyverno, mattermost-fips, nuclei,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-organizations, cloudbeat, zarf-fips, kubescape, glab, crossplane-provider-aws-scheduler, crossplane-provider-aws-cloudfront-fips, apko, slsa-verifier, kyverno-policy-reporter-plugins-kyverno, traefik, crossplane-provider-aws-kendra-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: nuclei, steampipe, guac, teleport, flux, grype, datadog-agent, nerdctl, skaffold, prometheus, dagger, kargo, minio, crossplane-provider-family-azure, kyverno, apko, pulumi-language-dotnet, kine, cilium-cli, ko, gomplate, zot, crossplane-provider-azure-managedidentity...

GO-2026-5709 Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane...

GHSA-WFQX-GJRF-G28R vulnerabilities

Vulnerabilities for packages: crossplane, crossplane-fips...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: cloudbeat, image-factory, k6-operator-fips, net-kourier-fips, ory-kratos, zarf-fips, cert-manager-csi-driver-fips, kubescape, ratify-fips, crossplane-provider-aws-scheduler, fluent-operator, kubernetes-csi-driver-nfs-fips, chaos-mesh-fips, rancher-support-bundle-kit,...

GHSA-WFQX-GJRF-G28R vulnerabilities

Vulnerabilities for packages: crossplane...

Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

GHSA-WFQX-GJRF-G28R Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...