CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, rabbitmq-cluster-operator, crossplane-provider-aws-fis-fips, contour-fips, crossplane-provider-kubernetes, crossplane-provider-aws-inspector, seaweedfs-operator-fips, rollouts-plugin-trafficrouter-gatewayapi, apko,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: ratify-fips, portieris-fips, rabbitmq-cluster-operator, crossplane-provider-aws-fis-fips, contour-fips, crossplane-provider-kubernetes, crossplane-provider-aws-inspector, seaweedfs-operator-fips, rollouts-plugin-trafficrouter-gatewayapi, apko,...

GO-2026-6610 vulnerabilities

Vulnerabilities for packages: nri-mssql, cosign, crossplane-provider-aws-sns, crossplane-provider-aws-kinesis, cloud-provider-vsphere, crossplane-provider-sql, metrics-agent, step-ca, kpt, authservice, knative-client, lvm-driver, newrelic-nri-kube-events, kubevela, pinact, external-dns, stern,...

CVE-2026-78660 vulnerabilities

Vulnerabilities for packages: nri-mssql, cosign, crossplane-provider-aws-sns, crossplane-provider-aws-kinesis, cloud-provider-vsphere, crossplane-provider-sql, metrics-agent, step-ca, kpt, authservice, knative-client, lvm-driver, newrelic-nri-kube-events, kubevela, pinact, external-dns, stern,...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: nri-mssql, cosign, crossplane-provider-aws-sns, crossplane-provider-aws-kinesis, cloud-provider-vsphere, crossplane-provider-sql, metrics-agent, skopeo, step-ca, kpt, authservice, knative-client, lvm-driver, newrelic-nri-kube-events, kubevela, pinact, external-dns,...

CVE-2026-97032 vulnerabilities

Vulnerabilities for packages: nri-mssql, cosign, crossplane-provider-aws-sns, crossplane-provider-aws-kinesis, cloud-provider-vsphere, crossplane-provider-sql, metrics-agent, skopeo, step-ca, kpt, authservice, knative-client, lvm-driver, newrelic-nri-kube-events, kubevela, pinact, external-dns,...

CVE-2026-105163

A flaw was found in crossplane-runtime. A malicious container registry can bypass package signature verification when packages are installed using tag references instead of fixed content digests. Because the package manager resolves the image tag separately during verification and retrieval, an...

EUVD-2026-92128

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163

A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in crossplane-runtime up to versions 2.2.2 and 2.3.2 . The flaw specifically affects the Get function within the pkg/xpkg/client.go file of the ImageConfig component. This issue may be exploited via a remote attack vector. T...

CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163 crossplane crossplane-runtime ImageConfig client.go Get toctou

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

CVE-2026-105163: Time-of-check Time-of-use (TOCTOU) Race Condition

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

PT-2026-104649

A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to versio...

GO-2026-6597 vulnerabilities

Vulnerabilities for packages: nerdctl, cloudbeat, zarf-fips, gitlab-rails-ce-fips, kubescape, gitlab-rails-ce, kubevela, chaos-mesh-fips, tracee, docker-compose, harvester-fips, kubevela-fips, consul-k8s, grype-fips, grype, trivy-operator-fips, spegel-fips, rancher-agent, envoy-gateway-fips,...

CLEANSTART-2026-MV16544 Security fix for CVE-2026-46597 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300066.1-r1, apko 1.2.13-r0, apko 1.2.2-r2, argo-cd 3.3.5-r1, argo-cd-fips 3.1.14-r2, argo-workflows 4.0.5-r0, authservice 1.1.5-r1, authservice 1.1.6-r1, cadvisor 0.55.1-r1, cadvisor 0.57.0-r0, cadvisor-fips 0.55.1-r0, calico 3.30.7-r2, cert-manager 1.17.4-r2, cert-manager 1.18.6-r1, cert-manager 1.20.0-r0, cert-manager 1.20.2-r0, cert-manager-webhook-pdns-fips 2.5.5-r1, cfssl 1.5.0-r1, cluster-autoscaler 1.35.2-r2, consul 2.0.1-r0, cortex 1.21.0-r2, cosign 3.0.6-r1, crossplane-provider-sql-fips 0.15.0-r3, dynatrace-operator 1.6.3-r1, elastic-beats 8.19.15-r5, elastic-beats 9.2.8-r2, elastic-beats-fips 9.2.8-r0, external-secrets-fips 0.17.0-r2, external-secrets-operator 2.5.0-r1, flux-image-automation-controller 1.2.1-r1, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r1, fulcio-fips 1.7.1-r3, gostatsd 28.3.0-r2, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, haproxy-ingress 0.14.12-r1, helm 4.0.5-r2, helm-operator 1.42.2-r0, istio 1.28.5-r3, istio 1.29.2-r1, istio-fips 1.26.8-r4, istio-fips 1.27.9-r2, istio-fips 1.30.0-r1, kube-rbac-proxy 0.20.2-r2, kube-rbac-proxy 0.21.2-r0, kube-rbac-proxy-fips 0.20.2-r2, kube-state-metrics 2.10.1-r2, kube-state-metrics-fips 2.18.0-r1, kube-vip 1.1.0-r1, kubernetes 1.36.1-r0, kubernetes-csi-external-provisioner-fips 6.1.0-r4, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-csi-external-resizer-fips 2.1.0-r1, kubernetes-csi-external-snapshotter-fips 8.4.0-r4, kubernetes-event-exporter 1.7-r1, kubernetes-event-exporter-fips 1.7-r0, local-static-provisioner 2.8.0-r2, melange 0.50.0-r1, melange 0.56.1-r1, memcached-exporter 0.16.0-r0, minio-client 0.20250721.052808-r1, mongodb 7.0.32-r1, mongodb 8.0.20-r1, mongodb 8.0.21-r1, mongodb 8.2.6-r1, mongodb 8.3.2-r1, ollama 0.20.3-r2, ollama 0.31.2-r2, ollama 0.32.11-r2, ollama-fips 0.32.11-r2, opa 1.17.0-r1, percona-server-mongodb-operator 1.22.0-r1, percona-server-mongodb-operator 1.23.0-r0, policy-controller-fips 0.15.1-r1, postgres-operator 1.12.2-r2, postgres-operator 1.15.1-r1, prometheus 3.11.2-r0, prometheus 3.5.2-r1, prometheus-alertmanager 0.32.0-r1, prometheus-blackbox-exporter 0.28.0-r2, prometheus-mysqld-exporter 0.15.0-r2, prometheus-node-exporter-fips 1.11.1-r1, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.11.3-r1, prometheus-pushgateway 1.8.0-r1, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r1, prometheus-pushgateway-fips 1.8.0-r2, prometheus-redis-exporter-fips 1.84.0-r0, prometheus-redis-exporter-fips 1.87.0-r3, promxy-fips 0.0.93-r1, pulumi-kubernetes-operator 2.7.0-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, rancher-fleet-agent 0.12.17-r3, rancher-fleet-agent 0.13.13-r1, rancher-fleet-agent 0.14.10-r1, rancher-fleet-agent 0.14.8-r3, rancher-fleet-agent 0.15.4-r3, rancher-fleet-agent 0.15.6-r0, rancher-fleet-agent 0.16.1-r1, rclone 1.69.0-r3, restic-fips 0.18.1-r7, rundeck 6.0.0-r0, sealed-secrets 0.34.0-r0, sealed-secrets 0.35.0-r4, sealed-secrets 0.36.6-r1, secrets-store-csi-driver-provider-gcp 1.15.0-r1, secrets-store-csi-driver-provider-gcp 1.17.0-r2, spire-server 1.13.5-r1, spire-server 1.14.5-r1, spire-server-fips 1.14.5-r1, step-ca-fips 0.30.2-r1, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, syft 1.45.0-r2, tempo 2.10.4-r1, temporal 1.5.1-r0, temporal-server 1.31.0.153.1-r0, temporal-ui-server-fips 2.51.1-r1, terraform 1.14.8-r2, tigera-operator 1.42.0-r0, tigera-operator-fips 1.37.2-r4, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.45.0-r1, tkn-fips 0.44.2-r0, trust-manager-fips 0.20.3-r2, trust-manager-fips 0.21.1-r2, vault 1.20.4-r5, vault 1.21.4-r5, vault 2.0.0-r1, vault-k8s 1.7.4-r0, velero 1.18.1-r0, velero-fips 1.18.2-r6, weaviate 1.37.4-r1, weaviate 1.37.6-r1, weaviate-fips 1.36.17-r0, weaviate-fips 1.37.9-r0, weaviate-fips 1.38.1-r0

CVE-2026-46597 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IY00574 Security fix for GHSA-jpcw-4wr7-c3vq applied in: crossplane-provider-keycloak-fips 2.21.1-r1, grafana 12.3.10-r1, grafana 12.3.8-r2, grafana 12.4.5-r2, grafana 12.4.6-r0, grafana 12.4.7-r1, grafana 13.0.5-r1

GHSA-jpcw-4wr7-c3vq affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QG09964 Security fix for CVE-2026-5160 applied in: crossplane-provider-keycloak 2.22.1-r2, pulumi 3.248.0-r0

CVE-2026-5160 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: cosign, crossplane-provider-aws-sns, crossplane-provider-aws-kinesis, cloud-provider-vsphere, crossplane-provider-sql, skopeo, rekor, step-ca, authservice, lvm-driver, kubevela, external-dns, terraform-provider-kubernetes, flux-notification-controller, juicefs,...