GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: apko, guac, kubevela, nuclei, skaffold, snyk-cli, flux, syft, terragrunt, trufflehog, kaniko, steampipe, trivy, goreleaser, pulumi, tfsec, witness, gitsign, kubescape, bom, act, osv-scanner, argo-events, argo-workflows, nfpm, pulumi-language-java, rancher-fleet,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: redpanda-console, dagger, flux-source-controller, xeol-fips, cg, external-secrets-operator-fips, skaffold, pulumi-language-yaml, cloudbeat-fips, flux-fips, gomplate-fips, mapotf-fips, kubevela-fips, grafana, gitaly, pulumi, gitaly-fips, src-fingerprint, argo-cd,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, docker, docker-cli-buildx, guac, skaffold, trivy, goreleaser, ratify, gitsign, cosign, kubescape, tflint, bom, zot, flux-source-controller, dagger, kyverno-notation-aws, ko, crossplane, gitlab-runner, trivy-operator, gh, spire-server,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: dagger, flux-source-controller, cosign-fips, ko-fips, cg, skaffold, tkn-fips, cloudbeat-fips, kyverno-policy-reporter-plugins-kyverno, spire-server, tflint, buildkitd-fips, slsa-verifier, falcoctl, tflint-fips, ratify-fips, spire-server-fips, buildkitd,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, nuclei, snyk-cli, kubernetes-replicator, rke2-cloud-provider, vault-env, whereabouts, actions-runner-controller, gitness, vault-k8s, kubernetes-csi-external-resizer, kor, crossplane-provider-azure-managedidentity, crane, kuma,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: redpanda-console, dagger, flux-source-controller, xeol-fips, cg, external-secrets-operator-fips, skaffold, pulumi-language-yaml, cloudbeat-fips, flux-fips, gomplate-fips, mapotf-fips, kubevela-fips, grafana, gitaly, pulumi, gitaly-fips, src-fingerprint, argo-cd,...

io.crossplane.compositefunctions:crossplane-function-example (>=1.20-alpha <=2.0.5), io.crossplane.compositefunctions:crossplane-function-springboot-starter (>=1.20-alpha <=2.0.5) +19 more potentially affected by CVE-2026-40969 via org.springframework.grpc:spring-grpc-core (>=1.0.0-RC1 <=1.0.2)

org.springframework.grpc:spring-grpc-core MAVEN version =1.0.0-RC1, =1.20-alpha, =1.20-alpha, =2026.01, =0.8.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0.0, =1.0.0, =1.0.2 - org.springframew...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-solutions, crossplane-provider-aws-appflow, crossplane-provider-azure-notificationhubs, flux-helm-controller, kubevirt-cdi-controller-fips, gitlab-cng, crossplane-provider-aws-sqs, authentik-fips, kubernetes-csi-node-driver-registrar-fips,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-solutions, crossplane-provider-aws-appflow, crossplane-provider-azure-notificationhubs, flux-helm-controller, kubevirt-cdi-controller-fips, gitlab-cng, crossplane-provider-aws-sqs, authentik-fips, kubernetes-csi-node-driver-registrar-fips,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, neuvector-sigstore-interface, docker, docker-cli-buildx, skaffold, trivy, goreleaser, witness, ratify, gitsign, cosign, kubescape, tflint, zot, flux-source-controller, kyverno-notation-aws, ko, crossplane, trivy-operator, gh, spire-server,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, neuvector-sigstore-interface, docker, docker-cli-buildx, skaffold, trivy, goreleaser, witness, ratify, gitsign, cosign, kubescape, tflint, zot, flux-source-controller, kyverno-notation-aws, ko, crossplane, trivy-operator, gh, spire-server,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-storage, nuclei, supercronic, snyk-cli, oras, kubernetes-replicator, esbuild, vault-env, whereabouts, aws-signer-notation-plugin, actions-runner-controller, gitness, vault-k8s, kubernetes-csi-external-resizer, kor,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: envconsul, crossplane-provider-azure-storage, opentofu, migrate, apko, nuclei, atlantis, cue, snyk-cli, terraform-provider-tls, aws-efs-csi-driver, goreleaser, knative-operator, trivy, vault-env, docker-machine-driver-linode, helm-mapkubeapis, gitness,...

CVE-2026-4660 vulnerabilities

Vulnerabilities for packages: grype-fips, terragrunt-fips, task-fips, zot, trivy-operator, kots, crossplane-provider-terraform-fips, k9s, terraform-fips, zarf, zarf-fips, tfsec, xeol-fips, cg, syft-fips, kubescape-server-fips, conftest, chainctl-fips, wolfictl, xeol, syft, cloudbeat-fips,...

GHSA-92MM-2PJQ-R785 vulnerabilities

Vulnerabilities for packages: grype-fips, terragrunt-fips, task-fips, zot, trivy-operator, kots, crossplane-provider-terraform-fips, k9s, terraform-fips, zarf, zarf-fips, tfsec, xeol-fips, cg, syft-fips, kubescape-server-fips, conftest, chainctl-fips, wolfictl, xeol, syft, cloudbeat-fips,...

GHSA-78H2-9FRX-2JM8 vulnerabilities

Vulnerabilities for packages: flux-operator-fips, distribution-fips, temporal, livekit-server, vcluster, xeol-fips, nginx-kubernetes-ingress, kyverno-policy-reporter-plugins-kyverno, flux-kustomize-controller, gitlab-cng, gitaly, authentik-fips, tflint, velero-fips, grpcurl-fips, frankenphp-8.5,...

CLEANSTART-2026-QJ92322 Security fixes for CVE-2025-15558, CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 2.0.2-r0, 2.0.2-r1

Multiple security vulnerabilities affect the crossplane package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NN77774 Security fixes for CVE-2026-33186, ghsa-p77j-4mvh-x3m3 applied in versions: 2.4.0-r0

Multiple security vulnerabilities affect the crossplane-provider-azure package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: dagger, flux-source-controller, xeol-fips, cg, external-secrets-operator-fips, skaffold, pulumi-language-yaml, cloudbeat-fips, flux-fips, gomplate-fips, kubevela-fips, grafana, gitaly, pulumi, chezmoi, gitaly-fips, src-fingerprint, argo-cd, trufflehog-fips, apko,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: dagger, flux-source-controller, xeol-fips, cg, external-secrets-operator-fips, skaffold, pulumi-language-yaml, cloudbeat-fips, flux-fips, gomplate-fips, kubevela-fips, grafana, gitaly, pulumi, chezmoi, gitaly-fips, src-fingerprint, argo-cd, trufflehog-fips, apko,...