GO-2026-6094 vulnerabilities

Vulnerabilities for packages: kube-rbac-proxy, k3s, kubernetes-csi-external-snapshotter, rancher, cluster-api, cert-manager-webhook-pdns, cloud-provider-gcp-cloud-controller-manager, cilium, kyverno, cert-manager-istio-csr, opentelemetry-operator, grafana, node-feature-discovery,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: cert-manager-fips, aws-ebs-csi-driver, flux-notification-controller, aws-load-balancer-controller-fips, nova-fips, grafana-operator, go, omnictl-multiarch, aws-ebs-csi-driver-fips, flux-fips, victorialogs-fips, victoriametrics-fips, flux-source-watcher, flux-operator...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: hcloud, spire-server, k3s, neuvector-sigstore-interface, crossplane-provider-keycloak, kyverno, terraform-provider-azurerm, prometheus, kubescape, crossplane-provider-aws-sns, zarf, apko, docker-compose, slsa-verifier, docker, docker-cli-buildx,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: dkron, k3s, spire-server, conjur-cli, neuvector-sigstore-interface, aws-eks-pod-identity-agent, vale, golangci-lint, timoni, aws-flb-cloudwatch, litefs, vault-secrets-webhook, apache-exporter, runc, dbmate, kubernetes-csi-livenessprobe, dynamic-localpv-provisioner,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: spire-server, argo-events, guac, k3s, opentelemetry-collector-contrib, neuvector-sigstore-interface, crossplane-provider-family-azure, kubevela, crossplane-provider-azure-sql, gh, crossplane-provider-azure-authorization, terraform-provider-azurerm, cosign, kubescape,...

CLEANSTART-2026-PM77605 Security fixes in flux-notification-controller-fips 1.9.2-r0

Package flux-notification-controller-fips version 1.9.2-r0 fixes 6 vulnerabilities: CVE-2023-3955, CVE-2023-3676, CVE-2019-11250, ghsa-gcjh-h69q-9w9g, ghsa-259r-337f-4rfw...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, argo-events, argocd-image-updater-fips, gitlab-rails-ce, cloudbeat-fips, src-fingerprint-fips, argo-cd-fips, kubevela-fips, pulumi-language-yaml, packer-fips, flux-operator, rancher-fleet, gitea, xeol-fips, chainloop-cli-fips, google-osconfig-agen...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, argo-events, argocd-image-updater-fips, gitlab-rails-ce, cloudbeat-fips, src-fingerprint-fips, argo-cd-fips, kubevela-fips, pulumi-language-yaml, packer-fips, flux-operator, rancher-fleet, gitea, xeol-fips, chainloop-cli-fips, google-osconfig-agen...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, argo-events, argocd-image-updater-fips, gitlab-rails-ce, cloudbeat-fips, src-fingerprint-fips, argo-cd-fips, kubevela-fips, pulumi-language-yaml, packer-fips, flux-operator, rancher-fleet, gitea, xeol-fips, chainloop-cli-fips, google-osconfig-agen...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, argo-events, argocd-image-updater-fips, gitlab-rails-ce, cloudbeat-fips, src-fingerprint-fips, argo-cd-fips, kubevela-fips, pulumi-language-yaml, packer-fips, flux-operator, rancher-fleet, gitea, xeol-fips, chainloop-cli-fips, google-osconfig-agen...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: argo-events, guac, act, argo-workflows, kubevela, kyverno, tfsec, kubescape, gomplate, src-fingerprint, gitaly, grype, argo-cd, pulumi-language-java, kots, cerbos, goreleaser, gitlab-runner, flux-image-automation-controller, external-secrets-operator, trivy, dagger,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: argo-events, guac, act, argo-workflows, kubevela, kyverno, tfsec, kubescape, gomplate, src-fingerprint, gitaly, grype, argo-cd, pulumi-language-java, kots, cerbos, goreleaser, gitlab-runner, flux-image-automation-controller, external-secrets-operator, trivy, dagger,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: argo-events, guac, act, argo-workflows, kubevela, kyverno, tfsec, kubescape, gomplate, src-fingerprint, gitaly, grype, argo-cd, pulumi-language-java, kots, cerbos, goreleaser, gitlab-runner, flux-image-automation-controller, external-secrets-operator, trivy, dagger,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: argo-events, guac, act, argo-workflows, kubevela, kyverno, tfsec, kubescape, gomplate, src-fingerprint, gitaly, grype, argo-cd, pulumi-language-java, kots, cerbos, goreleaser, gitlab-runner, flux-image-automation-controller, external-secrets-operator, trivy, dagger,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: hcloud, spire-server, k3s, neuvector-sigstore-interface, crossplane-provider-keycloak, kyverno, terraform-provider-azurerm, prometheus, kubescape, crossplane-provider-aws-sns, zarf, apko, docker-compose, slsa-verifier, docker, docker-cli-buildx,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: hcloud, spire-server, k3s, neuvector-sigstore-interface, kyverno, terraform-provider-azurerm, prometheus, kubescape, zarf, apko, slsa-verifier, docker, docker-cli-buildx, external-secrets-operator, trivy, cluster-api-azure-controller, containerd, pulumi, mods,...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: dkron, k3s, spire-server, argo-workflows, coredns, neuvector-sigstore-interface, newrelic-infrastructure-agent, cluster-api, crossplane-provider-keycloak, cloud-provider-gcp-cloud-controller-manager, kyverno, node-feature-discovery, dbmate,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: dkron, k3s, spire-server, argo-workflows, coredns, neuvector-sigstore-interface, newrelic-infrastructure-agent, cluster-api, crossplane-provider-keycloak, cloud-provider-gcp-cloud-controller-manager, kyverno, node-feature-discovery, dbmate,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...