36 matches found
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: opentelemetry-operator, rke2-cloud-provider, cluster-api-helm-controller, vcluster, kyverno-notation-aws, tetragon, cluster-api-gcp-controller, metallb, yunikorn-k8shim, kyverno, flux-notification-controller, cert-manager-istio-csr, helm-operator, kube-rbac-proxy,...
GO-2026-4600 vulnerabilities
Vulnerabilities for packages: dkron, victoriametrics, aws-load-balancer-controller-fips, victoriametrics-fips, nova, cluster-autoscaler-fips, podinfo, librechat, omnictl-multiarch, steampipe, grafana-operator, gotenberg, metacontroller, aws-ebs-csi-driver, victoriametrics-cluster, flux-operator,...
GO-2026-5013 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-lambda, terragrunt, containerd, external-dns, step-kms-plugin, crossplane-provider-aws-s3, nfpm, podman, crossplane-provider-aws-cloudwatchlogs, docker-compose, eksctl, prometheus-operator, gptscript, aactl, tw, kyverno,...
GO-2026-4340 vulnerabilities
Vulnerabilities for packages: kubernetes-event-exporter, crossplane-provider-aws-lambda, aws-eks-pod-identity-agent, external-dns, undock, crossplane-provider-aws-s3, cri-tools, litestream, mesosphere-vsphere-csi, crossplane-provider-aws-cloudwatchlogs, eksctl, dask-gateway, gptscript,...
GO-2024-2947 vulnerabilities
Vulnerabilities for packages: kubernetes-event-exporter, tekton-chains, opentelemetry-collector, terragrunt, snyk-cli, opentelemetry-collector-contrib, fulcio, kubescape, gomplate, crossplane-provider-azure, flux, crossplane-provider-azure-managedidentity, kubevela, terraform, vexctl, aactl, tkn,...
GHSA-QGQ7-7HM3-Q39J vulnerabilities
Vulnerabilities for packages: argo-cd, guac, nemo, nuclio-controller, coder, grafana-alloy, flux, gitsign, kubevela-fips, gitlab-runner, argo-events-fips, mapotf-fips, google-osconfig-agent, skaffold, argo-events, xeol, act, nuclei, trufflehog, cerbos-fips, zot, crossplane,...
CVE-2026-71557 vulnerabilities
Vulnerabilities for packages: argo-cd, guac, nemo, nuclio-controller, coder, grafana-alloy, flux, gitsign, kubevela-fips, gitlab-runner, argo-events-fips, mapotf-fips, google-osconfig-agent, skaffold, argo-events, xeol, act, nuclei, trufflehog, cerbos-fips, zot, crossplane,...
GHSA-HC8V-WWC9-VGXM vulnerabilities
Vulnerabilities for packages: argo-cd, guac, nemo, nuclio-controller, coder, grafana-alloy, flux, gitsign, kubevela-fips, gitlab-runner, argo-events-fips, mapotf-fips, google-osconfig-agent, skaffold, argo-events, xeol, act, nuclei, trufflehog, cerbos-fips, zot, crossplane,...
CVE-2026-71556 vulnerabilities
Vulnerabilities for packages: argo-cd, guac, nemo, nuclio-controller, coder, grafana-alloy, flux, gitsign, kubevela-fips, gitlab-runner, argo-events-fips, mapotf-fips, google-osconfig-agent, skaffold, argo-events, xeol, act, nuclei, trufflehog, cerbos-fips, zot, crossplane,...
GHSA-QGQ7-7HM3-Q39J vulnerabilities
Vulnerabilities for packages: act, snyk-cli, grafana-alloy, pulumi-language-dotnet, nfpm, kubescape, gomplate, syft, external-secrets-operator, flux, kubevela, gptscript, trivy, trufflehog, pulumi-kubernetes-operator, gitaly, kyverno, flux-notification-controller, gitea, bom, gitsign, guac,...
GHSA-HC8V-WWC9-VGXM vulnerabilities
Vulnerabilities for packages: act, snyk-cli, grafana-alloy, pulumi-language-dotnet, nfpm, kubescape, gomplate, syft, external-secrets-operator, flux, kubevela, gptscript, trivy, trufflehog, pulumi-kubernetes-operator, gitaly, kyverno, flux-notification-controller, gitea, bom, gitsign, guac,...
CVE-2026-71557 vulnerabilities
Vulnerabilities for packages: act, snyk-cli, grafana-alloy, pulumi-language-dotnet, nfpm, kubescape, gomplate, syft, external-secrets-operator, flux, kubevela, gptscript, trivy, trufflehog, pulumi-kubernetes-operator, gitaly, kyverno, flux-notification-controller, gitea, bom, gitsign, guac,...
CVE-2026-71556 vulnerabilities
Vulnerabilities for packages: act, snyk-cli, grafana-alloy, pulumi-language-dotnet, nfpm, kubescape, gomplate, syft, external-secrets-operator, flux, kubevela, gptscript, trivy, trufflehog, pulumi-kubernetes-operator, gitaly, kyverno, flux-notification-controller, gitea, bom, gitsign, guac,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-lambda, terragrunt, containerd, external-dns, step-kms-plugin, crossplane-provider-aws-s3, nfpm, podman, crossplane-provider-aws-cloudwatchlogs, docker-compose, eksctl, prometheus-operator, gptscript, aactl, tw, kyverno,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: terragrunt, containerd, external-dns, step-kms-plugin, podman, nfpm, eksctl, prometheus-operator, gptscript, aactl, kyverno, flux-notification-controller, atlantis, chezmoi, wolfictl, cluster-api-azure-controller, cilium-cli, buildah, k3s, zarf,...
GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: rke2-cloud-provider, crossplane-provider-aws-lambda, envoy-ratelimit, cluster-api-helm-controller, containerd, external-dns, undock, vcluster, crossplane-provider-aws-s3, podman, cri-tools, kyverno-notation-aws, litestream, mesosphere-vsphere-csi,...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: rke2-cloud-provider, crossplane-provider-aws-lambda, envoy-ratelimit, cluster-api-helm-controller, containerd, external-dns, undock, vcluster, crossplane-provider-aws-s3, podman, cri-tools, kyverno-notation-aws, litestream, mesosphere-vsphere-csi,...
SUSE CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...