CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: argo-workflows, pulumi-language-dotnet, argo-events, gitsign, snyk-cli, osv-scanner, wolfictl, argocd-image-updater, guac, skaffold, crossplane, syft, flux-image-automation-controller, gomplate, gitlab-runner, goreleaser, pulumi-language-java, zot, trufflehog,...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: argo-workflows, pulumi-language-dotnet, argo-events, gitsign, snyk-cli, osv-scanner, wolfictl, argocd-image-updater, guac, skaffold, crossplane, syft, flux-image-automation-controller, gomplate, gitlab-runner, goreleaser, pulumi-language-java, zot, trufflehog,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: syft-fips, pulumi-language-java, crossplane-fips, flux, act, cg, guac, trivy-operator-fips, kubevela-fips, terragrunt, terragrunt-fips, pulumi, tfsec, kargo, src-fingerprint-fips, cloudbeat-fips, external-secrets-operator-fips, coder-fips, external-secrets-operator,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: tkn, gitsign, vexctl, tflint, neuvector-sigstore-interface, gh, guac, skaffold, crossplane, ko, gitlab-runner, goreleaser, docker, buildkitd, zot, rekor, aactl, kyverno, slsa-verifier, spire-server, teleport, bom, trivy-operator, trivy, ratify, kyverno-notation-aws,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: tkn, crossplane-fips, cg, tflint, guac, trivy-operator-fips, aactl, tkn-fips, docker-cli-buildx, policy-controller-fips, cloudbeat-fips, neuvector-sigstore-interface-fips, gh, tekton-chains, kubescape-server-fips, docker-compose, chainctl,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: syft-fips, pulumi-language-java, crossplane-fips, flux, act, cg, guac, trivy-operator-fips, kubevela-fips, terragrunt, terragrunt-fips, pulumi, tfsec, kargo, src-fingerprint-fips, cloudbeat-fips, external-secrets-operator-fips, external-secrets-operator,...

CVE-2026-22741

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, seaweedfs, rclone, opentofu, telegraf, yunikorn-k8shim, gitlab-runner, terraform, cert-manager, rancher, zot, trufflehog, percona-server-mongodb-operator, kyverno, xeol, teleport, cert-manager-cmctl, rancher-agent, gitea, ratify,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, seaweedfs, rclone, opentofu, telegraf, yunikorn-k8shim, gitlab-runner, terraform, cert-manager, rancher, zot, trufflehog, percona-server-mongodb-operator, kyverno, xeol, teleport, cert-manager-cmctl, rancher-agent, gitea, ratify,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: flux, opentofu, syncthing-fips, cert-manager-fips, cloudbeat-fips, external-secrets-operator-fips, zitadel, external-secrets-operator, rclone-fips, dex, spqr, rancher-webhook-fips, packer-fips, k6, seaweedfs, terraform, neuvector-fips, sftpgo-plugin-auth,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: flux, opentofu, syncthing-fips, cert-manager-fips, cloudbeat-fips, external-secrets-operator-fips, zitadel, external-secrets-operator, rclone-fips, dex, spqr, rancher-webhook-fips, packer-fips, k6, seaweedfs, terraform, neuvector-fips, sftpgo-plugin-auth,...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: syft-fips, pulumi-language-java, crossplane-fips, flux, act, cg, guac, trivy-operator-fips, kubevela-fips, terragrunt, terragrunt-fips, pulumi, tfsec, kargo, src-fingerprint-fips, cloudbeat-fips, external-secrets-operator-fips, external-secrets-operator,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: tkn, gitsign, vexctl, tflint, neuvector-sigstore-interface, gh, skaffold, crossplane, ko, goreleaser, docker, buildkitd, zot, aactl, kyverno, slsa-verifier, spire-server, teleport, trivy-operator, trivy, witness, ratify, kyverno-notation-aws, flux-source-controller,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: tkn, gitsign, vexctl, tflint, neuvector-sigstore-interface, gh, skaffold, crossplane, ko, goreleaser, docker, buildkitd, zot, aactl, kyverno, slsa-verifier, spire-server, teleport, trivy-operator, trivy, witness, ratify, kyverno-notation-aws, flux-source-controller,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: helm-operator, cluster-api-helm-controller, chartmuseum, envoy-gateway, helm-push, helm-docs, linkerd2, zot, istio, rancher-fleet, trivy-operator, cert-manager-cmctl, helm-set-status, trivy, kube-arangodb, consul-k8s, flux-source-controller, kots, k9s,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: helm-operator, cluster-api-helm-controller, chartmuseum, envoy-gateway, helm-push, helm-docs, linkerd2, zot, istio, rancher-fleet, trivy-operator, cert-manager-cmctl, helm-set-status, trivy, kube-arangodb, consul-k8s, flux-source-controller, kots, k9s,...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: rancher-fleet, flux-source-controller-fips, flux-fips, flux, rancher-fleet-fips, zarf, flux-source-controller, gitlab-operator, helm-push, kuma, zarf-fips, gitlab-operator-fips, helm-diff, helm-diff-fips, cert-manager-cmctl-fips, cert-manager-cmctl, cilium-cli, kots...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: rancher-fleet, flux-source-controller-fips, flux-fips, flux, rancher-fleet-fips, zarf, flux-source-controller, gitlab-operator, helm-push, kuma, zarf-fips, gitlab-operator-fips, helm-diff, helm-diff-fips, cert-manager-cmctl-fips, cert-manager-cmctl, cilium-cli, kots...