549 matches found
CVE-2026-35205 vulnerabilities
Vulnerabilities for packages: flux-source-controller, helm-diff, cilium-cli, helm-diff-fips, kots, zarf, flux-source-controller-fips, cert-manager-cmctl-fips, kuma, zarf-fips, gitlab-operator, gitlab-operator-fips, rancher-fleet, helm-push, flux, rancher-fleet-fips, flux-fips, cert-manager-cmctl...
GHSA-VMX8-MQV2-9GMG vulnerabilities
Vulnerabilities for packages: flux-source-controller, helm-diff, cilium-cli, helm-diff-fips, kots, zarf, flux-source-controller-fips, cert-manager-cmctl-fips, kuma, zarf-fips, gitlab-operator, gitlab-operator-fips, rancher-fleet, helm-push, flux, rancher-fleet-fips, flux-fips, cert-manager-cmctl...
GHSA-HR2V-4R36-88HR vulnerabilities
Vulnerabilities for packages: kube-arangodb, kots, eksctl, linkerd2, nova-fips, trivy, helm-set-status, gitlab-operator-fips, cloudbeat-fips, rancher-fleet, envoy-gateway, k9s-fips, pluto, kubescape-server-fips, helm-exporter-fips, helm-operator, chart-testing-fips, cert-manager-cmctl, cerbos,...
GHSA-FV83-X2XW-2J55 vulnerabilities
Vulnerabilities for packages: malcontent, mountpoint-s3-csi-driver, newrelic-infra-operator, supercronic, apko, pluto, grafana-rollout-operator, dgraph, smarter-device-manager, volume-modifier-for-k8s, flux-image-reflector-controller, dbmate, clickhouse-operator, polaris, stakater-reloader, gh,...
CVE-2026-32282 vulnerabilities
Vulnerabilities for packages: prometheus-operator, dask-gateway, external-dns, k3s, kine, istio, kubernetes-dashboard, kyverno, aws-flb-firehose, gitlab-pages, telegraf, argo-cd, prometheus, fscrypt, gitaly, zot, redka, coredns, kaf, newrelic-fluent-bit-output, snyk-cli, cilium-cli,...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: cerbos, dask-gateway, external-dns, rclone, kine, step-ca, istio, rook, zot, vault-benchmark, falcoctl, weaviate, atlantis, hubble, redpanda, wal-g, nuclei, go, tigera-operator, cilium, cert-manager, gitness, ipfs-cluster, helm-push, mesosphere-vsphere-csi,...
GHSA-XJ38-JXC5-RPPX vulnerabilities
Vulnerabilities for packages: prometheus-operator, dask-gateway, external-dns, k3s, kine, istio, kubernetes-dashboard, kyverno, aws-flb-firehose, gitlab-pages, telegraf, argo-cd, prometheus, fscrypt, gitaly, zot, redka, coredns, kaf, newrelic-fluent-bit-output, snyk-cli, cilium-cli,...
CVE-2026-32281 vulnerabilities
Vulnerabilities for packages: kubernetes-csi-external-health-monitor, juicefs-csi-driver, chisel, istio, direnv, portieris, verticadb-operator, crossplane-provider-family-azure, atlantis, etcd, hubble, cadvisor, kubernetes-dashboard-api, nginx-prometheus-exporter, redpanda, sftpgo-plugin-auth,...
CVE-2026-32289 vulnerabilities
Vulnerabilities for packages: crossplane-provider-keycloak, cerbos, dask-gateway, external-dns, rclone, kubernetes-csi-external-health-monitor, kine, memcached-exporter, step-ca, juicefs-csi-driver, istio, sftpgo, grafana-mimir, opencost, kserve-modelmesh-serving, crossplane-provider-sql, rook,...
GHSA-7MR4-XJXG-34G6 vulnerabilities
Vulnerabilities for packages: crossplane-provider-keycloak, cerbos, dask-gateway, external-dns, rclone, kubernetes-csi-external-health-monitor, kine, memcached-exporter, step-ca, juicefs-csi-driver, istio, sftpgo, grafana-mimir, opencost, kserve-modelmesh-serving, crossplane-provider-sql, rook,...
GHSA-XJ38-JXC5-RPPX vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, external-secrets-operator-fips, kyverno-fips, dask-gateway, external-dns, cloud-provider-azure, coredns-fips, commercial-chainloop-backend, aws-load-balancer-controller-fips, kuma, newrelic-fluent-bit-output, k8s-device-plugin, argo-workflows,...
GHSA-FV83-X2XW-2J55 vulnerabilities
Vulnerabilities for packages: secrets-store-csi-driver-provider-aws, goreleaser, external-secrets-operator-fips, flux-helm-controller-fips, fluxcd-kustomize-mutating-webhook, karma-fips, sealed-secrets-fips, pluto, mariadb-operator-fips, github-mcp-server, cilium-certgen-fips,...
CVE-2026-33810 vulnerabilities
Vulnerabilities for packages: secrets-store-csi-driver-provider-aws, goreleaser, external-secrets-operator-fips, flux-helm-controller-fips, fluxcd-kustomize-mutating-webhook, karma-fips, sealed-secrets-fips, pluto, mariadb-operator-fips, github-mcp-server, cilium-certgen-fips,...
CVE-2026-32282 vulnerabilities
Vulnerabilities for packages: tekton-pipelines-fips, external-secrets-operator-fips, kyverno-fips, dask-gateway, external-dns, cloud-provider-azure, coredns-fips, commercial-chainloop-backend, aws-load-balancer-controller-fips, kuma, newrelic-fluent-bit-output, k8s-device-plugin, argo-workflows,...
GHSA-X4JJ-H2V8-HQQV vulnerabilities
Vulnerabilities for packages: trivy, flux-helm-controller-fips, cloudflared-fips, gitleaks, envconsul-fips, kyverno-fips, external-dns, coredns-fips, aws-load-balancer-controller-fips, splunk-otel-collector, ko, k8s-device-plugin, cloudbeat, falcoctl, tkn-fips, apko, flux-source-watcher,...
CVE-2026-32288 vulnerabilities
Vulnerabilities for packages: trivy, flux-helm-controller-fips, cloudflared-fips, gitleaks, envconsul-fips, kyverno-fips, external-dns, coredns-fips, aws-load-balancer-controller-fips, splunk-otel-collector, ko, k8s-device-plugin, cloudbeat, falcoctl, tkn-fips, apko, flux-source-watcher,...
CVE-2026-32283 vulnerabilities
Vulnerabilities for packages: cloudnative-pg-fips, custom-pod-autoscaler-operator, trivy, thanos-operator-fips, hubble-fips, argocd-image-updater, flux-helm-controller-fips, dockerize-fips, cloudflared-fips, promxy-fips, cadvisor-fips, tempo, minio-object-browser-fips, gitleaks, envconsul-fips,...
GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
