431 matches found
CVE-2025-32386 vulnerabilities
Vulnerabilities for packages: cilium-cli, helm-operator, helm-push, helm-operator-fips, flux-helm-controller-fips, kots, cluster-api-helm-controller, cert-manager-cmctl, eksctl, tw, flux-source-controller-fips, helm-docs, flux-source-controller, chart-testing-fips, kubescape, zarf, flux,...
GHSA-4HFP-H4CW-HJ8P vulnerabilities
Vulnerabilities for packages: cilium-cli, helm-operator, helm-push, helm-operator-fips, flux-helm-controller-fips, kots, cluster-api-helm-controller, cert-manager-cmctl, eksctl, tw, flux-source-controller-fips, helm-docs, flux-source-controller, chart-testing-fips, kubescape, zarf, flux,...
GHSA-5XQW-8HWV-WG92 vulnerabilities
Vulnerabilities for packages: cilium-cli, helm-operator, helm-push, helm-operator-fips, flux-helm-controller-fips, kots, cluster-api-helm-controller, cert-manager-cmctl, eksctl, tw, flux-source-controller-fips, helm-docs, flux-source-controller, chart-testing-fips, kubescape, zarf, flux,...
CVE-2025-22871 vulnerabilities
Vulnerabilities for packages: k3s, swagger, crossplane-provider-azure-managedidentity, sbom-scorecard, runc, tw, nri-elasticsearch, metallb, kubecolor, kubewatch, spire-controller-manager, conftest, pluto, aws-flb-cloudwatch, tekton-chains, tempo, buildah, oauth2-proxy, terraform, kube-rbac-proxy...
GHSA-G9PC-8G42-G6VQ vulnerabilities
Vulnerabilities for packages: k3s, swagger, crossplane-provider-azure-managedidentity, sbom-scorecard, runc, tw, nri-elasticsearch, metallb, kubecolor, kubewatch, spire-controller-manager, conftest, pluto, aws-flb-cloudwatch, tekton-chains, tempo, buildah, oauth2-proxy, terraform, kube-rbac-proxy...
CVE-2025-22871 vulnerabilities
Vulnerabilities for packages: opentelemetry-operator, wireguard-go, tekton-chains, kubernetes-csi-livenessprobe, azure-service-operator-fips, argo-workflows-fips, victoriametrics-operator-fips, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, age-fips, opa-fips-envoy,...
CISA and FBI Warn Fast Flux is Powering Resilient Malware, C2, and Phishing Networks
Cybersecurity agencies from Australia, Canada, New Zealand, and the United States have published a joint advisory about the risks associated with a technique called fast flux that has been adopted by threat actors to obscure a command-and-control C2 channel. "'Fast flux' is a technique used to...
NSA and Global Allies Declare Fast Flux a National Security Threat
NSA and global cybersecurity agencies warn fast flux DNS tactic is a growing national security threat used in phishing, botnets, and ransomware...
NSA, CISA, FBI, and International Partners Release Cybersecurity Advisory on “Fast Flux,” a National Security Threat
Today, CISA—in partnership with the National Security Agency NSA, Federal Bureau of Investigation FBI, Australian Signals Directorate’s Australian Cyber Security Centre ASD’s ACSC, Canadian Centre for Cyber Security CCCS, and New Zealand’s National Cyber Security Centre NCSC-NZ—released joint...
GHSA-265R-HFXG-FHMG vulnerabilities
Vulnerabilities for packages: flux-source-controller, ctop, k3s, docker, dagger, kubescape, fuse-overlayfs-snapshotter, eksctl, chartmuseum, helm, kots, docker-cli-buildx, cluster-api-helm-controller, spegel, neuvector-scanner, rancher-fleet, envoy-gateway, opa, kargo, xeol, buildkitd, grype,...
GHSA-265R-HFXG-FHMG vulnerabilities
Vulnerabilities for packages: flux-helm-controller, newrelic-infrastructure-agent, opa, cilium-cli, helm-operator, helm-push, docker-compose, rancher, helm-operator-fips, flux-helm-controller-fips, kots, opa-fips-envoy, dagger, cluster-api-helm-controller, osv-scanner, kaniko, cert-manager-cmctl,...
CVE-2024-40635 vulnerabilities
Vulnerabilities for packages: flux-helm-controller, newrelic-infrastructure-agent, opa, cilium-cli, helm-operator, helm-push, docker-compose, rancher, helm-operator-fips, flux-helm-controller-fips, kots, opa-fips-envoy, dagger, cluster-api-helm-controller, osv-scanner, kaniko, cert-manager-cmctl,...
GHSA-QXP5-GWG8-XV66 vulnerabilities
Vulnerabilities for packages: opentelemetry-operator, wireguard-go, tekton-chains, kubernetes-csi-livenessprobe, argo-workflows-fips, victoriametrics-operator-fips, kyverno-policy-reporter-kyverno-plugin-fips, helm-operator-fips, crossplane-provider-aws-kinesis, kserve, opa-fips-envoy,...
Malicious code in flux-common-plugin (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-1810 Malicious code in flux-common-plugin (npm)
--- -= Per source details. Do not edit below this line.=-...
GHSA-7WRW-R4P8-38RX vulnerabilities
Vulnerabilities for packages: swagger, sbom-scorecard, runc, crossplane-provider-aws, gitsign, metallb, kubecolor, kubewatch, nuclei, sftpgo, spire-controller-manager, conftest, pluto, aws-flb-cloudwatch, tempo, argo-rollouts, cloud-provider-aws, grpc-health-probe, oauth2-proxy, terraform,...
GHSA-J6M3-GC37-6R6Q vulnerabilities
Vulnerabilities for packages: dgraph, slsa-verifier, wireguard-go, cue-fips, kubernetes-csi-livenessprobe, argo-workflows-fips, helm-operator-fips, nri-apache, crossplane-provider-azure, amass, minio-fips, memcached-exporter, s5cmd, spark-operator, k8ssandra-operator, paranoia, kaf, nri-rabbitmq,...
CVE-2022-36035
Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration like Git repositories, and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allow...
CVE-2022-24878
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...
CVE-2022-24877
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...