GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-terraform, cloud-sql-proxy, flux-kustomize-controller, trivy, tekton-pipelines-fips, goreleaser, caddy-fips, sops, crossplane-provider-family-aws, vertical-pod-autoscaler-fips, crossplane-provider-aws-servicediscovery, apm-server, pluto, tempo,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-terraform, cloud-sql-proxy, flux-kustomize-controller, trivy, tekton-pipelines-fips, goreleaser, caddy-fips, sops, crossplane-provider-family-aws, vertical-pod-autoscaler-fips, crossplane-provider-aws-servicediscovery, apm-server, pluto, tempo,...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: trivy, k6-operator-fips, argocd-image-updater, rekor, cloudflared-fips, kyverno-fips, coredns-fips, flux-kustomize-controller-fips, secrets-store-csi-driver-provider-gcp-fips, cloudbeat, restic-fips, falcoctl, podinfo, tkn-fips, terraform-provider-google-fips,...

GHSA-WVJ2-96WP-FQ3F vulnerabilities

Vulnerabilities for packages: jaeger, osv-scanner, datadog-agent, gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips, flux-operator, datadog-agent-fips, flux-operator-fips, gptscript, ferretdb, github-mcp-server, gitlab-workhorse-ce, opencost...

CVE-2026-27896 vulnerabilities

Vulnerabilities for packages: jaeger, osv-scanner, datadog-agent, gitlab-workhorse-ce-fips, opencost-fips, jaeger-fips, flux-operator, datadog-agent-fips, flux-operator-fips, gptscript, ferretdb, github-mcp-server, gitlab-workhorse-ce, opencost...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-keycloak, cerbos, rclone, src-fingerprint, argo-rollouts, zot, crossplane-provider-aws-cloudformation, crossplane-provider-aws-firehose, crossplane-provider-family-azure, terraform-provider-azuread, atlantis, gomplate, boring-registry, wal-g,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-keycloak, cerbos, rclone, src-fingerprint, argo-rollouts, zot, crossplane-provider-aws-cloudformation, crossplane-provider-aws-firehose, crossplane-provider-family-azure, terraform-provider-azuread, atlantis, gomplate, boring-registry, wal-g,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, trivy, tekton-pipelines-fips, goreleaser, sops, crossplane-provider-family-aws, external-secrets-operator-fips, argocd-image-updater, flux-helm-controller-fips, terragrunt-fips, kyverno-fips, crossplane-provider-aws-elasticache-fips,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, trivy, tekton-pipelines-fips, goreleaser, sops, crossplane-provider-family-aws, external-secrets-operator-fips, argocd-image-updater, flux-helm-controller-fips, terragrunt-fips, kyverno-fips, crossplane-provider-aws-elasticache-fips,...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: step-ca-fips, flux-kustomize-controller, fulcio, sops, caddy-fips, openfga-fips, rekor, mariadb-operator-fips, trillian-fips, terragrunt-fips, kyverno-fips, prometheus-mysqld-exporter, sqlexporter-fips, flux-kustomize-controller-fips, percona-xtradb-cluster-operator,...

SUSE CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

GO-2026-4351 Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator

Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims in github.com/controlplaneio-fluxcd/flux-operator...

CVE-2025-61728 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, thanos-operator-fips, goreleaser, external-secrets-operator-fips, flux-helm-controller-fips, apm-server, gpu-operator-fips, steampipe, logstash, dask-gateway, external-dns, external-dns-fips, coredns-fips, vale,...

CVE-2026-23990 vulnerabilities

Vulnerabilities for packages: flux-operator...

GHSA-4XH5-JCJ2-CH8Q vulnerabilities

Vulnerabilities for packages: flux-operator...

GHSA-4XH5-JCJ2-CH8Q vulnerabilities

Vulnerabilities for packages: flux-operator, flux-operator-fips...

CVE-2026-23990 vulnerabilities

Vulnerabilities for packages: flux-operator, flux-operator-fips...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...

CVE-2026-23990

The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator Web UI authentication code that allows...