CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: guac, pulumi-language-dotnet, syft, nemo, gitlab-rails-ce-fips, xeol-fips, grype, scorecard, trivy-operator, pulumi-language-java, trivy-operator-fips, chainloop-cli, cloudbeat-fips, src-fingerprint-fips, amazon-ssm-agent, apko, argo-cd, cerbos-fips,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: vexctl, falcoctl, gh, trivy-operator, trivy, crossplane, dagger, ko, slsa-verifier, tflint, bom, cosign, docker, tkn, goreleaser, spire-server, zarf, gitlab-runner, ratify, guac, neuvector-sigstore-interface, teleport, gitsign, tekton-chains, kyverno-notation-aws, zo...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, guac, vexctl, trivy-operator, trivy-operator-fips, tekton-chains, chainloop-cli, cloudbeat-fips, cosign-fips, kyverno-policy-reporter-plugins-kyverno, tkn-fips, trivy, docker-compose, neuvector-sigstore-interface-fips, teleport,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: guac, pulumi-language-dotnet, syft, nemo, gitlab-rails-ce-fips, xeol-fips, grype, scorecard, trivy-operator, pulumi-language-java, trivy-operator-fips, chainloop-cli, cloudbeat-fips, src-fingerprint-fips, amazon-ssm-agent, apko, argo-cd, cerbos-fips,...

CVE-2026-22741

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: the application is using Spring MVC or Spring WebFlux the application is configuring the resource chain support...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: cert-manager, juicefs, cert-manager-istio-csr, k6, gitea, rancher-webhook, spqr, bento, opentofu, gitlab-runner, ratify, nuclei, grafana, seaweedfs, rancher-agent, openbao, teleport, cert-manager-csi-driver, kyverno-notation-aws, external-secrets-operator, trufflehog...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: cert-manager, juicefs, cert-manager-istio-csr, k6, gitea, rancher-webhook, spqr, bento, opentofu, gitlab-runner, ratify, nuclei, grafana, seaweedfs, rancher-agent, openbao, teleport, cert-manager-csi-driver, kyverno-notation-aws, external-secrets-operator, trufflehog...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, xeol-fips, percona-server-mongodb-operator-fips, minio-fips, terraform, dex-fips, vault-fips, dex, agentbeat-fips, cloudbeat-fips, neuvector, commercial-grafana, opentofu-fips, nuclei, cert-manager-csi-driver, k6-fips, k6, grafana, teleport...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, xeol-fips, percona-server-mongodb-operator-fips, minio-fips, terraform, dex-fips, vault-fips, dex, agentbeat-fips, cloudbeat-fips, neuvector, commercial-grafana, opentofu-fips, nuclei, cert-manager-csi-driver, k6-fips, k6, grafana, teleport...

GHSA-3XC5-WRHM-F963 vulnerabilities

Vulnerabilities for packages: guac, pulumi-language-dotnet, syft, nemo, gitlab-rails-ce-fips, xeol-fips, grype, scorecard, trivy-operator, pulumi-language-java, trivy-operator-fips, chainloop-cli, cloudbeat-fips, src-fingerprint-fips, amazon-ssm-agent, apko, argo-cd, cerbos-fips,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: vexctl, falcoctl, gh, trivy-operator, trivy, sigstore-scaffolding, crossplane, ko, slsa-verifier, tflint, docker, cosign, tkn, goreleaser, spire-server, zarf, ratify, neuvector-sigstore-interface, teleport, gitsign, tekton-chains, kyverno-notation-aws, zot, aactl,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: vexctl, falcoctl, gh, trivy-operator, trivy, sigstore-scaffolding, crossplane, ko, slsa-verifier, tflint, docker, cosign, tkn, goreleaser, spire-server, zarf, ratify, neuvector-sigstore-interface, teleport, gitsign, tekton-chains, kyverno-notation-aws, zot, aactl,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, helm-set-status, trivy-operator, trivy, istio, consul-k8s, nova, headlamp, helm-operator, helm-push, kuma, helm-docs, cerbos, kube-arangodb, zarf, chart-testing, helm-mapkubeapis, kots, teleport, tigera-operator, chartmuseum, eksctl, flux...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, helm-set-status, trivy-operator, trivy, istio, consul-k8s, nova, headlamp, helm-operator, helm-push, kuma, helm-docs, cerbos, kube-arangodb, zarf, chart-testing, helm-mapkubeapis, kots, teleport, tigera-operator, chartmuseum, eksctl, flux...

GHSA-VMX8-MQV2-9GMG vulnerabilities

Vulnerabilities for packages: flux-source-controller, rancher-fleet, gitlab-operator-fips, cilium-cli, helm-diff-fips, kots, zarf, flux, helm-diff, helm-push, zarf-fips, kuma, flux-fips, flux-source-controller-fips, cert-manager-cmctl-fips, gitlab-operator, rancher-fleet-fips, cert-manager-cmctl...

CVE-2026-35204 vulnerabilities

Vulnerabilities for packages: flux-source-controller, rancher-fleet, gitlab-operator-fips, cilium-cli, helm-diff-fips, kots, zarf, flux, helm-diff, helm-push, zarf-fips, kuma, flux-fips, flux-source-controller-fips, cert-manager-cmctl-fips, gitlab-operator, rancher-fleet-fips, cert-manager-cmctl...

CVE-2026-35205 vulnerabilities

Vulnerabilities for packages: flux-source-controller, rancher-fleet, gitlab-operator-fips, cilium-cli, helm-diff-fips, kots, zarf, flux, helm-diff, helm-push, zarf-fips, kuma, flux-fips, flux-source-controller-fips, cert-manager-cmctl-fips, gitlab-operator, rancher-fleet-fips, cert-manager-cmctl...

GHSA-Q5JF-9VFQ-H4H7 vulnerabilities

Vulnerabilities for packages: flux-source-controller, rancher-fleet, gitlab-operator-fips, cilium-cli, helm-diff-fips, kots, zarf, flux, helm-diff, helm-push, zarf-fips, kuma, flux-fips, flux-source-controller-fips, cert-manager-cmctl-fips, gitlab-operator, rancher-fleet-fips, cert-manager-cmctl...