CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: buildkitd, helm, crossplane-provider-aws-eks, gitsign, nuclei, crossplane, zarf, syft, tfsec, grafana-alloy, crossplane-provider-aws-kinesis, ratify, crossplane-provider-aws-rds, extism, cerbos, trivy, external-secrets-operator, src-fingerprint, vcluster,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: buildkitd, helm, crossplane-provider-aws-eks, gitsign, nuclei, crossplane, zarf, syft, tfsec, grafana-alloy, crossplane-provider-aws-kinesis, ratify, crossplane-provider-aws-rds, extism, cerbos, trivy, external-secrets-operator, src-fingerprint, vcluster,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: actions-runner-controller, grype, pulumi-language-java, helm-push, reports-server, crossplane-provider-aws-memorydb-fips, boring-registry, argo-events-fips, cloudbeat, gitlab-operator, docker-fips, kubevela, terraform-provider-databricks, kyverno-notation-aws,...

GHSA-WHQX-F9J3-CH6M vulnerabilities

Vulnerabilities for packages: kyverno, tkn, aactl, zot, teleport, goreleaser, kyverno-notation-aws, policy-controller, falcoctl, witness, gitsign, ratify, flux-source-controller...

CVE-2026-22703 vulnerabilities

Vulnerabilities for packages: kyverno, tkn, aactl, zot, teleport, goreleaser, kyverno-notation-aws, policy-controller, falcoctl, witness, gitsign, ratify, flux-source-controller...

CVE-2026-22703 vulnerabilities

Vulnerabilities for packages: ratify, cloudbeat, falcoctl, falcoctl-fips, policy-controller-fips, cloudbeat-fips, kyverno-notation-aws, chainctl, gitsign, kyverno-fips, tkn, kyverno-notation-aws-fips, kyverno, tkn-fips, tekton-chains-fips, aactl, witness, flux-source-controller, ratify-fips,...

GHSA-WHQX-F9J3-CH6M vulnerabilities

Vulnerabilities for packages: ratify, cloudbeat, falcoctl, falcoctl-fips, policy-controller-fips, cloudbeat-fips, kyverno-notation-aws, chainctl, gitsign, kyverno-fips, tkn, kyverno-notation-aws-fips, kyverno, tkn-fips, tekton-chains-fips, aactl, witness, flux-source-controller, ratify-fips,...

EUVD-2024-0363

Malicious code in bioql PyPI...

CVE-2025-54388 vulnerabilities

Vulnerabilities for packages: zarf, grype, trufflehog, docker-cli-buildx, apko, opentelemetry-collector, nerdctl, falcoctl, aws-otel-collector-fips, falcoctl-fips, trivy-fips, aws-otel-collector, spire-server-fips, zot, cadvisor, beats-fips, docker-compose-fips, openfga, agentbeat-fips, apko-fips...

GHSA-29WX-VH33-7X7R vulnerabilities

Vulnerabilities for packages: argo-workflows, tekton-chains, buildkitd, temporal, gitea, secrets-store-csi-driver-provider-azure, openbao, k3s, flyte, gitsign, crossplane, nuclei, wal-g, zarf, crossplane-provider-azure-storage, octo-sts, temporal-server, atlantis, kaniko, goreleaser,...

CVE-2024-51744 vulnerabilities

Vulnerabilities for packages: argo-workflows, tekton-chains, buildkitd, temporal, gitea, secrets-store-csi-driver-provider-azure, openbao, k3s, flyte, gitsign, crossplane, nuclei, wal-g, zarf, crossplane-provider-azure-storage, octo-sts, temporal-server, atlantis, kaniko, goreleaser,...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: argo-workflows, sqlpad, buildkitd, tekton-chains, sigstore-scaffolding, velero, spire-server, secrets-store-csi-driver-provider-azure, prometheus-operator, flux-kustomize-controller, grafana-mimir, rclone, flyte, nuclei, wal-g, timestamp-authority, harbor-registry,...

GO-2024-2860 goreleaser shows environment by default in github.com/goreleaser/goreleaser

goreleaser shows environment by default in github.com/goreleaser/goreleaser...

GHSA-F6MM-5FC7-3G3C vulnerabilities

Vulnerabilities for packages: goreleaser...

GHSA-F6MM-5FC7-3G3C vulnerabilities

Vulnerabilities for packages: goreleaser...

goreleaser shows environment by default

Summary Since 4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment. PoC Create a Go project with dependencies, do not pull them yet or run goreleaser later in a container, or...

GHSA-F6MM-5FC7-3G3C goreleaser shows environment by default

Summary Since 4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment. PoC Create a Go project with dependencies, do not pull them yet or run goreleaser later in a container, or...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: argo-workflows, tekton-chains, temporal, sigstore-scaffolding, spire-server, flux-kustomize-controller, kubernetes-dashboard, caddy, kargo, k3s, gitsign, timestamp-authority, zarf, fulcio, dex, dgraph, temporal-ui-server, grpc-health-probe, slsa-verifier,...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: zarf, cosign, tekton-chains, k3s, nerdctl, docker-machine-driver-harvester, loki, falcoctl, up, falcoctl-fips, kubevela, policy-controller-fips, flux-image-reflector-controller, zot, cadvisor, scorecard, kpt, k3d, kargo, cosign-fips, flux, crane, gitsign, helm,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: zarf, cosign, tekton-chains, k3s, nerdctl, docker-machine-driver-harvester, loki, falcoctl, up, falcoctl-fips, kubevela, policy-controller-fips, flux-image-reflector-controller, zot, cadvisor, scorecard, kpt, k3d, kargo, cosign-fips, flux, crane, gitsign, helm,...