GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: zarf-fips, google-osconfig-agent, spegel, chainctl, cluster-api-helm-controller-fips, trivy, docker-fips, headlamp, packer-fips, crossplane, dagger, trivy-fips, docker-cli-buildx-fips, linkerd2, fuse-overlayfs-snapshotter, helm-exporter, cg, ctop, helm-exporter-fips,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: neuvector-scanner, buildkitd, newrelic-infrastructure-agent, zot, gatekeeper, helm-mapkubeapis, dagger, envoy-gateway, kubevela, rancher-agent, zarf, scorecard, k8sgpt, opa, tigera-operator, k9s, eksctl, rancher-helm, rancher, docker-cli-buildx, grype, helm-operator,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, buildkitd, newrelic-infrastructure-agent, zot, gatekeeper, helm-mapkubeapis, dagger, envoy-gateway, kubevela, rancher-agent, zarf, scorecard, k8sgpt, opa, tigera-operator, k9s, eksctl, rancher-helm, rancher, docker-cli-buildx, grype, helm-operator,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: zarf-fips, google-osconfig-agent, spegel, chainctl, cluster-api-helm-controller-fips, gogatekeeper, trivy, docker-fips, headlamp, packer-fips, dagger, k8ssandra-client, trivy-fips, osv-scanner, docker-cli-buildx-fips, linkerd2, opa-fips-envoy,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: pluto, zot, helm-mapkubeapis, envoy-gateway, zarf, tigera-operator, k9s, eksctl, flux-source-controller, helm-operator, cert-manager-cmctl, k8ssandra-client, istio, linkerd2, cerbos, cluster-api-helm-controller, teleport, nova, headlamp, cilium-cli, chartmuseum, kuma...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: pluto, zot, helm-mapkubeapis, envoy-gateway, zarf, tigera-operator, k9s, eksctl, flux-source-controller, helm-operator, cert-manager-cmctl, k8ssandra-client, istio, linkerd2, cerbos, cluster-api-helm-controller, teleport, nova, headlamp, cilium-cli, chartmuseum, kuma...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: fluxcd-kustomize-mutating-webhook, pluto, kubewatch, hubble, dataplaneapi, karpenter, newrelic-infra-operator, stakater-reloader, grafana-operator, smokescreen, flux-source-controller, supercronic, dkron, external-secrets-operator, github-mcp-server,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, pulumi-language-yaml, pulumi-language-java, tfsec, dagger, kubevela, zarf, crossplane-provider-keycloak, flux-source-controller, docker-cli-buildx, crossplane-provider-aws-s3, cert-manager-cmctl, melange, crossplane,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-managedidentity, pulumi-language-yaml, pulumi-language-java, tfsec, dagger, kubevela, zarf, crossplane-provider-keycloak, flux-source-controller, docker-cli-buildx, crossplane-provider-aws-s3, cert-manager-cmctl, melange, crossplane,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: gatus-fips, eks-distro, aws-fsx-csi-driver-fips, volsync-fips, longhorn-manager-fips, kubernetes-ingress-defaultbackend, spegel, velero-plugin-for-csi, blob-csi-fips, yace, volsync, k8s-device-plugin, capslock, chainctl, opentelemetry-operator, rancher-machine,...

BIT-FLUX-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-6887

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: rabbitmq-cluster-operator, google-osconfig-agent, terraform-provider-azapi, docker-credential-gcr, kpt, cerbos, nri-rabbitmq, dgraph, plugin-barman-cloud, monstache, bom, timescaledb-tune, trivy, grafana-alloy, k3d, headlamp, swagger, argo-events, tkn,...

CVE-2025-55199 vulnerabilities

Vulnerabilities for packages: pluto, zot, helm-mapkubeapis, envoy-gateway, zarf, k8sgpt, k9s, eksctl, flux-source-controller, helm-operator, kargo, cert-manager-cmctl, k8ssandra-client, istio, linkerd2, cerbos, cluster-api-helm-controller, nova, headlamp, cilium-cli, chartmuseum, trivy,...

CVE-2025-55198 vulnerabilities

Vulnerabilities for packages: pluto, zot, helm-mapkubeapis, envoy-gateway, zarf, k8sgpt, k9s, eksctl, flux-source-controller, helm-operator, kargo, cert-manager-cmctl, k8ssandra-client, istio, linkerd2, cerbos, cluster-api-helm-controller, nova, headlamp, cilium-cli, chartmuseum, trivy,...

GHSA-F9F8-9PMF-XV68 vulnerabilities

Vulnerabilities for packages: pluto, zot, helm-mapkubeapis, envoy-gateway, zarf, k8sgpt, k9s, eksctl, flux-source-controller, helm-operator, kargo, cert-manager-cmctl, k8ssandra-client, istio, linkerd2, cerbos, cluster-api-helm-controller, nova, headlamp, cilium-cli, chartmuseum, trivy,...

GHSA-9H84-QMV7-982P vulnerabilities

Vulnerabilities for packages: pluto, zot, helm-mapkubeapis, envoy-gateway, zarf, k8sgpt, k9s, eksctl, flux-source-controller, helm-operator, kargo, cert-manager-cmctl, k8ssandra-client, istio, linkerd2, cerbos, cluster-api-helm-controller, nova, headlamp, cilium-cli, chartmuseum, trivy,...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: helm-operator, tw, kots, kubescape, cert-manager-cmctl-fips, helm-push, cluster-api-helm-controller-fips, k8ssandra-client-fips, consul-k8s-fips, flux-helm-controller, flux-source-controller-fips, helm-operator-fips, eksctl, kuma, trivy, chartmuseum-fips, helm-docs,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: helm-operator, tw, kots, kubescape, cert-manager-cmctl-fips, helm-push, cluster-api-helm-controller-fips, k8ssandra-client-fips, consul-k8s-fips, flux-helm-controller, flux-source-controller-fips, helm-operator-fips, eksctl, kuma, trivy, chartmuseum-fips, helm-docs,...