GO-2024-2947 vulnerabilities

Vulnerabilities for packages: tekton-chains, k3s, crossplane-provider-azure-authorization, neuvector-sigstore-interface, flux-notification-controller, rekor, sigstore-scaffolding, terraform, snyk-cli, crossplane-provider-azure, vexctl, pulumi, actions-runner-controller, falcoctl, kubevela, k3d,...

GHSA-XHF5-7WJV-PQXP vulnerabilities

Vulnerabilities for packages: trivy, helm-operator, livekit-cli, consul-k8s, teleport, cluster-api-helm-controller-fips, fuse-overlayfs-snapshotter, zot, eksctl, newrelic-infrastructure-agent, grype-db, steampipe, helm-mapkubeapis, grype-fips, k9s, trivy-operator-fips, kubescape-operator,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: ctop, opa, k3s, containerd, docker, cluster-api-helm-controller, rancher-agent, kaniko, linkerd2, dagger, trivy-operator, grype, newrelic-infrastructure-agent, kubevela, gogatekeeper, kube-arangodb, headlamp, k8sgpt, k9s, osv-scanner, manifest-tool, rancher-helm,...

GHSA-FQW6-GF59-QR4W vulnerabilities

Vulnerabilities for packages: ctop, opa, k3s, containerd, docker, cluster-api-helm-controller, rancher-agent, kaniko, linkerd2, dagger, trivy-operator, grype, newrelic-infrastructure-agent, kubevela, gogatekeeper, kube-arangodb, headlamp, k8sgpt, k9s, osv-scanner, manifest-tool, rancher-helm,...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: trivy, helm-operator, livekit-cli, consul-k8s, teleport, cluster-api-helm-controller-fips, osv-scanner, opa-fips, upwind-agent, fuse-overlayfs-snapshotter, zot, opa, eksctl, newrelic-infrastructure-agent, grype-db, steampipe, k8ssandra-client-fips, helm-mapkubeapis,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, linkerd2, trivy-operator, cerbos, kube-arangodb, headlamp, tigera-operator, k9s, helm-operator, chartmuseum, kubescape, nova, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, helm-mapkubeapis, rancher-fleet, chart-testin...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, linkerd2, trivy-operator, cerbos, kube-arangodb, headlamp, tigera-operator, k9s, helm-operator, chartmuseum, kubescape, nova, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, helm-mapkubeapis, rancher-fleet, chart-testin...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: omnibump, mariadb-operator, tailscale, flux-notification-controller, victoriametrics-cluster, grafana-rollout-operator, supercronic, secrets-store-csi-driver-provider-aws, mountpoint-s3-csi-driver, ingress-nginx-controller, polaris, actions-runner-controller,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: pulumi-language-java, vcluster, crossplane-provider-family-aws, crossplane-provider-aws-sns, docker, grafana, snyk-cli, terraform-provider-pagerduty, pulumi, crossplane-provider-aws-firehose, grype, datadog-agent, kubescape, guac, apko, pulumi-kubernetes-operator,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, vcluster, crossplane-provider-family-aws, crossplane-provider-aws-sns, docker, grafana, snyk-cli, terraform-provider-pagerduty, pulumi, crossplane-provider-aws-firehose, grype, datadog-agent, kubescape, guac, apko, pulumi-kubernetes-operator,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: logstash-exporter, sriov-network-device-plugin, argo-cd, crossplane-provider-aws-kms, aws-ebs-csi-driver-fips, dfc, cilium-envoy, runc, helm-operator, kubernetes-csi-external-attacher, flagger, protoc-gen-go-grpc, migrate, teleport-operator-fips, kwok,...

BIT-FLUX-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

BIT-FLUX-2022-24817 Improper kubeconfig validation allows arbitrary code execution

Flux2 is an open and extensible continuous delivery solution for Kubernetes. Flux2 versions between 0.1.0 and 0.29.0, helm-controller 0.1.0 to v0.19.0, and kustomize-controller 0.1.0 to v0.23.0 are vulnerable to Code Injection via malicious Kubeconfig. In multi-tenancy deployments this can also...

EUVD-2022-6887

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: trivy, helm-operator, mockgen, consul-k8s, migrate, nri-mysql, cis-operator, knative-serving, teleport, wait-for-port, nri-f5, harbor-registry, nri-haproxy, swagger, nri-redis, zot, controller-gen, src, opa, eksctl, wal-g, steampipe, nova, rancher-security-scan, tkn,...

CVE-2025-55199 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, linkerd2, trivy-operator, cerbos, headlamp, k8sgpt, k9s, helm-operator, chartmuseum, kubescape, kargo, nova, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, helm-mapkubeapis, rancher-fleet, chart-testing, envoy-gateway,...

CVE-2025-55198 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, linkerd2, trivy-operator, cerbos, headlamp, k8sgpt, k9s, helm-operator, chartmuseum, kubescape, kargo, nova, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, helm-mapkubeapis, rancher-fleet, chart-testing, envoy-gateway,...

GHSA-F9F8-9PMF-XV68 vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, linkerd2, trivy-operator, cerbos, headlamp, k8sgpt, k9s, helm-operator, chartmuseum, kubescape, kargo, nova, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, helm-mapkubeapis, rancher-fleet, chart-testing, envoy-gateway,...

GHSA-9H84-QMV7-982P vulnerabilities

Vulnerabilities for packages: cluster-api-helm-controller, linkerd2, trivy-operator, cerbos, headlamp, k8sgpt, k9s, helm-operator, chartmuseum, kubescape, kargo, nova, k8ssandra-client, eksctl, pluto, helm-push, zot, trivy, helm-docs, helm-mapkubeapis, rancher-fleet, chart-testing, envoy-gateway,...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: chartmuseum, kubescape, trivy, harbor-fips, helm-operator, consul-k8s, trivy-fips, cert-manager-cmctl-fips, chart-testing-fips, flux-helm-controller, k8ssandra-client, chart-testing, cluster-api-helm-controller-fips, cert-manager-cmctl, pluto, helm-push, flux-fips,...