GO-2026-5014 vulnerabilities

Vulnerabilities for packages: helm, k3s, telegraf, chisel, rancher, falco-no-driver, nerdctl, external-dns, fscrypt, gitlab-kas, trivy-operator, flux-source-controller, minio, cloud-provider-aws, docker-machine-driver-harvester, kubernetes-dashboard, knative-serving, mattermost, zot, prometheus,...

GO-2026-4982 vulnerabilities

Vulnerabilities for packages: conftest, hubble, karpenter, k8sgpt, certificate-transparency, karma, authservice, terraform-provider-acme, dbmate, kubernetes-csi-node-driver-registrar, mattermost, undock, scorecard, dagger, apko, jitsucom-bulker, migrate, harbor, istio, aws-flb-kinesis, gatus,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: helm, k3s, telegraf, wolfictl, falco-no-driver, nerdctl, pulumi, external-dns, fscrypt, gitlab-kas, trivy-operator, gomplate, datadog-agent, flux-source-controller, minio, nuclei, terragrunt, pulumi-language-dotnet, argo-events, cloud-provider-aws,...

GO-2026-4977 vulnerabilities

Vulnerabilities for packages: conftest, hubble, karpenter, k8sgpt, nats, datadog-agent, kubernetes-csi-node-driver-registrar, mattermost, undock, scorecard, harbor, pgtimetable, istio, aws-flb-kinesis, gatus, cilium-certgen, containerd, cluster-autoscaler, go, ko, slsa-verifier, aactl,...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi, openbao, hubble, nats, certificate-transparency, incert, supercronic, gcsfuse, dgraph, kubernetes-event-exporter, nsc, dbmate, mods, scorecard, terraform, apko, harbor, kubernetes-csi-external-resizer, aws-flb-kinesis, terraform-docs,...

GO-2026-4978 vulnerabilities

Vulnerabilities for packages: conftest, hubble, karpenter, k8sgpt, nats, pdfcpu, certificate-transparency, incert, karma, datadog-agent, sonobuoy, authservice, victoriametrics-cluster, terraform-provider-acme, kube-logging-operator, amazon-cloudwatch-agent, dbmate, cni-plugins,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, configmap-reload, go-licenses, nats, oras, kind, cortex, go-bindata, dgraph, amass, sonobuoy, nsc, go-md2man, grpcurl, cni-plugins, docker-credential-ecr-login, gke-gcloud-auth-plugin, helm-push, petname, gops, kubernetes-dashboard-metrics-scraper, cto...

GO-2026-4354 vulnerabilities

Vulnerabilities for packages: crossplane, buildkitd, trivy-operator, gitsign, flux-source-controller, tekton-chains, zot, ratify, policy-controller, tkn, zarf, gh, neuvector-sigstore-interface, falcoctl, teleport, vexctl, kyverno, goreleaser, skaffold, spire-server, cosign, witness, ko,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: conftest, k3s, telegraf, terraform-provider-pagerduty, hubble, k8sgateway, src, falco-no-driver, nerdctl, external-dns, redka, flux-kustomize-controller, mc, flux-notification-controller, tfsec, minio, eksctl, helm-set-status, gitness, kubernetes-dashboard,...

GO-2026-4918 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi, velero-plugin-for-csi, openbao, hubble, incert, gcsfuse, karma, dgraph, flux-kustomize-controller, kubernetes-event-exporter, kiali, dbmate, mods, undock, scorecard, terraform, loki, apko, harbor, kubernetes-csi-external-resizer,...

GO-2023-2383 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, configmap-reload, go-licenses, nats, oras, kind, cortex, go-bindata, dgraph, amass, sonobuoy, nsc, go-md2man, grpcurl, cni-plugins, docker-credential-ecr-login, gke-gcloud-auth-plugin, helm-push, petname, gops, kubernetes-dashboard-metrics-scraper, cto...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: conftest, aws-sigv4-proxy, aws-privateca-issuer, hubble, yunikorn-k8shim, percona-server-mongodb-operator, src, kubernetes-csi-livenessprobe, langfuse, external-dns, flux-kustomize-controller, authservice, kubernetes-event-exporter, sonobuoy, gitlab-runner,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi, hubble, certificate-transparency, incert, supercronic, karma, dgraph, flux-kustomize-controller, kiali, amazon-cloudwatch-agent, dbmate, mods, undock, terraform, apko, aws-flb-kinesis, docker-cli, aws-eks-pod-identity-agent,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager, conftest, terraform-provider-azapi, aws-privateca-issuer, hubble, k8sgpt, src, gcsfuse, chartmuseum, cluster-api-helm-controller, dgraph, fzf, kube-logging-operator, wire-go, docker-machine-driver-harvester, cni-plugins,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: terraform-provider-azapi, openbao, opentelemetry-operator, k8sgpt, sqlexporter, grafana-agent-operator, chartmuseum, dgraph, flux-kustomize-controller, terragrunt, amazon-cloudwatch-agent, gitness, scorecard, policy-controller, terraform, jitsucom-bulker, fulcio,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: k3s, openbao, octo-sts, crossplane, buildkitd, azcopy, crossplane-provider-azure-managedidentity, chartmuseum, crossplane-provider-azure, temporal-server, temporal, wal-g, gitsign, kubernetes-dashboard-auth, flux-notification-controller,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: k3s, timestamp-authority, buildkitd, pulumi, ksops, crossplane-provider-azure-managedidentity, grafana-mimir, crossplane-provider-azure, kargo, gomplate, flux-kustomize-controller, gitsign, kubernetes-event-exporter, flux-notification-controller,...

GO-2025-3487 vulnerabilities

Vulnerabilities for packages: conftest, nats-server, hugo, openbao, nats, opentelemetry-operator, k8sgpt, sqlexporter, oras, certificate-transparency, src, gcsfuse, grafana-agent-operator, chartmuseum, flux-kustomize-controller, authservice, kubernetes-event-exporter, kiali, terragrunt,...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...