GO-2026-4982 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, grafana-pyroscope, gatus, karma, gitaly, minio-object-browser, tempo, spqr, crossplane, scorecard, skopeo, flyte, step, k3s, cloud-sql-proxy, contour, flux, secrets-store-csi-driver-provider-azure, terraform-provider-tls, juicefs...

GO-2026-5014 vulnerabilities

Vulnerabilities for packages: helm, k9s, cilium-cli, cloud-provider-aws, nerdctl, cilium, loki, external-dns, opentelemetry-collector, containerd, zot, skaffold, chisel, trivy-operator, minio, k3s, osv-scanner, docker-machine-driver-harvester, flux, spire-server, kubernetes, aactl,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: helm, k9s, cilium-cli, cloud-provider-aws, nerdctl, dagger, podman, cilium, loki, pulumi-language-dotnet, gptscript, external-dns, opentelemetry-collector, pulumi-kubernetes-operator, containerd, chezmoi, act, zot, opentofu, scorecard, melange, skaffold, syft,...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: podman, nri-rabbitmq, grafana-pyroscope, gatus, gitsign, gitaly, doppler-kubernetes-operator, aws-efs-csi-driver, percona-server-mongodb-operator, gitness, mariadb-operator, k3s, neuvector-dbgen, consul-k8s, flux, polaris, rook, neuvector-scanner, kubescape, redpanda...

GO-2026-4977 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-node-driver-registrar, grafana-pyroscope, gatus, minio-object-browser, crossplane, scorecard, skopeo, flyte, k3s, flux, juicefs, mattermost, hubble, nuclei, sftpgo, k8s-device-plugin, prometheus-operator, pgtimetable, tekton-chains, helm, cilium-cli,...

GO-2026-4978 vulnerabilities

Vulnerabilities for packages: victoriametrics, tw, nri-rabbitmq, kubernetes-csi-node-driver-registrar, grafana-pyroscope, gatus, karma, gitaly, http-echo, mods, newrelic-nri-statsd, minio-object-browser, tempo, spqr, crossplane, scorecard, local-static-provisioner, skopeo, cni-plugins, flyte, ste...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: kubo, cilium-cli, nerdctl, kubernetes-dashboard-api, external-dns, aws-flb-kinesis, fuse-overlayfs-snapshotter, runc, terraform-provider-pagerduty, opentofu, conftest, dask-gateway, gitness, cert-manager-cmctl, redis-operator, ingress-nginx-controller, scorecard,...

GO-2026-4354 vulnerabilities

Vulnerabilities for packages: teleport, gitsign, slsa-verifier, zot, kyverno-notation-aws, tflint, crossplane, falcoctl, vexctl, skaffold, ko, trivy-operator, gh, goreleaser, spire-server, aactl, policy-controller, tkn, kyverno, kubescape, cosign, flux-source-controller, witness, zarf, buildkitd,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: gops, go-md2man, render-template, sops, kind, mage, gosu, slsa-verifier, aws-flb-kinesis, smarter-device-manager, flannel-cni-plugin, protoc-gen-go-grpc, kubernetes-dashboard-metrics-scraper, hey, scorecard, nats, cni-plugins, petname, configmap-reload, dgraph,...

GO-2023-2383 vulnerabilities

Vulnerabilities for packages: gops, go-md2man, render-template, sops, kind, mage, gosu, slsa-verifier, aws-flb-kinesis, smarter-device-manager, flannel-cni-plugin, protoc-gen-go-grpc, kubernetes-dashboard-metrics-scraper, hey, scorecard, nats, cni-plugins, petname, configmap-reload, dgraph,...

GO-2026-4918 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, nri-rabbitmq, loki, grafana-pyroscope, gatus, pulumi-kubernetes-operator, gitaly, doppler-kubernetes-operator, aws-efs-csi-driver, gitness, dagdotdev, k3s, mariadb-operator, terraform-provider-google, consul-k8s, flux, polaris, rook,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: aws-sigv4-proxy, boring-registry, nri-rabbitmq, kubernetes-csi-node-driver-registrar, gatus, external-dns, rancher-loglevel, volume-modifier-for-k8s, newrelic-infra-operator, esbuild, http-echo, doppler-kubernetes-operator, mods, minio-object-browser,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: podman, nri-rabbitmq, gatus, doppler-kubernetes-operator, gitness, k3s, neuvector-dbgen, flux, polaris, rook, sftpgo-plugin-kms, kubescape, cluster-api-gcp-controller, docker, malcontent, git-credential-oauth, k8ssandra-operator, op-geth, sbom-scorecard, cri-tools,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: nri-rabbitmq, nri-mysql, wire-go, nri-redis, tempo, nri-f5, pluto, cni-plugins, timescaledb-tune, k3s, cloud-sql-proxy, flux, polaris, docker-cli, wait-for-port, helm-push, hubble, nuclei, guac, kubernetes-csi-external-health-monitor, nova,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: boring-registry, crossplane-provider-azure-authorization, gitsign, pulumi-kubernetes-operator, tempo, crossplane, distribution, gitness, scorecard, skaffold, vexctl, flyte, step, k3s, flux, rook, openbao, secrets-store-csi-driver-provider-azure, sftpgo-plugin-kms,...

GO-2024-3250 vulnerabilities

Vulnerabilities for packages: boring-registry, azcopy, crossplane-provider-azure-authorization, promxy, gitsign, crossplane-provider-azure-storage, crossplane-provider-azure-managedidentity, pulumi-kubernetes-operator, doppler-kubernetes-operator, terraform-provider-azurerm, zot,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: sops, crossplane-provider-azure-authorization, gitsign, crossplane-provider-azure-storage, opentelemetry-collector, crossplane-provider-azure-managedidentity, pulumi-kubernetes-operator, src-fingerprint, timestamp-authority, slsa-verifier, terraform-provider-azurerm,...

GO-2025-3487 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, ollama, tw, podman, crossplane-provider-aws-kms, crossplane-provider-azure-authorization, gatus, gitsign, pulumi-kubernetes-operator, newrelic-nri-statsd, tempo, spqr, crossplane, distribution, gitness, nri-mssql, scorecard,...

CVE-2026-73842

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, internal/cluster-gateway/server.go exposed /api/proxy/, /api/exec/, and /api/wirelogs/ on an internal listener without requiring a client certificate or token, allowing any...

CVE-2026-73843 OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/...