GO-2026-6094 vulnerabilities

Vulnerabilities for packages: apisix-ingress-controller, openfga, fluent-operator, metallb, spqr, kubernetes-csi-external-health-monitor, node-feature-discovery, grafana, cloud-provider-aws, keda, k3s, kapp-controller, kyverno-notation-aws, tetragon, opentelemetry-operator,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: grafana-agent-operator, cluster-api-gcp-controller-fips, crossplane-provider-aws-efs-fips, kubeflow, kubernetes-csi-external-provisioner-fips, osv-scanner, timestamp-authority, crossplane-provider-aws-efs, crossplane-provider-azure-spring, atlas-fips, beats,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: kubevela, go-licenses, gomplate, goreleaser, pulumi-language-yaml, scorecard, gitsign, nuclei, pulumi-kubernetes-operator, src-fingerprint, flux-kustomize-controller, pulumi-language-dotnet, pulumi-language-java, bom, zot, kots, apko, gitness, pulumi...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: sops-fips, flux-kustomize-controller-fips, age-fips, sops, chezmoi, age, grafana, grafana-fips, flux-kustomize-controller, litestream, ksops...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, promxy, flux-helm-controller, grafana-agent-operator, crossplane-provider-aws-firehose, kube-logging-logging-operator, prometheus-operator-fips, kubernetes-fips, docker-compose-fips, seaweedfs, openbao, kubeflow, boring-registry,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: syft, scorecard, go-licenses, melange, nuclei, kargo, k9s, gitea, pulumi-language-yaml, argo-events, grype, k8sgpt, wolfictl, flux-image-automation-controller, apko, gptscript, grafana-alloy, dagger, argocd-image-updater, kubevela, trivy, crossplane, chezmoi, kots,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: syft, scorecard, go-licenses, melange, nuclei, kargo, k9s, gitea, pulumi-language-yaml, argo-events, grype, k8sgpt, wolfictl, flux-image-automation-controller, apko, gptscript, grafana-alloy, dagger, argocd-image-updater, kubevela, trivy, crossplane, chezmoi, kots,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: nuclei, py3-azure-identity, up, spire-server, flux-image-reflector-controller, cortex, boring-registry, sqlpad, argo-events, step-ca, policy-controller, rekor, harbor-registry, hugo, k8sgpt, ksops, rook, grafana-mimir, py3-cassandra-medusa, trivy, wal-g,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: age, ksops, sops, flux-kustomize-controller, chezmoi, litestream...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: dbmate, docker-machine-driver-linode, azure-workload-identity-webhook, kube-vip, crossplane-provider-aws-cloudformation, rekor, harbor-registry, wuzz, bento, step-issuer, dynamic-localpv-provisioner, ksops, migrate, percona-server-mongodb-operator, vault-k8s, telegra...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: spire-server, rekor, slsa-verifier, kots, cosign, aactl, dex, vexctl, tkn, flux-source-controller, tekton-chains, flux-kustomize-controller, gitsign, terragrunt, kubescape, argo-workflows, fulcio, oauth2-proxy, sops, cloudflared...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: scorecard, docker-machine-driver-linode, melange, nuclei, fscrypt, gitea, gh, crossplane-provider-aws-cloudformation, grype, step-issuer, ksops, gptscript, telegraf, steampipe, argocd-image-updater, ko, chezmoi, aactl, zarf, nfpm, gitlab-pages, go-discover, guac,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: redis-operator, dbmate, docker-machine-driver-linode, go-licenses, scorecard, azure-workload-identity-webhook, minio-operator, aws-sigv4-proxy, kuberlr, spire-controller-manager, clickhouse-operator, crossplane-provider-aws-cloudformation, hey, grpcurl,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure, scorecard, nuclei, k3s, kargo, spire-server, flux-image-reflector-controller, kubernetes-event-exporter, gh, step-ca, argo-events, policy-controller, rekor, gomplate, flux-image-automation-controller, ksops, neuvector-sigstore-interface,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: scorecard, melange, nuclei, fscrypt, gitea, gh, grype, step-issuer, ksops, gptscript, telegraf, steampipe, argocd-image-updater, ko, chezmoi, aactl, zarf, nfpm, guac, go-discover, rootlesskit, cluster-api-azure-controller, buildah, trivy-operator, osv-scanner, ranche...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: ratify-fips, seaweedfs, openbao, boring-registry, external-secrets-fips, witness, timestamp-authority, cloudflared-fips, keda, beats, livekit-cli, datadog-agent-fips, grpc-health-probe-fips, google-osconfig-agent, azcopy-fips, prometheus-podman-exporter-fips, ko-fips...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: scorecard, melange, nuclei, gitea, crossplane-provider-aws-cloudformation, grype, ksops, gptscript, cert-manager-cmctl, argocd-image-updater, aactl, zarf, nfpm, guac, trivy-operator, osv-scanner, flux, atlantis, tfsec, terraform-provider-pagerduty, xeol,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: scorecard, melange, nuclei, gitea, crossplane-provider-aws-cloudformation, grype, ksops, gptscript, cert-manager-cmctl, argocd-image-updater, aactl, zarf, nfpm, guac, trivy-operator, osv-scanner, flux, atlantis, tfsec, terraform-provider-pagerduty, xeol,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: buildkitd, nfpm, crossplane-provider-aws-rds, databricks-cli, kubevela, ratify-fips, flux-helm-controller, guac, argocd-image-updater, crossplane-provider-aws-cloudwatchlogs-fips, crossplane-provider-aws-firehose, helm, goreleaser, terraform-provider-azuread-fips,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...