GO-2026-6094 vulnerabilities

Vulnerabilities for packages: helm-operator, kubernetes-csi-external-snapshotter, cluster-api-helm-controller, fluent-operator, kubeflow-pipelines, spqr, tkn, cass-operator, k3s, metallb, node-feature-discovery, openfga, argocd-image-updater, emissary, tekton-pipelines, cilium,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: nuclei, argo-workflows-fips, policy-controller-fips, crossplane-provider-aws-apigateway-fips, crossplane-provider-aws-kinesisanalyticsv2-fips, kserve-rest-proxy, aws-signer-notation-plugin-fips, kepler-fips, fortio, crossplane-provider-aws-ivs-fips, portieris, fscryp...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: nuclei, pulumi-language-java, goreleaser, flux-kustomize-controller, apko, bom, gitsign, pulumi-kubernetes-operator, pulumi, gomplate, zot, scorecard, kots, pulumi-language-yaml, gitness, pulumi-language-dotnet, go-licenses, kubevela, src-fingerprint...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, chezmoi, sops, grafana-fips, sops-fips, litestream, age-fips, grafana, flux-kustomize-controller-fips, ksops, age...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: gitea-fips, nuclei, argo-workflows-fips, prometheus-mongodb-exporter, secrets-store-csi-driver-provider-azure, sigstore-scaffolding, dynamic-localpv-provisioner, vault-csi-provider, cfssl-fips, policy-controller-fips, promxy-fips, linkerd2, gotenberg,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: melange, pulumi-language-yaml, tfsec, grafana-alloy, chezmoi, argo-events, argocd-image-updater, grype, kubescape, scorecard, flux, nuclei, gptscript, src-fingerprint, flux-image-automation-controller, flux-kustomize-controller, kargo, timoni, wolfictl, guac, snyk-cl...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: melange, pulumi-language-yaml, tfsec, grafana-alloy, chezmoi, argo-events, argocd-image-updater, grype, kubescape, scorecard, flux, nuclei, gptscript, src-fingerprint, flux-image-automation-controller, flux-kustomize-controller, kargo, timoni, wolfictl, guac, snyk-cl...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: terragrunt, step-ca, flux-image-reflector-controller, chezmoi, tkn, ksops, cosign, sqlpad, harbor-registry, argo-events, sigstore-scaffolding, grafana-agent-operator, kubescape, velero, flux, nuclei, prometheus-operator, grafana-mimir, flyte, rook, buildkitd, cortex,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: litestream, sops, flux-kustomize-controller, chezmoi, ksops, age...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, nova, manifest-tool, mattermost, neuvector-dbgen, kbld, step-ca, conjur-cli, grafana-rollout-operator, terraform-provider-acme, azcopy, knative-eventing, argo-events, argocd-image-updater, emissary, controller-gen,...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: oauth2-proxy, dex, tkn, cosign, slsa-verifier, kubescape, flux-kustomize-controller, vexctl, aactl, rekor, gitsign, cloudflared, tekton-chains, spire-server, kots, sops, flux-source-controller, fulcio, argo-workflows, terragrunt...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, mattermost, terraform-provider-acme, chezmoi, tkn, argo-events, argocd-image-updater, crossplane-provider-keycloak, witness, rancher-agent, atlantis, kubernetes, terraform-provider-azapi, crossplane-provider-aws-kinesis, hcloud,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, mongodb-kubernetes-operator, vale, undock, manifest-tool, mattermost, kbld, conjur-cli, grafana-rollout-operator, kubernetes-dashboard-api, azcopy, kube-logging-operator-custom-runner, kubernetes-csi-external-resizer,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: terragrunt, kubernetes-event-exporter, terraform, step-ca, flux-image-reflector-controller, tkn, ksops, cosign, k3s, argo-events, crossplane-provider-azure-storage, sigstore-scaffolding, slsa-verifier, gh, kubescape, scorecard, flux, crossplane-provider-azure-sql,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: mattermost, chezmoi, tkn, argo-events, argocd-image-updater, witness, rancher-agent, atlantis, kubernetes, hcloud, flux-kustomize-controller, kaf, kargo, loki, guac, fscrypt, snyk-cli, policy-controller, vault-benchmark, external-dns, k9s, osv-scanner, pulumi, glab,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: prometheus-mongodb-exporter, argo-workflows-fips, sigstore-scaffolding, vault-csi-provider, envoy-gateway-fips, policy-controller-fips, commercial-chainloop-cli, chainctl, dapr-fips, cluster-api-aws-controller, frankenphp-8.4, traefik-fips, dagger, teleport,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-azuread, argo-events, argocd-image-updater, crossplane-provider-keycloak, witness, atlantis, crossplane-provider-aws-kinesis, flux-kustomize-controller, crossplane-provider-aws-ec2, guac, q, snyk-cli,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, terraform-provider-azuread, argo-events, argocd-image-updater, crossplane-provider-keycloak, witness, atlantis, crossplane-provider-aws-kinesis, flux-kustomize-controller, crossplane-provider-aws-ec2, guac, q, snyk-cli,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitea-fips, crossplane-provider-aws-lambda-fips, nuclei, argo-workflows-fips, crossplane-provider-aws-cloudformation-fips, gomplate-fips, crossplane-provider-aws-memorydb, flux-source-controller, crossplane-provider-aws-s3-fips, goreleaser, cloudbeat,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...