GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: octo-sts, kratos, ksops-fips, nri-redis-fips, flux-kustomize-controller, harbor-fips, cloud-provider-azure-fips, grafana-agent-operator, plutono, cyberark-secrets-provider-for-k8s-fips, tfsec, cloud-provider-gcp-cloud-controller-manager-fips, direnv,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: nuclei, zot, pulumi-language-dotnet, goreleaser, flux-kustomize-controller, src-fingerprint, scorecard, kots, kubevela, pulumi-kubernetes-operator, gitness, gitsign, pulumi-language-yaml, bom, apko, gomplate, go-licenses, pulumi-language-java, pulumi...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: grafana, litestream, chezmoi, flux-kustomize-controller-fips, sops-fips, age, age-fips, ksops, flux-kustomize-controller, grafana-fips, sops...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: octo-sts, distribution, conftest-fips, openbao-k8s-fips, syft, flux-kustomize-controller, harbor-fips, cloud-provider-azure-fips, kots, grafana-agent-operator, tfsec, crossplane-provider-azure-managedidentity, spicedb, external-secrets-fips, spqr, weaviate,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: snyk-cli, skaffold, flux-image-automation-controller, kots, argo-workflows, k9s, gitea, grype, flux-kustomize-controller, tfsec, melange, timoni, crossplane, gitsign, zot, flux, trivy, osv-scanner, kaniko, bom, apko, scorecard, k8sgpt, task, syft, zarf,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: snyk-cli, skaffold, flux-image-automation-controller, kots, argo-workflows, k9s, gitea, grype, flux-kustomize-controller, tfsec, melange, timoni, crossplane, gitsign, zot, flux, trivy, osv-scanner, kaniko, bom, apko, scorecard, k8sgpt, task, syft, zarf,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, ksops, wal-g, tekton-chains, grafana-agent-operator, fulcio, hugo, harbor-registry, rekor, up, trino, argo-workflows, hugo-extended, flux-kustomize-controller, timestamp-authority, step, zot, flux, nuclei, trivy, cosign, thanos,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: litestream, ksops, chezmoi, sops, age, flux-kustomize-controller...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: tekton-chains, fulcio, rekor, kots, slsa-verifier, argo-workflows, flux-kustomize-controller, aactl, gitsign, cosign, cloudflared, dex, sops, flux-source-controller, tkn, kubescape, vexctl, oauth2-proxy, terragrunt, spire-server...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: snyk-cli, kubescape-operator, spicedb-operator, harbor-registry, gomplate, terraform-provider-acme, sftpgo-plugin-auth, temporal-server, haproxy-ingress, gitlab-runner, temporal-ui-server, crossplane-provider-azure-authorization, kots,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: snyk-cli, terraform-provider-acme, gomplate, gitlab-runner, skaffold, crossplane-provider-azure-authorization, kots, k9s, knative-serving, flux-kustomize-controller, flux, atlantis, crossplane-provider-aws-sqs, datadog-agent, telegraf, eksctl, podman, scorecard,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kubescape-operator, nginx-prometheus-exporter, calico, docker-credential-gcr, kubernetes-dns-node-cache, harbor-registry, sftpgo-plugin-auth, temporal-ui-server, gitlab-runner, ferretdb, ghaudit, rancher-loglevel, container-object-storage-interface, rancher-telemetry...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: sigstore-scaffolding, snyk-cli, ksops, tekton-chains, terraform, fulcio, rekor, gomplate, actions-runner-controller, flux-image-automation-controller, kubernetes-event-exporter, crossplane-provider-azure-authorization, slsa-verifier, step-ca, flux-kustomize-controlle...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: snyk-cli, gomplate, gitlab-runner, skaffold, crossplane-provider-azure-authorization, kots, k9s, knative-serving, flux-kustomize-controller, flux, atlantis, datadog-agent, telegraf, eksctl, podman, scorecard, docker-machine-driver-harvester, flux-source-controller,...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: octo-sts, distribution, conftest-fips, syft, flux-kustomize-controller, harbor-fips, kots, chainloop-cli, tfsec, skaffold-fips, spicedb, chainctl-fips, external-secrets-fips, weaviate, cert-manager, minio-fips, telegraf, sops-fips, gitlab-workhorse-ce, datadog-agent,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, snyk-cli, gomplate, gitlab-runner, skaffold, crossplane-provider-azure-authorization, kots, argo-workflows, k9s, flux-kustomize-controller, flux, atlantis, crossplane-provider-aws-sqs, datadog-agent, scorecard, trufflehog, flux-source-controller...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, snyk-cli, gomplate, gitlab-runner, skaffold, crossplane-provider-azure-authorization, kots, argo-workflows, k9s, flux-kustomize-controller, flux, atlantis, crossplane-provider-aws-sqs, datadog-agent, scorecard, trufflehog, flux-source-controller...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, crossplane-provider-aws-kms, kubevela-fips, trivy-fips, guac, grype, crossplane-provider-aws-lambda-fips, syft, flux-kustomize-controller, gitlab-rails-ce, kots, syft-fips, argocd-image-updater, crossplane-provider-aws-iam, gitea-fips, argo-cd, tfsec,...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...

BIT-FLUX-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...