GO-2026-6094 vulnerabilities

Vulnerabilities for packages: gitlab-kas, cloud-provider-vsphere, flux-notification-controller, zot, spicedb-operator, tetragon, cluster-api-helm-controller, telegraf, kwok, kubescape-operator, pulumi-kubernetes-operator, calico, argocd-image-updater, kube-state-metrics, gatekeeper,...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: cert-manager-openshift-routes-fips, cephcsi-fips, frankenphp-8.4, tofu-controller-fips, chronyexporter, mlrun-log-collector-fips, crossplane-provider-aws-sns, tbot, crossplane-provider-azure-servicefabric, grafana-elasticsearch-datasource,...

GO-2024-2466 vulnerabilities

Vulnerabilities for packages: zot, flux-kustomize-controller, goreleaser, pulumi-kubernetes-operator, kubevela, pulumi-language-yaml, bom, nuclei, gomplate, gitsign, pulumi-language-java, pulumi, pulumi-language-dotnet, apko, go-licenses, src-fingerprint, gitness, scorecard, kots...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: litestream, age-fips, ksops, age, flux-kustomize-controller, sops, grafana, grafana-fips, sops-fips, chezmoi, flux-kustomize-controller-fips...

GO-2024-3321 vulnerabilities

Vulnerabilities for packages: cloud-sql-proxy-fips, azcopy-fips, extism, sqlexporter-fips, haproxy-ingress, src, crossplane-provider-sql, prometheus-mysqld-exporter-fips, rancher-webhook, neuvector, crossplane-provider-aws-sns, gitea-fips, sbomqs, cosign-fips, glab, cilium, kapp-controller-fips,...

GO-2025-3367 vulnerabilities

Vulnerabilities for packages: gitsign, kubevela, pulumi-language-dotnet, flux-source-controller, crossplane, scorecard, grype, kots, gptscript, nuclei, src-fingerprint, grafana-alloy, gitea, apko, k8sgpt, tfsec, go-licenses, melange, snyk-cli, trivy, flux-image-automation-controller, osv-scanner,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: gitsign, kubevela, pulumi-language-dotnet, flux-source-controller, crossplane, scorecard, grype, kots, gptscript, nuclei, src-fingerprint, grafana-alloy, gitea, apko, k8sgpt, tfsec, go-licenses, melange, snyk-cli, trivy, flux-image-automation-controller, osv-scanner,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: boring-registry, policy-controller, spire-server, up, wal-g, flux-source-controller, tekton-chains, timestamp-authority, harbor-registry, druid, grafana-agent-operator, terragrunt, tkn, nuclei, rclone, k8sgpt, opentelemetry-collector, cortex, fluent-bit-plugin-loki,...

GO-2024-3344 vulnerabilities

Vulnerabilities for packages: ksops, sops, age, litestream, chezmoi, flux-kustomize-controller...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: spire-server, gitsign, flux-source-controller, tekton-chains, terragrunt, tkn, kots, slsa-verifier, dex, flux-kustomize-controller, argo-workflows, cosign, sops, oauth2-proxy, cloudflared, aactl, rekor, vexctl, fulcio, kubescape...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kube-bench, go, crossplane-provider-family-aws, kubevela, azcopy, cloud-sql-proxy, rancher-helm, haproxy-ingress, nri-haproxy, envconsul, opa, glab, dask-gateway, grafana-alloy, jaeger-operator, newrelic-infra-operator, actions-runner-controller,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-family-aws, eksctl, gitlab-kas, flux-source-controller, caddy, docker-compose, glab, crossplane-provider-keycloak, apko, gitea, flux-notification-controller, fscrypt, melange, crossplane-provider-azure-storage, buildkitd,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kube-bench, langfuse, crossplane-provider-family-aws, azcopy, eksctl, rancher-helm, nri-haproxy, nri-postgresql, postgres-operator, cloud-provider-vsphere, pguser, dkron, dask-gateway, flux-notification-controller, newrelic-infra-operator, kuberlr, nats-top,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: policy-controller, spire-server, gh, gitsign, kubevela, flux-source-controller, tekton-chains, scorecard, crossplane-provider-azure-sql, terragrunt, tkn, k3s, nuclei, src-fingerprint, glab, opentelemetry-collector-contrib, skopeo, flux-notification-controller,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: eksctl, gitlab-kas, flux-source-controller, caddy, glab, gitea, apko, flux-notification-controller, fscrypt, melange, crossplane-provider-azure-storage, buildkitd, crossplane-provider-azure-authorization, flux-image-automation-controller, prometheus, age, zot, chezmo...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: cerbos, azcopy-fips, sqlexporter-fips, cephcsi-fips, hydra, agentbeat, frankenphp-8.4, src, vault-fips, vault-secrets-operator, seaweedfs-rocksdb-fips, neuvector, gitlab-workhorse-ce, cosign-fips, cilium, tw, vault-csi-provider-fips, openbao, syft-fips,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: gitsign, crossplane-provider-family-aws, kubevela, flux-source-controller, grafana-alloy, crossplane-provider-keycloak, apko, gitea, flux-notification-controller, melange, crossplane-provider-azure-storage, buildkitd, crossplane-provider-azure-authorization,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: gitsign, crossplane-provider-family-aws, kubevela, flux-source-controller, grafana-alloy, crossplane-provider-keycloak, apko, gitea, flux-notification-controller, melange, crossplane-provider-azure-storage, buildkitd, crossplane-provider-azure-authorization,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, cerbos, crossplane-provider-aws-kms-fips, cilium-cli, rancher-fleet, tekton-pipelines-fips, pulumi-kubernetes-operator, pulumi-language-yaml, extism, hydra, nuclei, crossplane-provider-family-azure, vault-fips, crossplane-provider-aws-dynamodb-fip...

BIT-FLUX-2022-24878 Improper path handling in Kustomization files allows for denial of service

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to cause a Denial of Service at the controller level. Workarounds include automated tooling in the user's CI/CD pipeline to...