GO-2026-5052 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-solutions, cert-manager, crossplane-provider-azure-relay, splunk-otel-collector-fips, crossplane-provider-azure-signalrservice, crossplane-provider-azure-web, crossplane-provider-azure-operationsmanagement, external-secrets-operator,...

GO-2026-5224 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, rancher, vault, azure-service-operator, vault-fips, authentik-fips, rancher-agent, authentik, cloudbeat, azure-service-operator-fips...

GO-2026-4909 vulnerabilities

Vulnerabilities for packages: steampipe, gitlab-runner, flux-image-automation-controller-fips, kaniko, crossplane-fips, argo-workflows, gitlab-rails-ce-fips, rancher-fleet-fips, rancher-fleet, kubescape-server-fips, pulumi-kubernetes-operator, src-fingerprint, kyverno, pulumi-language-dotnet,...

GO-2025-4245 vulnerabilities

Vulnerabilities for packages: k8sgateway, jaeger-fips, nrdot-collector-k8s-fips, aws-otel-collector, verticadb-operator-fips, splunk-otel-collector-fips, opentelemetry-collector-fips, keda-fips, coredns-fips, rke2-runtime, opentelemetry-collector, grafana-alloy-fips, nats, keda,...

GO-2023-2102 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, prometheus-mongodb-exporter-fips, prometheus-mongodb-exporter, kiam, flux-kustomize-controller, prometheus-statsd-exporter, aws-ebs-csi-driver, metrics-server-fips, prometheus-adapter, nfs-subdir-external-provisioner,...

GO-2024-2453 vulnerabilities

Vulnerabilities for packages: spire-server-fips, crossplane-provider-aws-kms, crossplane-provider-aws-cloudformation, crossplane-provider-aws-dynamodb, zot, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-route53, crossplane-provider-aws-cloudfront, tekton-chains,...

GO-2026-5005 vulnerabilities

Vulnerabilities for packages: knative-serving-fips, prometheus-mongodb-exporter, gatekeeper, opentelemetry-collector, mattermost, argo-workflows, gitlab-rails-ce-fips, rancher-agent, etcd-fips, spire-server, prometheus-fips, mattermost-fips, gatekeeper-fips, prometheus-elasticsearch-exporter, lok...

GO-2026-4971 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, crossplane-provider-azure-solutions, bazelisk, gitlab-operator-fips, spire-controller-manager-fips, gitlab-pages, wazero-fips, agentbeat, prometheus-mongodb-exporter, hugo-fips, yace-fips, crossplane-provider-aws-lexmodels-fips,...

GO-2025-3487 vulnerabilities

Vulnerabilities for packages: spire-controller-manager-fips, prometheus-mongodb-exporter, hugo-fips, velero-plugin-for-microsoft-azure, kiam, flux-kustomize-controller, cortex-fips, prometheus-statsd-exporter, actions-runner-controller-fips, eks-distro-fips, helm-operator, spire-server,...

GO-2025-3420 vulnerabilities

Vulnerabilities for packages: bazelisk, spire-controller-manager-fips, prometheus-mongodb-exporter, hugo-fips, velero-plugin-for-microsoft-azure, kiam, flux-kustomize-controller, cortex-fips, prometheus-statsd-exporter, actions-runner-controller-fips, docker-cli-fips, helm-operator, nri-couchbase...

GO-2024-2887 vulnerabilities

Vulnerabilities for packages: nri-memcached, bazelisk, prometheus-mongodb-exporter, kiam, flux-kustomize-controller, cortex-fips, prometheus-statsd-exporter, actions-runner-controller-fips, rabbitmq-cluster-operator, nri-couchbase, helm-operator, spire-server, prometheus-adapter, configmap-reload...

GO-2026-4947 vulnerabilities

Vulnerabilities for packages: nri-kafka, redka, aws-signer-notation-plugin, tailscale, spqr, kubernetes-dashboard-api, wave, cadvisor, php-fpmexporter, sriov-network-device-plugin, gobuster, bom, fuse-overlayfs-snapshotter, grafana-operator, openbao-k8s, nova, tetragon, yunikorn-k8shim, kubewatch...

Malicious code in @onereach/regular-expressions-test (npm)

npm/@onereach/regular-expressions-test is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

Malicious code in @servicetitan/assist-utils (npm)

npm/@servicetitan/assist-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11632 Malicious code in @onereach/si-code (npm)

npm/@onereach/si-code is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11910 Malicious code in @servicetitan/onboarding-ui (npm)

npm/@servicetitan/onboarding-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: grype, splunk-otel-collector, kine, external-secrets-operator, kubernetes, external-dns, prometheus, opentofu, argocd-image-updater, melange, gptscript, prometheus-operator, terragrunt, datadog-agent, gitlab-runner, opentelemetry-collector, act, trivy-operator,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: trivy-operator, kots, snyk-cli, gitea, kyverno, trivy, kubernetes-dashboard, spire-server, flux-source-controller, flux-image-automation-controller, kine, cert-manager, external-secrets-operator, cloud-provider-aws, flux, minio, zarf, kubernetes, external-dns,...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: grype, splunk-otel-collector, kine, external-secrets-operator, kubernetes, external-dns, prometheus, opentofu, argocd-image-updater, melange, gptscript, prometheus-operator, terragrunt, datadog-agent, gitlab-runner, opentelemetry-collector, act, trivy-operator,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: trivy-operator, kots, snyk-cli, gitea, kyverno, trivy, kubernetes-dashboard, spire-server, flux-source-controller, flux-image-automation-controller, kine, cert-manager, external-secrets-operator, cloud-provider-aws, flux, minio, zarf, kubernetes, external-dns,...