GO-2026-4985 vulnerabilities

Vulnerabilities for packages: flux, kube-logging-operator, cerbos, opa-envoy, opentelemetry-collector-contrib, grafana-pyroscope, falcosidekick, thanos, cloudprober, knative-eventing, harbor, datadog-agent, k6, keda, external-secrets-operator, flyte, terragrunt, tekton-pipelines, argo-workflows,...

GO-2026-5694 vulnerabilities

Vulnerabilities for packages: zot, teleport, crossplane, policy-controller, trivy, kubescape, ratify, kyverno-notation-aws, slsa-verifier, aactl, trivy-operator, kyverno...

GO-2026-5841 vulnerabilities

Vulnerabilities for packages: flux, k3s, containerd, kaf, k3d, spire-server, kyverno, kine, minio, loki, aactl, kots, telegraf, zot, snyk-cli, helm, falco-no-driver, nerdctl, prometheus-operator...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, flux, mattermost, multus-cni, q, wuzz, actions-runner-controller, k3s, src, chisel, terraform-provider-azurerm, nri-discovery-kubernetes, kube-logging-operator, victoriametrics-cluster, step-ca, tofu-controller,...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: spire-server, kyverno, teleport, ratify, tflint, neuvector-sigstore-interface, tekton-chains, kubescape, goreleaser, kyverno-notation-aws, zarf, crossplane, policy-controller, gitsign, tkn, falcoctl, ko, slsa-verifier, aactl, trivy-operator...

GO-2023-2153 vulnerabilities

Vulnerabilities for packages: scorecard, up, src, buildkitd, kubeflow, k3d, dgraph, kubescape, kubevela, cortex, terraform-provider-sendgrid, slsa-verifier, aactl, spark-operator...

GO-2026-5005 vulnerabilities

Vulnerabilities for packages: flux, mattermost, docker-cli-buildx, k3s, containerd, kaf, spire-server, fscrypt, kyverno, istio, cert-manager, kine, minio, loki, opentelemetry-collector, kots, cilium-cli, cilium, rancher-agent, telegraf, kubernetes, zot, snyk-cli, helm, falco-no-driver,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: flux, mattermost, k3s, src, chisel, kaf, terraform-provider-azurerm, crossplane-provider-aws-lambda, guac, kyverno, trivy, cloudflared, tflint, sops, fulcio, helm, crossplane-provider-aws-cloudfront, nerdctl, skaffold, crossplane-provider-aws-iam, podman,...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, php-fpmexporter, whereabouts, step-ca, kubernetes-dashboard-metrics-scraper, trivy, rancher-telemetry, spqr, bank-vaults, argo-rollouts, gitness, nfs-subdir-external-provisioner, percona-server-mongodb-operator, crossplane-provider-sql, nerdctl,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: mattermost, ingress-nginx-controller, terraform, cert-manager-cmctl, helm-operator, k3s, src, flux-notification-controller, spire-server, tfsec, opensearch-k8s-operator, bom, ferretdb, dask-gateway, flux-kustomize-controller, croc, vale, fuse-overlayfs-snapshotter,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: mattermost, wuzz, actions-runner-controller, cfssl, cert-manager-cmctl, k3s, chisel, src, kube-logging-operator, whereabouts, tofu-controller, crossplane-provider-aws-lambda, guac, ctop, kube-vip-cloud-provider, kubernetes-dashboard-metrics-scraper, manifest-tool,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: witness, docker-cli-buildx, spire-server, kyverno, vexctl, teleport, trivy, cosign, aactl, ratify, flux-source-controller, tflint, zot, neuvector-sigstore-interface, tekton-chains, buildkitd, kubescape, kyverno-notation-aws, skaffold, docker, gh, zarf, crossplane,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: flux, k3s, src, kube-logging-operator, cerbos, guac, portieris, render-template, trivy, aws-application-networking-k8s, chart-testing, docker-machine-driver-harvester, nri-redis, harbor-cli, envconsul, tflint, nats-server-config-reloader, fulcio, cloud-sql-proxy,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: witness, spire-server, vexctl, teleport, trivy, cosign, aactl, ratify, flux-source-controller, tflint, zot, neuvector-sigstore-interface, tekton-chains, buildkitd, kubescape, kyverno-notation-aws, skaffold, docker, gh, zarf, policy-controller, gitsign, tkn,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-image-reflector-controller, flux, actions-runner-controller, terraform, k3s, terraform-provider-azurerm, flux-notification-controller, k3d, spire-server, flux-kustomize-controller, step-ca, guac, opentelemetry-collector-contrib, vexctl,...

CVE-2026-71570: Improper Access Control

Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...

CVE-2025-7639: Deserialization of Untrusted Data

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...

PT-2026-72085

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with "DNA Authority - Operator" privileges can tamper with serialized data. This action may lead to remote code execution during the...

PT-2026-72117

Name of the Vulnerable Software and Affected Versions iCagenda versions prior to 2.0.0-4.0.11 Description Authenticated backend operators with permissions to access the extension can perform SQL injection. This occurs due to an unescaped numeric filter, allowing the injection of malicious SQL...

Security Bulletin: Vault Secrets Operator vulnerable to arbitrary file read and credential exfiltration via AppRole secretIDPath

Summary Vault Secrets Operator 1.3.0 up to 1.4.1 is vulnerable to an arbitrary file read and credential exfiltration issue in the AppRole authentication configuration that may allow a tenant with limited Kubernetes RBAC permissions to read files from the operator pod's filesystem and transmit the...