GO-2026-4883 vulnerabilities

Vulnerabilities for packages: buildah, spire-server, docker, osv-scanner, splunk-otel-collector, wolfictl, openfga, undock, rancher-agent, gatekeeper, neuvector-scanner, zarf, opentelemetry-collector-contrib, goreleaser, ko, pulumi, envoy-gateway, apko, opentelemetry-operator, zot, rancher-machin...

GO-2026-4866 vulnerabilities

Vulnerabilities for packages: flux, grafana-operator, envoy-ratelimit, nfs-subdir-external-provisioner, osv-scanner, smarter-device-manager, spire-server, polaris, ingress-nginx-controller, actions-runner-controller, sftpgo-plugin-eventsearch, goreleaser, aws-load-balancer-controller, pluto, apko...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: buildah, kyverno-policy-reporter-kyverno-plugin, nfs-subdir-external-provisioner, spire-server, cloud-sql-proxy, tetragon, trino, cloud-provider-azure, delve, polaris, ingress-nginx-controller, actions-runner-controller, zarf, kubo, kubernetes-csi-livenessprobe,...

GO-2026-4869 vulnerabilities

Vulnerabilities for packages: buildah, gitleaks, spire-server, vault-env, ingress-nginx-controller, argo-cd, step-ca, kyverno, falco-no-driver, rclone, vault-benchmark, pulumi, incert, filebrowser, nats, extism, licenseclassifier, rancher-machine, timoni, docker-cli, k3s, k8ssandra-client, runc,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: buildah, spire-server, wolfictl, zarf, argo-cd, kyverno, crossplane-provider-family-aws, vault-benchmark, pulumi, terraform-provider-tls, rancher-machine, gitlab-runner, k3s, src, crossplane-provider-aws-firehose, dagger, docker-compose, grype, telegraf, slsa-verifie...

GO-2026-5006 vulnerabilities

Vulnerabilities for packages: buildah, spire-server, wolfictl, zarf, argo-cd, kyverno, pulumi, k3s, dagger, grype, telegraf, pulumi-kubernetes-operator, kots, flux-image-automation-controller, prometheus-operator, pulumi-language-java, gomplate, pulumi-language-yaml, witness, gptscript,...

GO-2026-5019 vulnerabilities

Vulnerabilities for packages: buildah, spire-server, wolfictl, zarf, argo-cd, kyverno, vault-benchmark, pulumi, terraform-provider-tls, rancher-machine, gitlab-runner, k3s, dagger, grype, telegraf, slsa-verifier, rootlesskit, pulumi-kubernetes-operator, kots, flux-image-automation-controller,...

GO-2026-5020 vulnerabilities

Vulnerabilities for packages: buildah, spire-server, wolfictl, zarf, argo-cd, kyverno, crossplane-provider-family-aws, vault-benchmark, pulumi, terraform-provider-tls, rancher-machine, gitlab-runner, k3s, src, crossplane-provider-aws-firehose, dagger, docker-compose, grype, telegraf, slsa-verifie...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: gitleaks, kyverno-policy-reporter-kyverno-plugin, nfs-subdir-external-provisioner, spire-server, tetragon, vault-secrets-webhook, rancher-telemetry, ingress-nginx-controller, actions-runner-controller, mongodb-kubernetes-operator, kubo, kubernetes-csi-livenessprobe,...

aa-rag (=0.4.3), acex (>=3.0.0 <=5.28.0) +825 more potentially affected by CVE-2026-32871 via fastmcp (>=0.1.0 <=3.1.1)

fastmcp PYPI version =0.1.0, =3.0.0, =0.2.0, =0.1.0, =0.1.7, =2.1.7, =0.1.0, =1.0.0, =0.4.6, =0.1.0, =1.8.0, =0.1.1, =0.1.5 and more Source cves: CVE-2026-32871 Source advisory: OSV:PYSEC-2026-338...

a7a1234 (=1.0.0), aas2openapi (>=0.2.0 <=0.2.4) +2554 more potentially affected by CVE-2025-43859 via h11 (>=0.10.0 <=0.15.0)

h11 PYPI version =0.10.0, =0.2.0, =0.2.1, =1.2.1, =0.7.3.post0, =0.1.0, =2.0.0.1, =0.0.1, =0.1.0, =0.8.3, =0.1.0, =4.8.2, =0.1.0, =0.1.1 - adminui =1.5.2 and more Source cves: CVE-2025-43859 Source advisory: OSV:PYSEC-2026-348...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: knative-serving, omnictl-multiarch-fips, loki, drone, gitea, cert-manager, kyverno, tekton-pipelines-fips, opentofu-fips, kyverno-fips, coder, seaweedfs-rocksdb, cloud-provider-aws, elastic-agent-fips, gitlab-kas, grafana-fips, harbor, external-secrets-operator,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: buildah, spire-server, wolfictl, zarf, argo-cd, kyverno, vault-benchmark, pulumi, terraform-provider-tls, rancher-machine, gitlab-runner, k3s, dagger, grype, telegraf, slsa-verifier, rootlesskit, pulumi-kubernetes-operator, kots, flux-image-automation-controller,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: flux, containerd, spire-server, osv-scanner, aactl, knative-serving, gitea, zarf, kyverno, cilium-cli, argocd-image-updater, snyk-cli, prometheus, kubescape, loki, zot, external-dns, gitlab-kas, trivy-operator, istio, k3s, kaf, minio, cilium, mattermost, fscrypt,...

com.izivia:ocpp-toolkit (>=1.3.0 <=2.0.2), com.izivia:ocpp-transport-soap (>=1.3.0 <=2.0.2) +321 more potentially affected by unknown CVE via org.http4k:http4k-core (>=5.0.0.0 <=5.41.0.0)

org.http4k:http4k-core MAVEN version =5.0.0.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =0.5.0, =1.30.0, =0.1, =0.11.0, =0.12.7, =0.12.7, =0.11.6, =0.11.0, =0.11.0, =1.4.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-PR33-38XX-6R26...

227checkergenerator (>=1.0.0 <=1.0.1), 5mghost-rover (>=0.0.1 <=0.0.3) +1861 more potentially affected by CVE-2026-54273 via aiohttp (>=0.13.1 <=3.14.0)

aiohttp PYPI version =0.13.1, =1.0.0, =0.0.1, =0.1.1, =0.1.0b0, =1.1.0, =1.0.1, =0.31.5, =0.6.0, =0.0.0, =0.0.33.post1 and more Source cves: CVE-2026-54273 Source advisory: OSV:GHSA-4FVR-RGM6-GQMC...

@neetly/jest-config (>=1.0.0-alpha.14 <=1.0.0-alpha.16), @powerlines/plugin-alloy (>=0.14.0 <=0.26.152) +21 more potentially affected by CVE-2026-49356 via @babel/core (>=8.0.0-alpha.1 <=8.0.0-rc.5)

@babel/core NPM version =8.0.0-alpha.1, =1.0.0-alpha.14, =0.14.0, =0.12.396, =0.6.149, =0.9.0, =0.12.0, =0.12.0, =0.2.99, =0.1.0, =0.1.0, =0.1.71, =0.3.0, =0.3.0, =0.1.0, =0.7.301, =0.7.460 and more Source cves: CVE-2026-49356 Source advisory: OSV:GHSA-4X5R-PXFX-6JF8...

ai.spice:spiceai (=0.6.0), cn.isqing.icloud:icloud-common-utils (>=4.0.3-M1 <=4.0.3.1) +431 more potentially affected by CVE-2026-46340 via io.netty:netty-transport-sctp (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-transport-sctp MAVEN version =4.2.0.Final, =4.0.3-M1, =1.21.9, =3.4.7, =25.4.1, =26.2.1, =7.9.0, =5.1.0, =5.1.0, =6.80, =0.2.2, =0.2.4 and more Source cves: CVE-2026-46340 Source advisory: OSV:GHSA-5XRH-QMMQ-W6CH...

ai.spice:spiceai (=0.6.0), cn.isqing.icloud:icloud-common-utils (>=4.0.3-M1 <=4.0.3.1) +636 more potentially affected by CVE-2026-44893 via io.netty:netty-codec-haproxy (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.Final, =4.0.3-M1, =1.21.9, =3.4.7, =25.4.1, =26.2.1, =7.9.0, =5.1.0, =5.1.0, =6.80, =6.84 and more Source cves: CVE-2026-44893 Source advisory: OSV:GHSA-CC37-9Q2J-3HFV...

@agent-native/core (>=0.26.5 <=0.47.1), @intlayer/backend (=8.7.0-canary.0) +6 more potentially affected by CVE-2026-45337 via better-auth (>=1.6.0 <=1.6.10)

better-auth NPM version =1.6.0, =0.26.5, =0.0.33, =0.2.0, =1.6.0, =0.1.2, =0.2.0 Source cves: CVE-2026-45337 Source advisory: OSV:GHSA-CQ3F-VC6P-68FH...