GO-2026-5327 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent, consul-k8s, cortex, grafana-agent-operator, external-secrets-operator, ksops, vcluster, kubeflow-pipelines, cilium, migrate, kubescape-operator, promxy, tekton-chains, grafana, ratify, ferretdb, wal-g, thanos, opentelemetry-collector-contrib,...

GO-2024-2918 vulnerabilities

Vulnerabilities for packages: rekor, cortex, grafana-agent-operator, ksops, up, flux-image-reflector-controller, step-ca, timestamp-authority, trivy, boring-registry, flux-kustomize-controller, cosign, fulcio, argo-workflows, tekton-chains, flyte, sops, zot, chezmoi, py3-azure-identity, hugo,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: speedtest-go, crossplane, osv-scanner, cortex, crossplane-provider-aws-kinesis, vertical-pod-autoscaler, cloud-sql-proxy, snyk-cli, step-ca, crossplane-provider-azure-sql, cri-tools, traefik, dgraph, containerd, crossplane-provider-aws-kms, flux-kustomize-controller,...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: cortex, kaf, step-ca, crossplane-provider-azure-sql, certificate-transparency, dgraph, flux-kustomize-controller, cosign, argo-workflows, tekton-chains, k3s, sops, kots, conftest, libssh, gh, terragrunt, dex, eksctl, temporal-ui-server,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, falco-exporter, cloud-sql-proxy, external-dns, certificate-transparency, secrets-store-csi-driver-provider-gcp, cosign, crossplane-provider-aws-kms, steampipe, sops, grafana, gitlab-pages, spqr, task, rke2-cloud-provider, envoy-ratelimi...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: osv-scanner, kaf, crossplane-provider-aws-kinesis, snyk-cli, external-dns, crossplane-provider-azure-sql, pulumi-language-yaml, rancher-machine, traefik, kine, containerd, cosign, crossplane-provider-aws-kms, flux-kustomize-controller, steampipe, gatus, tekton-chains...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: cert-manager-cmctl, croc, osv-scanner, timoni, kubeflow-katib, ingress-nginx-controller, opentofu, external-dns, rancher-helm, traefik, kine, flux-kustomize-controller, cosign, scorecard, mc, steampipe, tfsec, flux-notification-controller, k3s, redis-operator, aactl,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: minio-operator, osv-scanner, aws-privateca-issuer, cortex, crossplane-provider-aws-kinesis, vertical-pod-autoscaler, external-dns, crossplane-provider-azure-sql, cri-tools, rancher-machine, s5cmd, traefik, kubelet-csr-approver, kine, flux-kustomize-controller, cosign...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: yam, falco-exporter, certificate-transparency, secrets-store-csi-driver-provider-gcp, cosign, steampipe, render-template, rke2-cloud-provider, rancher-telemetry, secrets-store-csi-driver-provider-azure, velero, podman, ip-masq-agent, cluster-api-gcp-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cloud-sql-proxy, timescaledb-tune, aws-otel-collector, dgraph, containerd, cluster-api-helm-controller, nri-haproxy, steampipe, k3s, tekton-chains, nova, wgcf, harbor-cli, cis-operator, render-template, pluto, wire-go, conftest, nri-apache, dex,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, age, yam, certificate-transparency, secrets-store-csi-driver-provider-gcp, cosign, crossplane-provider-aws-kms, sops, spqr, gitleaks, nri-mongodb, render-template, task, wire-go, envoy-ratelimit, secrets-store-csi-driver-provider-azure,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rekor, k3d, ksops, skopeo, gitsign, crossplane-provider-azure-storage, flux-image-reflector-controller, snyk-cli, step-ca, crossplane-provider-azure-sql, timestamp-authority, actions-runner-controller, scorecard, flux-kustomize-controller, cosign, fulcio,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, yam, certificate-transparency, secrets-store-csi-driver-provider-gcp, cosign, crossplane-provider-aws-kms, sops, spqr, gitleaks, nri-mongodb, render-template, task, wire-go, envoy-ratelimit, secrets-store-csi-driver-provider-azure,...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73302

Budibase is an open-source low-code platform. Prior to 3.39.30, the OIDC flow in packages/backend-core/src/middleware/passport/sso/oidc.ts resolved an email without getEmailVerified or an emailverified requirement, and packages/backend-core/src/middleware/passport/sso/sso.ts then used...

CVE-2026-73304

Summary: Budibase prior to 3.39.25 exposed OAuth2 tokens (oauth2.accessToken, oauth2.refreshToken) in user metadata responses. The list endpoint (/api/users/metadata) and the single-user endpoint (/api/users/metadata/:id) return full user profiles without removing these fields, enabling any user ...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840 OpenChoreo: Unauthenticated build/workflow trigger via git-provider confusion (webhook signature bypass)

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...

CVE-2026-73840

OpenChoreo is affected by a vulnerability in the POST /api/v1alpha1/autobuild endpoint (internal/openchoreo-api/api/handlers/webhook_handler.go) where a webhook provider is chosen from caller-controlled X-Event-Key, Bitbucket requests may be accepted without HMAC-SHA256 in X-Hub-Signature or a co...

CVE-2026-18511

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary cod...