io.spinnaker.echo:echo-api-tck (2.36.1), io.spinnaker.echo:echo-notifications (2.36.1) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.36.1)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.36.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.36.1 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.36.4), io.spinnaker.echo:echo-notifications (2.36.4) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.36.4)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.36.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.36.4 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.36.3), io.spinnaker.echo:echo-notifications (2.36.3) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.36.3)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.36.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.36.3 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (>=2026.0-19, <=2026.0-23), io.spinnaker.echo:echo-notifications (>=2026.0-19, <=2026.0-23) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (>=2026.0-19, <=2026.0-23)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-23 Source cves: CVE-2026-32613 Source advisory: GHSA-69RW-45WJ-G4V6...

io.spinnaker.echo:echo-api-tck (2.37.2), io.spinnaker.echo:echo-notifications (2.37.2) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.37.2)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.37.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.37.2 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.36.2), io.spinnaker.echo:echo-notifications (2.36.2) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.36.2)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.36.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.36.2 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.36.0), io.spinnaker.echo:echo-notifications (2.36.0) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.36.0)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.36.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.36.0 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-288), io.spinnaker.echo:echo-notifications (main-288) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-288)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-288 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-288 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (main-295), io.spinnaker.echo:echo-notifications (main-295) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (main-295)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version main-295 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck main-295 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (2.44.5), io.spinnaker.echo:echo-notifications (2.44.5) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (2.44.5)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version 2.44.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.spinnaker.echo:echo-pipelinetriggers and may be impacted: - io.spinnaker.echo:echo-api-tck 2.44.5 - io.spinnaker.echo:echo-notifications...

io.spinnaker.echo:echo-api-tck (>=main-272, <=2.47.2), io.spinnaker.echo:echo-notifications (>=main-272, <=2.47.2) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (>=main-272, <=2.47.2)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =main-272, =2.47.2 Source cves: CVE-2026-32613 Source advisory: MEND:CVE-2026-32613...

io.spinnaker.echo:echo-api-tck (>=2026.0-19, <=2026.0-23), io.spinnaker.echo:echo-notifications (>=2026.0-19, <=2026.0-23) +6 more potentially affected by CVE-2026-32613 via io.spinnaker.echo:echo-pipelinetriggers (>=2026.0-19, <=2026.0-23)

io.spinnaker.echo:echo-pipelinetriggers MAVEN version =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-19, =2026.0-23 Source cves: CVE-2026-32613 Source advisory: MEND:CVE-2026-32613...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

PT-2026-31735

Name of the Vulnerable Software and Affected Versions Flux notification-controller versions prior to 1.8.3 Description Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. The gcr Receiver type does not validate the email claim of...

CVE-2026-24004 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint

Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of individual Android devices from Fleet...

PT-2026-22115

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.80.1 Description Fleet is open source device management software. A flaw in the Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized...

open62541:fuzz_pubsub_binary: Use-of-uninitialized-value in UA_NetworkMessage_decodePayload

Project: https://github.com/open62541/open62541.git Detailed Report: https://oss-fuzz.com/testcase?key=6747482494402560 Project: open62541 Fuzzing Engine: libFuzzer Fuzz Target: fuzzpubsubbinary Job Type: libfuzzermsanopen62541 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

CVE-2026-1301

CVE-2026-1301 pertains to o6 Automation GmbH Open62541 (Open62541/Open62541-like builds) where in PubSub with JSON decoding enabled a crafted JSON message can cause a heap-allocated array write beyond bounds before authentication, leading to a process crash and memory corruption. Affected compone...