GO-2026-4358 vulnerabilities

Vulnerabilities for packages: docker-compose, spire-server, podman, falco-no-driver, crossplane, rekor, kyverno, skopeo, tkn, gitsign, buildah, flux-source-controller, kots, policy-controller, buildkitd, cosign, undock, trivy-operator, zot, vexctl, ratify, gh, trivy, ko, falcoctl, portieris,...

GO-2026-4311 vulnerabilities

Vulnerabilities for packages: zarf, kots, kubescape, aactl, sigstore-scaffolding, falcoctl, falco-no-driver, cosign, skopeo, witness, gitsign, tekton-chains, slsa-verifier, vexctl...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: spire-server, crossplane, kyverno, tkn, gitsign, flux-source-controller, docker-cli-buildx, policy-controller, cosign, buildkitd, teleport, trivy-operator, zot, vexctl, ratify, gh, trivy, ko, falcoctl, kyverno-notation-aws, skaffold, zarf, goreleaser, kubescape, aact...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: spire-server, crossplane, rekor, kyverno, tkn, gitsign, flux-source-controller, policy-controller, cosign, buildkitd, teleport, trivy-operator, zot, vexctl, ratify, gh, trivy, ko, falcoctl, kyverno-notation-aws, skaffold, zarf, goreleaser, kubescape, aactl,...

GO-2025-4155 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, gostatsd, etcd, kpt, rabbitmq-default-user-credential-updater, govulncheck, kube-state-metrics, rancher-loglevel, spicedb-operator, tailscale, buildkitd, kubernetes-dns-node-cache, openbao, gomplate, actions-runner-controller, ksops,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, etcd, kpt, cert-manager-csi-driver, kube-state-metrics, fluent-bit-plugin-loki, rancher-loglevel, apko, buildkitd, kubernetes-dns-node-cache, fluxcd-kustomize-mutating-webhook, gomplate, ksops, falco-exporter, aws-nuke, metrics-server, direnv...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: spire-server, crossplane, rekor, kyverno, tkn, gitsign, flux-source-controller, policy-controller, cosign, buildkitd, teleport, trivy-operator, zot, vexctl, ratify, gh, trivy, ko, falcoctl, kyverno-notation-aws, skaffold, zarf, goreleaser, kubescape, aactl,...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-dynamodb, gostatsd, kpt, crossplane-provider-aws-kms, tw, kube-state-metrics, fluent-bit-plugin-loki, apko, tailscale, kubernetes-dns-node-cache, openbao, gomplate, actions-runner-controller, ksops, grafana-mimir,...

GO-2025-3553 vulnerabilities

Vulnerabilities for packages: crossplane, restic, hydra, fluent-bit-plugin-loki, buildkitd, step-ca, openbao, gomplate, zot, promxy, dgraph, actions-runner-controller, ksops, falcoctl, kubernetes, openfga, opentofu, grafana-mimir, atlantis, minio, crossplane-provider-azure-managedidentity,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: spire-server, rekor, wolfictl, tkn, gitsign, flux-source-controller, apko, policy-controller, cosign, zot, melange, vexctl, gh, trivy, falcoctl, zarf, kubescape, aactl, sigstore-scaffolding, neuvector-sigstore-interface, tekton-chains, slsa-verifier...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, gostatsd, kpt, rabbitmq-default-user-credential-updater, govulncheck, fluent-bit-plugin-loki, kube-state-metrics, protoc-gen-go, tailscale, buildkitd, kubernetes-dns-node-cache, gomplate, actions-runner-controller, ksops, nri-haproxy,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-dynamodb, gostatsd, kpt, rabbitmq-default-user-credential-updater, crossplane-provider-aws-kms, govulncheck, fluent-bit-plugin-loki, kube-state-metrics, protoc-gen-go, apko, tailscale, buildkitd, kubernetes-dns-node-cache, gomplate,...

GO-2024-3333 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-dynamodb, gostatsd, kpt, crossplane-provider-aws-kms, kube-state-metrics, fluent-bit-plugin-loki, apko, tailscale, buildkitd, kubernetes-dns-node-cache, openbao, gomplate, actions-runner-controller, ksops,...

GO-2025-3485 vulnerabilities

Vulnerabilities for packages: k3d, istio, wolfictl, dagdotdev, buildah, hydra, apko, step-ca, openbao, gomplate, zot, dagger, dgraph, melange, grpc-health-probe, neuvector-scanner, ksops, falcoctl, opentofu, spiffe-helper, grafana-mimir, minio, dex, step-kms-plugin, goreleaser, kubescape, kargo,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: spire-server, k3d, kubernetes-event-exporter, argo-events, rekor, bank-vaults, skopeo, snyk-cli, scorecard, crossplane-provider-azure-sql, sops, tkn, gitsign, opentelemetry-collector, flux-source-controller, flux-image-reflector-controller, policy-controller,...

GO-2024-2687 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, crossplane-provider-aws-dynamodb, gostatsd, kpt, crossplane-provider-aws-kms, govulncheck, kube-state-metrics, protoc-gen-go, apko, tailscale, buildkitd, kubernetes-dns-node-cache, gomplate, actions-runner-controller, nri-haproxy,...

GHSA-XRMC-C5CG-RV7X SafeInstall agent guard shell parsing can miss raw package execution

Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher names, leading file-descriptor redirections, and supported shell wrappers with options can cause a raw install command to receive no guard...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: aws-network-policy-agent, spire-server, ingress-nginx-controller, newrelic-infra-operator, kubewatch, external-secrets-operator, victoriametrics-cluster, oras, envoy-ratelimit, hubble, malcontent, clickhouse-operator, nfs-subdir-external-provisioner,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: newrelic-infra-operator, gostatsd, etcd, kpt, rabbitmq-default-user-credential-updater, cert-manager-csi-driver, govulncheck, kube-state-metrics, rancher-loglevel, apko, spicedb-operator, tailscale, openbao, fluxcd-kustomize-mutating-webhook, tetragon,...

CLEANSTART-2026-ZM74354 Security fixes for CVE-2025-61732, CVE-2025-66506, CVE-2025-66564, CVE-2025-68121, CVE-2026-22772, CVE-2026-23991, CVE-2026-23992, CVE-2026-24137, CVE-2026-24686, CVE-2026-25679, CVE-2026-26958, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-4qg8-fj49-pxjh, ghsa-59jp-pj84-45mr, ghsa-846p-jg2w-w324, ghsa-fcv2-xgw5-pqxf, ghsa-fphv-w9fq-2525, ghsa-jqc5-w2xx-5vq4 applied in versions: 0.7.31-r0, 0.7.31-r1, 0.7.31-r2

Multiple security vulnerabilities affect the sigstore-scaffolding package. These issues are resolved in later releases. See references for individual vulnerability details...