CVE-2026-25681 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, zot, prometheus, nerdctl, kyverno, step, hubble, k3s, snyk-cli, crossplane-provider-azure-authorization, opentelemetry-collector, vale, kubernetes-dashboard, hydra, step-issuer, prometheus-operator, terraform-provider-acme, kots,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, zot, prometheus, nerdctl, kyverno, step, hubble, k3s, snyk-cli, crossplane-provider-azure-authorization, opentelemetry-collector, vale, kubernetes-dashboard, hydra, step-issuer, prometheus-operator, terraform-provider-acme, kots,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, zot, prometheus, nerdctl, kyverno, step, hubble, k3s, snyk-cli, crossplane-provider-azure-authorization, opentelemetry-collector, vale, kubernetes-dashboard, hydra, step-issuer, prometheus-operator, terraform-provider-acme, kots,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, zot, prometheus, nerdctl, kyverno, step, hubble, k3s, snyk-cli, crossplane-provider-azure-authorization, opentelemetry-collector, vale, kubernetes-dashboard, hydra, step-issuer, prometheus-operator, terraform-provider-acme, kots,...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, zot, prometheus, nerdctl, kyverno, step, hubble, k3s, snyk-cli, crossplane-provider-azure-authorization, opentelemetry-collector, vale, kubernetes-dashboard, hydra, step-issuer, prometheus-operator, terraform-provider-acme, kots,...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, zot, prometheus, nerdctl, kyverno, step, hubble, k3s, snyk-cli, crossplane-provider-azure-authorization, opentelemetry-collector, vale, kubernetes-dashboard, hydra, step-issuer, prometheus-operator, terraform-provider-acme, kots,...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: rke2-runtime, bento-fips, keda, timescaledb-parallel-copy, gotrue, telegraf, spicedb, rke2-cloud-provider-fips, step-issuer-fips, grafana, sftpgo-plugin-eventstore, falcosidekick, envoy-gateway-fips, teleport, step-issuer, temporal-server, grafana-alloy-fips,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: harbor, cosign, spire-controller-manager, envoy-ratelimit, flux-notification-controller, aws-flb-kinesis, opa-envoy, prometheus, promxy, fscrypt, kubernetes-dashboard-web, k8s-device-plugin, docker-credential-gcr, cluster-api-provider-vsphere, eksctl,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: harbor, cosign, spire-controller-manager, envoy-ratelimit, flux-notification-controller, aws-flb-kinesis, opa-envoy, prometheus, promxy, fscrypt, kubernetes-dashboard-web, k8s-device-plugin, docker-credential-gcr, cluster-api-provider-vsphere, eksctl,...

CLEANSTART-2026-CV29689 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2025-62820, CVE-2026-25793, CVE-2026-30836 applied in versions: 0.10.2-r0, 0.9.10-r0, 0.9.9-r0, 0.9.9-r1

Multiple security vulnerabilities affect the step-issuer package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CE02533 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2025-62820, CVE-2026-30836, CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-q4r8-xm5f-56gw applied in versions: 0.10.1-r0, 0.9.10-r0, 0.9.9-r0, 0.9.9-r1

Multiple security vulnerabilities affect the step-issuer package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UZ79996 Security fixes for CVE-2025-58183, CVE-2025-58185, CVE-2025-58187, CVE-2025-58188, CVE-2025-58189, CVE-2025-61723, CVE-2025-61724, CVE-2025-61725, CVE-2025-61729, CVE-2025-62820, CVE-2026-30836, CVE-2026-33186, ghsa-p77j-4mvh-x3m3, ghsa-q4r8-xm5f-56gw applied in versions: 0.10.0-r0, 0.9.10-r0, 0.9.9-r0, 0.9.9-r1

Multiple security vulnerabilities affect the step-issuer package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-Q4R8-XM5F-56GW vulnerabilities

Vulnerabilities for packages: frankenphp-8.3, frankenphp-8.2, caddy, step-issuer-fips, step-ca-fips, caddy-fips, frankenphp-8.5, frankenphp-8.4...

CVE-2026-30836 vulnerabilities

Vulnerabilities for packages: frankenphp-8.3, frankenphp-8.2, caddy, step-issuer-fips, step-ca-fips, caddy-fips, frankenphp-8.5, frankenphp-8.4...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, rke2-runtime, tekton-pipelines, crossplane-provider-aws-elasticache, bento-fips, nova-fips, amazon-ssm-agent, telegraf, terraform-provider-acme-fips, step-issuer-fips, kyverno-policy-reporter, gpu-operator, ollama-fips, external-dn...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, rke2-runtime, tekton-pipelines, crossplane-provider-aws-elasticache, bento-fips, nova-fips, amazon-ssm-agent, telegraf, terraform-provider-acme-fips, step-issuer-fips, kyverno-policy-reporter, gpu-operator, ollama-fips, external-dn...

GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: spicedb, sops, apko, sftpgo, kubeflow-pipelines, loki, timestamp-authority, step, crossplane-provider-sql, grafana-alloy, step-ca, dbmate, spire-server, chezmoi, flux-kustomize-controller, tailscale, aactl, ratify, rekor, k3s, certificate-transparency,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: percona-xtradb-cluster-operator-fips, opentelemetry-operator-fips, aws-privateca-issuer, aws-privateca-issuer-fips, cert-manager-google-cas-issuer, step-issuer-fips, percona-server-mongodb-operator, cert-manager-google-cas-issuer-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: cert-manager-istio-csr, cert-manager-webhook-pdns, percona-server-mongodb-operator, mariadb-operator, opentelemetry-operator, aws-privateca-issuer, step-issuer, cert-manager-csi-driver, cert-manager-cmctl...

CLEANSTART-2026-KV78041 processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

Multiple security vulnerabilities affect the step-issuer-fips package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. See references for individual vulnerability details...