GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, policy-controller, cortex, kube-state-metrics, nri-kubernetes, lazydocker, spire-server, docker-machine-driver-harvester, net-kourier, temporal, opa-envoy, helm-push, cert-manager-webhook-pdns, descheduler,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, policy-controller, kaf, kargo, spire-server, terraform-provider-azapi, docker-compose, trivy-operator, cloudflared, vault-benchmark, kine, crossplane-provider-azure-sql, flux-kustomize-controller, crossplane-provider-aws-kinesis,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, aws-privateca-issuer, policy-controller, swagger, cortex, kubelet-csr-approver, juicefs, spire-server, kserve-modelmesh-serving, spire-controller-manager, crossplane-provider-sql, whereabouts, postgres-operator,...

CVE-2026-56140

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter...

Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

CVE-2021-41280

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

Command injection

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280 OS command injection in Sharetribe Go

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280

CVE-2021-41280 affects Sharetribe Go (OS configuration) where an operating system command injection is possible in affected versions that do not configure the secret SNS notification token via the sns_notification_token parameter. The issue is mitigated by upgrading to version 10.2.1, where the p...