GO-2026-5039 vulnerabilities

Vulnerabilities for packages: tigera-operator, kubernetes-event-exporter, cloudnative-pg, govulncheck, kubeflow-katib, pulumi-kubernetes-operator, crossplane-provider-aws-cloudfront, octo-sts, grafana-alloy, cloud-provider-aws, skopeo, rancher-webhook, kubernetes-csi-livenessprobe, kuma,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: falcoctl, rancher-machine, rootlesskit, pulumi-kubernetes-operator, crossplane-provider-aws-cloudfront, cloud-provider-aws, grype, docker-compose, apko, kaf, minio, external-dns, spire-server, kine, act, argo-cd, gh, k8sgpt, sops, kots, terraform-provider-tls,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: nri-postgresql, kubernetes-event-exporter, kubernetes-csi-driver-nfs, hydra, govulncheck, kubeflow-katib, rancher-machine, crossplane-provider-aws-cloudfront, octo-sts, local-static-provisioner, cloud-provider-aws, kubernetes-dns-node-cache,...

Improper Input Validation

Apache Camel AWS SNS component is vulnerable to Improper Input Validation. The vulnerability is due to the absence of an inbound header-filtering rule in Sns2HeaderFilterStrategy, which could theoretically allow externally supplied message attributes to be mapped into Camel control headers;...

CVE-2026-56140

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStrategy. Like the sibling Sqs2HeaderFilterStrategy, it originally configured only an outbound filter...

ROOT-APP-MAVEN-CVE-2026-44308 CVE-2026-44308 in io.root.io.awspring.cloud:spring-cloud-aws-sns - Patched by Root

Root has patched CVE-2026-44308 in the io.root.io.awspring.cloud:spring-cloud-aws-sns package for Root:Maven. Multiple fixed versions available...

GHSA-5Q86-62XR-3R57 Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

Uses of deprecated API can be used to cause DoS in user-facing endpoints

Impact Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll. ioutil.ReadAll reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. Eventsources susceptible to an out-of-memor...

CVE-2021-41280

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

Command injection

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280 OS command injection in Sharetribe Go

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service SNS notification token configured via the snsnotificationtoken configuration...

CVE-2021-41280

CVE-2021-41280 affects Sharetribe Go (OS configuration) where an operating system command injection is possible in affected versions that do not configure the secret SNS notification token via the sns_notification_token parameter. The issue is mitigated by upgrading to version 10.2.1, where the p...