GO-2023-2334 vulnerabilities

Vulnerabilities for packages: rekor, sops, cloudflared, gitsign, vexctl, kubescape, argo-workflows, flux-source-controller, aactl, cosign, oauth2-proxy, tekton-chains, dex, tkn, flux-kustomize-controller, spire-server, fulcio, kots, slsa-verifier, terragrunt...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: aactl, gitsign, podman, skopeo, tekton-chains, zarf, witness, falcoctl, kyverno, ratify, kots, undock, slsa-verifier, falco-no-driver, buildah, kubescape, flux-source-controller, kyverno-notation-aws...

GO-2026-5952 vulnerabilities

Vulnerabilities for packages: aactl, gitsign, neuvector-sigstore-interface, tflint, trivy-operator, tekton-chains, zarf, falcoctl, policy-controller, kyverno, ratify, trivy, tkn, crossplane, kubescape, kyverno-notation-aws...

GO-2026-4529 vulnerabilities

Vulnerabilities for packages: aactl, ko, trivy-operator, tekton-chains, vexctl, teleport, kyverno, ratify, slsa-verifier, tkn, trivy, skaffold, zot, kyverno-notation-aws...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno, ratify, kyverno-notation-aws, gitsign, tflint, kubescape, aactl, ko, neuvector-sigstore-interface, tekton-chains, goreleaser, policy-controller, tkn, spire-server, trivy-operator, zarf, teleport, slsa-verifier, crossplane...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: aactl, ko, cosign, melange, spire-server, tekton-chains, apko, policy-controller, slsa-verifier, tkn, kubescape, skaffold, flux-source-controller...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: falcoctl, sigstore-scaffolding, ratify, kyverno-notation-aws, gitsign, tflint, vexctl, kubescape, flux-source-controller, aactl, ko, neuvector-sigstore-interface, cosign, gh, tekton-chains, goreleaser, policy-controller, tkn, zot, spire-server, docker-cli-buildx, zar...

GO-2026-4311 vulnerabilities

Vulnerabilities for packages: aactl, gitsign, cosign, skopeo, tekton-chains, vexctl, witness, falcoctl, zarf, sigstore-scaffolding, kots, slsa-verifier, falco-no-driver, kubescape...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: falcoctl, kyverno, ratify, sigstore-scaffolding, kyverno-notation-aws, docker, gitsign, tflint, vexctl, buildkitd, kubescape, flux-source-controller, aactl, ko, neuvector-sigstore-interface, cosign, gh, tekton-chains, goreleaser, policy-controller, trivy, tkn, zot,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: rekor, falcoctl, sigstore-scaffolding, ratify, kyverno-notation-aws, docker, gitsign, tflint, vexctl, buildkitd, kubescape, flux-source-controller, aactl, ko, neuvector-sigstore-interface, cosign, gh, tekton-chains, goreleaser, policy-controller, trivy, tkn, zot,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, chart-testing, docker-credential-gcr, migrate, kapp, ratify, rabbitmq-cluster-operator, kpt, rancher-system-upgrade-controller, cis-operator, kyverno-notation-aws, kubernetes-dashboard, libnvidia-container, hubble,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: grafana-mimir, rabbitmq-messaging-topology-operator, rekor, flux-notification-controller, falcoctl, crossplane-provider-azure-sql, sigstore-scaffolding, sops, terraform, gitsign, crossplane-provider-azure-authorization, kubevela, flux-helm-controller,...

PT-2026-70089

Name of the Vulnerable Software and Affected Versions JBoss marshalling affected versions not specified Description A flaw exists in the Infinispan session replication path where replicated session data is deserialized using the JBoss Marshalling River unmarshaller without class filtering. This...

JLSEC-2026-1239

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to...

PT-2026-80175

Name of the Vulnerable Software and Affected Versions c-ares versions prior to 1.34.8-1.1 Description A CPU-exhaustion denial of service occurs due to unbounded DNS name compression pointer chains. This issue allows an attacker to cause excessive CPU usage by providing specially crafted DNS...

CVE-2026-62996

A flaw was found in Smarty, a PHP template engine. Smarty's stream resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template. An attacker able to author or influence a template's resource reference could exploit this by using...

CVE-2026-62996

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-62996 Smarty Security stream restriction bypass through stream: resource

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a...

CVE-2026-71294 Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions

Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via trim-only sanitization is passed to with no restriction, reachable by any member with wri...