GO-2026-6497 vulnerabilities

Vulnerabilities for packages: helm-set-status, gitness, maru, cert-manager-cmctl, helm-mapkubeapis, k9s, manifest-tool, tigera-operator, flux-helm-controller, kyverno-notation-aws, rancher-helm, cluster-api-helm-controller, helm-push, k8sgpt, kargo, kube-arangodb, opentofu, xeol...

GO-2026-6499 vulnerabilities

Vulnerabilities for packages: helm-set-status, gitness, maru, cert-manager-cmctl, helm-mapkubeapis, k9s, manifest-tool, tigera-operator, flux-helm-controller, kyverno-notation-aws, rancher-helm, cluster-api-helm-controller, helm-push, k8sgpt, kargo, kube-arangodb, opentofu, xeol...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: nerdctl, neuvector-scanner, eksctl, tigera-operator, rancher-helm, kube-arangodb, syft, docker-compose, buildkitd, trivy-operator, kubescape-operator, manifest-tool, kubevela, scorecard, zarf, skaffold, docker, spegel, headlamp, rancher, zot, kubescape,...

GHSA-2V4P-QF9Q-27WJ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elastictranscoder-fips, aactl, crossplane-provider-aws-qldb, crossplane-provider-aws-cloudwatch-fips, helmfile, juicefs-csi-driver, percona-xtradb-cluster-operator-fips, lvm-driver, crossplane-provider-aws-ssm, percona-grafana,...

CVE-2026-84445 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elastictranscoder-fips, aactl, crossplane-provider-aws-qldb, crossplane-provider-aws-cloudwatch-fips, helmfile, juicefs-csi-driver, percona-xtradb-cluster-operator-fips, lvm-driver, crossplane-provider-aws-ssm, percona-grafana,...

SUSE CVE-2026-7184

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

GO-2026-6282 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

PT-2026-82031

Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations in github.com/mattermost/mattermost-server...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: azure-service-operator, tkn, spqr, argocd-image-updater, kubernetes-csi-external-health-monitor, openfga, caddy, tekton-chains, cluster-api-gcp-controller, datadog-operator, fluent-operator, kube-state-metrics, kubernetes-csi-external-attacher, datadog-agent, grafana...

CVE-2026-48162

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3, DistributedAPI.sendtmpfile in framework/wazuh/core/cluster/dapi/dapi.py joins an attacker-controlled tmpfile value to WAZUHPATH without canonicalization or...

CVE-2026-48162

CVE-2026-48162 affects Wazuh (open-source threat detection platform) versions 4.0.0 through 4.14.6 and 5.0.0-beta3 . The vulnerability resides in DistributedAPI.send_tmp_file() in framework/wazuh/core/cluster/dapi/dapi.py, where an attacker-controlled tmp_file value is joined to WAZUH_PATH withou...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: trivy, linkerd2-fips, istio, flux-fips, k8sgpt, eksctl, chart-testing, flux-helm-controller, flux-source-controller-fips, consul-k8s, helm-operator-fips, harbor-fips, rancher-helm, flux, tw, cert-manager-cmctl, envoy-gateway-fips, zot, helm-push, rancher-fleet,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: tigera-operator, jfrog-cli, kyverno-notation-aws-fips, tigera-operator-fips, consul-k8s, helm-exporter, cert-manager-cmctl, kyverno-notation-aws, rancher-fleet, gogatekeeper, kube-mgmt-fips, crossplane-fips, commercial-kyverno, envoy-gateway, falcoctl-fips,...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, argo-events, cluster-api-aws-controller, jitsucom-bulker, sqlexporter-fips, amazon-cloudwatch-agent-fips, argo-events-fips, vault-fips, grafana-alloy, splunk-otel-collector-fips, opentelemetry-collector-contrib, bento,...

GO-2025-3602 vulnerabilities

Vulnerabilities for packages: pluto, cilium-cli, tw, flux-source-controller, eksctl, rancher-helm, helm-docs, kots, flux, cert-manager-cmctl, zarf, zot, kubescape, k8ssandra-client, helm-operator, cluster-api-helm-controller, helm-push, trivy, chart-testing, chartmuseum, k9s, flux-helm-controller...

GO-2025-3802 vulnerabilities

Vulnerabilities for packages: pluto, cilium-cli, tw, flux-source-controller, eksctl, rancher-helm, helm-docs, kots, istio, cert-manager-cmctl, zarf, zot, k8ssandra-client, helm-operator, cluster-api-helm-controller, helm-push, k8sgpt, linkerd2, trivy, chart-testing, rancher-fleet, chartmuseum, k9...

GO-2025-4123 vulnerabilities

Vulnerabilities for packages: amazon-cloudwatch-agent, cluster-api-aws-controller, jitsucom-bulker, opentelemetry-collector-contrib, grafana-alloy, argo-events, sqlexporter, bento, splunk-otel-collector...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: opa-envoy, crossplane-provider-aws-rds, db-operator, delve, argocd-image-updater, crossplane-provider-aws-s3, crossplane-provider-aws-kinesis, ksops, crossplane-provider-aws-sns, aws-flb-cloudwatch, amazon-cloudwatch-agent-operator, src-fingerprint,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: minio, crossplane-provider-aws-rds, db-operator, sbomqs, crossplane-provider-aws-s3, extism, crossplane-provider-aws-kinesis, ksops, crossplane-provider-aws-sns, wgcf, aws-flb-cloudwatch, amazon-cloudwatch-agent-operator, clickhouse-operator, dockerize,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: wait-for-port, delve, portieris, glow, wgcf, amazon-cloudwatch-agent-operator, clickhouse-operator, nri-haproxy, aws-eks-pod-identity-agent, dex, nginx-prometheus-exporter, opentofu, kpt, dgraph, nri-mysql, harbor-cli, harbor-registry, nri-memcached, helm-operator,...