GO-2025-4008 vulnerabilities

Vulnerabilities for packages: prometheus-fips, kubernetes-csi-node-driver-registrar-fips, redka, kubernetes-csi-livenessprobe-fips, nfs-subdir-external-provisioner, git-credential-oauth, kuberlr, kustomize-fips, amass, aws-signer-notation-plugin-fips, kyverno-policy-reporter-plugins-trivy,...

GO-2025-4014 vulnerabilities

Vulnerabilities for packages: prometheus-fips, kubernetes-csi-node-driver-registrar-fips, redka, kubernetes-csi-livenessprobe-fips, nfs-subdir-external-provisioner, git-credential-oauth, kuberlr, kustomize-fips, amass, aws-signer-notation-plugin-fips, kyverno-policy-reporter-plugins-trivy,...

GO-2025-4015 vulnerabilities

Vulnerabilities for packages: prometheus-fips, kubernetes-csi-node-driver-registrar-fips, redka, kubernetes-csi-livenessprobe-fips, nfs-subdir-external-provisioner, git-credential-oauth, kuberlr, kustomize-fips, amass, aws-signer-notation-plugin-fips, kyverno-policy-reporter-plugins-trivy,...

GO-2026-4981 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-datasync-fips, crossplane-provider-aws-servicediscovery, kubernetes-csi-driver-nfs, prometheus-fips, chainloop-control-plane-fips, kubernetes-csi-node-driver-registrar-fips, crossplane-provider-aws-cloudfront-fips, redka,...

GO-2026-4338 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kubernetes-csi-driver-nfs, prometheus-fips, kserve-modelmesh-serving, crossplane-provider-aws-cloudfront-fips, redka, kubernetes-csi-livenessprobe-fips, nfs-subdir-external-provisioner, runc-fips, git-credential-oauth, kube-arangodb-fips, kuberlr,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-nfs, redka, kubernetes-csi-livenessprobe-fips, hugo-extended, nfs-subdir-external-provisioner, prometheus-operator, terragrunt, git-credential-oauth, flux-image-reflector-controller-fips, amass, eksctl, sftpgo-plugin-kms, spicedb,...

GO-2024-3105 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kserve-modelmesh-serving, redka, kubernetes-csi-livenessprobe-fips, hugo-extended, nfs-subdir-external-provisioner, prometheus-operator, nri-consul, gomplate-fips, kustomize-fips, flux-image-reflector-controller-fips, amass, eksctl, spicedb,...

GO-2024-3237 vulnerabilities

Vulnerabilities for packages: nvidia-container-toolkit...

GO-2024-2617 vulnerabilities

Vulnerabilities for packages: k3d...

GO-2026-4841 vulnerabilities

Vulnerabilities for packages: k3s...

GO-2023-1785 vulnerabilities

Vulnerabilities for packages: hubble-ui...

GO-2026-5046 vulnerabilities

Vulnerabilities for packages: dapr, opentelemetry-collector-contrib, splunk-otel-collector, bento...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: cloud-provider-gcp-cloud-controller-manager, rancher-system-agent, docker-machine-driver-harvester, kubernetes-csi-driver-hostpath, vcluster, yunikorn-k8shim, emissary, rancher-fleet, mesosphere-vsphere-csi...

GO-2026-5527 vulnerabilities

Vulnerabilities for packages: argo-workflows, kubeflow-pipelines...

GO-2026-5856 vulnerabilities

Vulnerabilities for packages: authservice, nfpm, grafana-agent-operator, telegraf, tetragon, docker-credential-acr-env, addon-resizer, cloud-provider-aws, cluster-api-aws-controller, eksctl, kor, gatekeeper, helm-set-status, frp, minio-object-browser, k3s, conftest, neuvector-scanner, tfsec,...

GO-2026-5038 vulnerabilities

Vulnerabilities for packages: nova, authservice, nfs-subdir-external-provisioner, crossplane-provider-azure-storage, gitlab-runner, dgraph, vcluster, crossplane-provider-aws-kinesis, telegraf, apisix-ingress-controller, addon-resizer, flyte, jaeger-operator, grafana,...

GO-2023-1988 vulnerabilities

Vulnerabilities for packages: nfs-subdir-external-provisioner, crossplane-provider-azure, dgraph, gomplate, flux-helm-controller, flux-notification-controller, kubernetes-csi-external-resizer, kubernetes-dashboard-metrics-scraper, frp, flux-kustomize-controller, k3s, cosign,...

GO-2025-3563 vulnerabilities

Vulnerabilities for packages: authservice, opencost, grafana-agent-operator, flux-helm-controller, docker-credential-acr-env, addon-resizer, checksec, elvish, frp, k3s, flux-image-reflector-controller, conftest, capslock, neuvector-scanner, tfsec, snyk-cli, sealed-secrets, temporal, ini-file,...

GO-2024-3106 vulnerabilities

Vulnerabilities for packages: authservice, grafana-agent-operator, thanos, flux-helm-controller, docker-credential-acr-env, addon-resizer, eksctl, kor, frp, k3s, flux-image-reflector-controller, conftest, capslock, neuvector-scanner, tfsec, weaviate, kafka-proxy, docker-compose, snyk-cli, tempora...

CVE-2026-47766: UNIX Symbolic Link (Symlink) Following

crun is an open source OCI Container Runtime fully written in C. Prior to version 1.28, crun's default device setup opens the container rootfs /dev directory without ONOFOLLOW. If an OCI bundle contains rootfs/dev as a symlink and the bundle configuration does not mount /dev, crun follows that...