GO-2026-5778 vulnerabilities

Vulnerabilities for packages: ratify, slsa-verifier, tflint, teleport, ko, kubescape, spire-server, kyverno, crossplane, gitsign, tkn, neuvector-sigstore-interface, falcoctl, aactl, zarf, kyverno-notation-aws, policy-controller, tekton-chains, goreleaser, trivy-operator...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: kots, sops, crossplane-provider-family-azure, pulumi, crossplane-provider-aws-eks, gitlab-runner, k9s, teleport, pulumi-language-yaml, kubescape, argocd-image-updater, mattermost, terraform-provider-tls, kubernetes-dashboard, terraform-provider-acme, datadog-agent,...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: ratify, tflint, gh, teleport, sigstore-scaffolding, ko, kubescape, spire-server, kyverno, crossplane, gitsign, zot, tkn, witness, vexctl, neuvector-sigstore-interface, cosign, skaffold, falcoctl, docker-cli-buildx, aactl, flux-source-controller, zarf,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller, thanos-operator, bom, aws-flb-cloudwatch, mc, redka, opensearch-k8s-operator, minio, rancher-helm, src, steampipe, kubo, cilium-cli, timoni, falco-no-driver, spire-server, telegraf, mattermost, newrelic-fluent-bit-output, croc,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: ratify, slsa-verifier, tflint, gh, teleport, sigstore-scaffolding, ko, kubescape, spire-server, kyverno, crossplane, gitsign, buildkitd, tkn, zot, witness, trivy, vexctl, neuvector-sigstore-interface, cosign, skaffold, falcoctl, docker-cli-buildx, aactl,...

GO-2026-4309 vulnerabilities

Vulnerabilities for packages: ratify, kyverno, teleport, kyverno-notation-aws, policy-controller, gitsign, falcoctl, tkn, aactl, zot, goreleaser, witness, flux-source-controller...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: wave, sops, ingress-nginx-controller, thanos-operator, bom, gitleaks, mc, ip-masq-agent, litestream, nri-f5, x509-certificate-exporter, rancher-helm, nri-mongodb, gitlab-runner, cass-operator, spqr, vault-secrets-webhook, mesosphere-vsphere-csi,...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: ratify, slsa-verifier, tflint, gh, teleport, sigstore-scaffolding, ko, kubescape, spire-server, kyverno, crossplane, gitsign, buildkitd, tkn, zot, witness, trivy, vexctl, neuvector-sigstore-interface, cosign, skaffold, falcoctl, aactl, rekor, flux-source-controller,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: thanos-operator, bom, ip-masq-agent, nri-f5, kind, emissary, nri-apache, spire-controller-manager, kubernetes-dashboard, aws-otel-collector, oauth2-proxy, migrate, kubernetes-csi-driver-hostpath, kubernetes-dashboard-api, aws-application-networking-k8s, eksctl,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: slsa-verifier, melange, gh, sigstore-scaffolding, kubescape, spire-server, gitsign, zot, tkn, apko, trivy, vexctl, neuvector-sigstore-interface, cosign, falcoctl, aactl, rekor, flux-source-controller, zarf, wolfictl, policy-controller, tekton-chains...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: sops, flux-helm-controller, terraform-provider-azurerm, glab, crossplane-provider-family-azure, slsa-verifier, bank-vaults, pulumi, skopeo, gh, guac, k3s, sigstore-scaffolding, nuclei, ksops, kubescape, spire-server, crossplane-provider-azure-managedidentity, step-ca...

EUVD-2026-58555

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...

CVE-2026-19761

A vulnerability has been found in DTStack Taier 1.4.0. Affected is the function MultipartFile.getOriginalFilename of the file UploadController.java of the component Upload Controller. The manipulation of the argument File leads to path traversal. The attack may be initiated remotely. Upgrading to...

CVE-2026-19757

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

PT-2026-71998

Name of the Vulnerable Software and Affected Versions Grav API plugin getgrav/grav-plugin-api versions prior to 1.0.13 Description An API-key scope-cap bypass exists in the create and update methods of the UsersController. While these methods enforce scope caps for api.users.write, they rely on a...

CVE-2026-19757 Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

CVE-2026-73266

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266 Clusterclaims-controller: clusterclaims-controller: tenant-controlled clusterclaim labels propagated to managedcluster enabling cross-tenant managedclusterset join

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...

CVE-2026-73266

CVE-2026-73266 affects the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can manipulate ClusterClaim labels to force a cluster to join a ManagedClusterSet owned by another tenant, enabling cross-tenant access and the potential injection of policies and w...

EUVD-2026-58132

A flaw was found in the clusterclaims-controller component of Multicluster Engine MCE. An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized...