GO-2026-5547 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, buildkitd, guac, kyverno, trivy, zarf, bom, tflint, ko, zot, dagger, goreleaser, gh, vexctl, docker-cli-buildx, aactl, gitlab-runner, trivy-operator, docker-compose, flux-source-controller, crossplane, spire-server, ratify, slsa-verifier...

GO-2025-4192 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, zarf, tflint, ko, zot, gitsign, goreleaser, gh, vexctl, docker-cli-buildx, aactl, witness, flux-source-controller, spire-server, ratify, sigstore-scaffolding, falcoctl, tkn, kubescape, policy-controller, kyverno-notation-aws,...

GO-2026-4354 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, buildkitd, trivy, zarf, tflint, ko, zot, gitsign, goreleaser, gh, vexctl, aactl, trivy-operator, witness, flux-source-controller, spire-server, ratify, slsa-verifier, falcoctl, tkn, kubescape, policy-controller, kyverno-notation-aws,...

GO-2025-4193 vulnerabilities

Vulnerabilities for packages: buildah, podman, zarf, vexctl, aactl, skopeo, witness, flux-source-controller, ratify, sigstore-scaffolding, slsa-verifier, undock, tkn, falcoctl, kubescape, kots, falco-no-driver, kyverno-notation-aws, tekton-chains, cosign, portieris, gitsign...

GO-2026-4311 vulnerabilities

Vulnerabilities for packages: witness, skopeo, falco-no-driver, slsa-verifier, vexctl, zarf, aactl, tekton-chains, sigstore-scaffolding, cosign, falcoctl, gitsign, kubescape, kots...

GO-2026-4355 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, buildkitd, trivy, zarf, tflint, ko, zot, gitsign, goreleaser, gh, vexctl, aactl, trivy-operator, witness, flux-source-controller, spire-server, ratify, slsa-verifier, falcoctl, tkn, kubescape, policy-controller, kyverno-notation-aws,...

GO-2026-5763 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, buildkitd, kyverno, trivy, zarf, tflint, ko, zot, goreleaser, gh, vexctl, docker-cli-buildx, aactl, trivy-operator, witness, flux-source-controller, crossplane, spire-server, ratify, sigstore-scaffolding, slsa-verifier, teleport, falcoct...

GO-2026-4349 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, buildkitd, trivy, zarf, tflint, ko, zot, goreleaser, gh, vexctl, aactl, trivy-operator, witness, flux-source-controller, spire-server, ratify, sigstore-scaffolding, slsa-verifier, teleport, falcoctl, tkn, kubescape, docker,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: malcontent, helm-push, kubernetes-csi-external-provisioner, velero, nri-rabbitmq, fulcio, amazon-k8s-cni, migrate, esbuild, smarter-device-manager, gomplate, gke-gcloud-auth-plugin, gitness, witness, terraform-provider-kubernetes, azure-workload-identity-webhook,...

GO-2025-3488 vulnerabilities

Vulnerabilities for packages: thanos-operator, helm-push, cloudflared, kubernetes-csi-external-provisioner, velero, fulcio, amazon-k8s-cni, octo-sts, azcopy, stern, gomplate, gke-gcloud-auth-plugin, kyverno-policy-reporter-kyverno-plugin, prometheus-adapter, gitness, terraform-provider-kubernetes...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, trivy, zarf, zot, gh, vexctl, aactl, flux-source-controller, spire-server, sigstore-scaffolding, slsa-verifier, tkn, falcoctl, melange, kubescape, policy-controller, wolfictl, apko, tekton-chains, rekor, cosign, gitsign...

GO-2024-2888 vulnerabilities

Vulnerabilities for packages: thanos-operator, helm-push, cloudflared, kubernetes-csi-external-provisioner, velero, nri-rabbitmq, fulcio, octo-sts, stern, hey, gomplate, gke-gcloud-auth-plugin, smarter-device-manager, kyverno-policy-reporter-kyverno-plugin, litefs, rootlesskit, prometheus-adapter...

GO-2025-3447 vulnerabilities

Vulnerabilities for packages: thanos-operator, malcontent, cloudflared, kubernetes-csi-external-provisioner, velero, nri-rabbitmq, fulcio, amazon-k8s-cni, azcopy, esbuild, stern, hey, gomplate, gke-gcloud-auth-plugin, smarter-device-manager, kyverno-policy-reporter-kyverno-plugin, litefs,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, buildkitd, kargo, pulumi, guac, terragrunt, terraform, zarf, timestamp-authority, snyk-cli, step-ca, k3d, kubevela, fulcio, kubernetes-event-exporter, terraform-provider-azurerm, zot, flux-helm-controller, crossplane-provider-azure-sql,...

GO-2024-2718 vulnerabilities

Vulnerabilities for packages: neuvector-sigstore-interface, zarf, ko, zot, goreleaser, vexctl, aactl, flux-source-controller, spire-server, slsa-verifier, tkn, falcoctl, melange, kubescape, policy-controller, wolfictl, apko, tekton-chains, skaffold, gitsign...

CLEANSTART-2026-RN13668 Security fixes in cosign 2.6.4-r2

Package cosign version 2.6.4-r2 fixes 2 vulnerabilities: CVE-2026-54787, ghsa-hrxh-6v49-42gf...

CLEANSTART-2026-SK52724 Security fixes in cosign 3.1.2-r1

Package cosign version 3.1.2-r1 fixes 9 vulnerabilities: CVE-2026-54787, ghsa-hrxh-6v49-42gf, ghsa-259r-337f-4rfw, CVE-2026-49835, ghsa-9c54-x2g4-v92j...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: cosign: cosign-3.1.3-0.1.hum1 aarch64, x8664 cosign-3.1.3-0.1.hum1.src src...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: cosign: cosign-3.1.2-0.3.hum1 aarch64, x8664 cosign-3.1.2-0.3.hum1.src src Security Fixes: cosign: CVE-2026-56852...

CVE-2026-54787 vulnerabilities

Vulnerabilities for packages: jfrog-cli, tekton-chains-fips, crossplane, tekton-chains, zarf, cloudbeat-fips, skaffold, tkn, trivy-operator-fips, teleport, aactl, trivy-operator, kubescape, goreleaser, spire-server, trivy-fips, falcoctl-fips, crossplane-fips, kyverno-fips,...