GHSA-WFQX-GJRF-G28R Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: nfpm, gitea, gptscript, external-secrets-operator, crossplane, kubescape, flux-image-automation-controller, teleport, wolfictl, kyverno, k9s, pulumi-language-dotnet, src-fingerprint, argo-cd, grafana-alloy, kaniko, pulumi-kubernetes-operator, gitlab-runner,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: nfpm, gitea, gptscript, external-secrets-operator, crossplane, kubescape, flux-image-automation-controller, teleport, wolfictl, kyverno, k9s, pulumi-language-dotnet, src-fingerprint, argo-cd, grafana-alloy, kaniko, pulumi-kubernetes-operator, gitlab-runner,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: nfpm, gitea, gptscript, external-secrets-operator, crossplane, kubescape, flux-image-automation-controller, teleport, wolfictl, kyverno, k9s, pulumi-language-dotnet, src-fingerprint, argo-cd, grafana-alloy, kaniko, pulumi-kubernetes-operator, gitlab-runner,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: nfpm, gitea, gptscript, external-secrets-operator, crossplane, kubescape, flux-image-automation-controller, teleport, wolfictl, kyverno, k9s, pulumi-language-dotnet, src-fingerprint, argo-cd, grafana-alloy, kaniko, pulumi-kubernetes-operator, gitlab-runner,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: trivy, coder-fips, nuclei, gitlab-runner, scorecard, mapotf-fips, kubescape-server, kaniko-fips, google-osconfig-agent, redpanda-console, gitea, flux-fips, kubescape, guac, snyk-cli, argo-workflows-fips, argocd-image-updater, grype, argo-workflows, bom, cloudbeat-fip...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: trivy, coder-fips, nuclei, gitlab-runner, scorecard, mapotf-fips, kubescape-server, kaniko-fips, google-osconfig-agent, redpanda-console, gitea, flux-fips, kubescape, guac, snyk-cli, argo-workflows-fips, argocd-image-updater, grype, argo-workflows, bom, cloudbeat-fip...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: trivy, coder-fips, nuclei, gitlab-runner, scorecard, mapotf-fips, kubescape-server, kaniko-fips, google-osconfig-agent, redpanda-console, gitea, flux-fips, kubescape, guac, snyk-cli, argo-workflows-fips, argocd-image-updater, grype, argo-workflows, bom, cloudbeat-fip...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: trivy, coder-fips, nuclei, gitlab-runner, scorecard, mapotf-fips, kubescape-server, kaniko-fips, google-osconfig-agent, redpanda-console, gitea, flux-fips, kubescape, guac, snyk-cli, argo-workflows-fips, argocd-image-updater, grype, argo-workflows, bom, cloudbeat-fip...

GHSA-389R-GV7P-R3RP vulnerabilities

Vulnerabilities for packages: nfpm, gitea, gptscript, external-secrets-operator, crossplane, kubescape, flux-image-automation-controller, teleport, wolfictl, kyverno, k9s, pulumi-language-dotnet, src-fingerprint, argo-cd, grafana-alloy, kaniko, pulumi-kubernetes-operator, gitlab-runner,...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: trivy, coder-fips, nuclei, gitlab-runner, scorecard, mapotf-fips, kubescape-server, grafana, kaniko-fips, google-osconfig-agent, redpanda-console, gitea, flux-fips, kubescape, guac, snyk-cli, argo-workflows-fips, argocd-image-updater, grype, argo-workflows, bom,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: gh, vexctl, crossplane, kubescape, slsa-verifier, teleport, kyverno, docker, policy-controller, tflint, gitlab-runner, trivy, skaffold, falcoctl, rekor, docker-compose, docker-cli-buildx, flux-source-controller, gitsign, bom, kyverno-notation-aws, guac,...

GHSA-PMWQ-PJRM-6P5R vulnerabilities

Vulnerabilities for packages: trivy, reports-server, ko, livekit-cli, gitlab-runner, vexctl, docker-compose, kubescape-server, aactl, docker-cli-buildx, kubescape, guac, policy-controller, buildkitd, gh, bom, cloudbeat-fips, ko-fips, chainloop-cli-fips, docker, image-factory, tekton-chains-fips,...

CVE-2026-33814 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws, kubernetes-csi-external-snapshotter, infinispan-operator, kubernetes-dashboard-metrics-scraper, vcluster, kserve-modelmesh-serving, newrelic-nri-statsd, gatekeeper, metrics-server, sftpgo, kubernetes-dashboard-web,...

CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: trivy, nuclei, gitlab-runner, scorecard, mapotf-fips, kubescape-server, grafana, kaniko-fips, google-osconfig-agent, redpanda-console, gitea, flux-fips, kubescape, guac, snyk-cli, argo-workflows-fips, argocd-image-updater, grype, argo-workflows, bom, cloudbeat-fips,...

io.crossplane.compositefunctions:crossplane-function-example (>=1.20-alpha <=2.0.5), io.crossplane.compositefunctions:crossplane-function-springboot-starter (>=1.20-alpha <=2.0.5) +19 more potentially affected by CVE-2026-40969 via org.springframework.grpc:spring-grpc-core (>=1.0.0-RC1 <=1.0.2)

org.springframework.grpc:spring-grpc-core MAVEN version =1.0.0-RC1, =1.20-alpha, =1.20-alpha, =2026.01, =0.8.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0.0, =1.0.0, =1.0.2 - org.springframew...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-notificationhubs, trivy, knative-net-istio-fips, kapp, datadog-agent, influxd, crossplane-provider-azure-managedidentity, trident, gatus-fips, crossplane-provider-aws-secretsmanager-fips, docker-machine-driver-harvester,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-notificationhubs, trivy, knative-net-istio-fips, kapp, datadog-agent, influxd, crossplane-provider-azure-managedidentity, trident, gatus-fips, crossplane-provider-aws-secretsmanager-fips, docker-machine-driver-harvester,...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: gh, vexctl, crossplane, kubescape, kyverno, docker, policy-controller, tflint, trivy, skaffold, falcoctl, docker-cli-buildx, flux-source-controller, sigstore-scaffolding, gitsign, kyverno-notation-aws, neuvector-sigstore-interface, witness, zot, goreleaser,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: gh, vexctl, crossplane, kubescape, kyverno, docker, policy-controller, tflint, trivy, skaffold, falcoctl, docker-cli-buildx, flux-source-controller, sigstore-scaffolding, gitsign, kyverno-notation-aws, neuvector-sigstore-interface, witness, zot, goreleaser,...