cve-2026-42945-scan

cve-2026-42945-scan NGINX設定ファイル用の静的スキャナで、CVE-2026-42945に関連するrewrite/setパターンを検出します。 このスキャナはcrossplaneを使用してNGINX設定を解析し、locationブロックを走査して、影響を受けていると思われるすべてのlocationを次の形式で出力します: //xxx.conf: - location XXXXX 例: /path/to/nginx.conf:39 - location ^/api/.$ 参照: CVE-2026-42945-POC。 必要条件 Python 3.10以降 uv...

CLEANSTART-2026-MV16544 Security fix for CVE-2026-46597 applied in: amazon-cloudwatch-agent 1.300070.0-r1, amazon-cloudwatch-agent 1.300071.0-r1, amazon-cloudwatch-agent-fips 1.300066.1-r1, apko 1.2.13-r0, apko 1.2.2-r2, argo-cd 3.3.5-r1, argo-cd-fips 3.1.14-r2, argo-workflows 4.0.5-r0, authservice 1.1.5-r1, authservice 1.1.6-r1, cadvisor 0.55.1-r1, cadvisor 0.57.0-r0, cadvisor-fips 0.55.1-r0, calico 3.30.7-r2, cert-manager 1.17.4-r2, cert-manager 1.18.6-r1, cert-manager 1.20.0-r0, cert-manager 1.20.2-r0, cert-manager-webhook-pdns-fips 2.5.5-r1, cfssl 1.5.0-r1, cluster-autoscaler 1.35.2-r2, consul 2.0.1-r0, cortex 1.21.0-r2, cosign 3.0.6-r1, crossplane-provider-sql-fips 0.15.0-r3, dynatrace-operator 1.6.3-r1, elastic-beats 8.19.15-r5, elastic-beats 9.2.8-r2, elastic-beats-fips 9.2.8-r0, external-secrets-fips 0.17.0-r2, external-secrets-operator 2.5.0-r1, flux-image-automation-controller 1.2.1-r1, flux-notification-controller-fips 1.5.0-r0, forecastle 1.0.159-r1, fulcio-fips 1.7.1-r3, gostatsd 28.3.0-r2, gotenberg 8.31.0-r0, gotenberg 8.32.0-r0, haproxy-ingress 0.14.12-r1, helm 4.0.5-r2, helm-operator 1.42.2-r0, istio 1.28.5-r3, istio 1.29.2-r1, istio-fips 1.26.8-r4, istio-fips 1.27.9-r2, istio-fips 1.30.0-r1, kube-rbac-proxy 0.20.2-r2, kube-rbac-proxy 0.21.2-r0, kube-rbac-proxy-fips 0.20.2-r2, kube-state-metrics 2.10.1-r2, kube-state-metrics-fips 2.18.0-r1, kube-vip 1.1.0-r1, kubernetes 1.36.1-r0, kubernetes-csi-external-provisioner-fips 6.1.0-r4, kubernetes-csi-external-provisioner-fips 6.2.1-r3, kubernetes-csi-external-resizer-fips 2.1.0-r1, kubernetes-csi-external-snapshotter-fips 8.4.0-r4, kubernetes-event-exporter 1.7-r1, kubernetes-event-exporter-fips 1.7-r0, local-static-provisioner 2.8.0-r2, melange 0.50.0-r1, melange 0.56.1-r1, memcached-exporter 0.16.0-r0, minio-client 0.20250721.052808-r1, mongodb 7.0.32-r1, mongodb 8.0.20-r1, mongodb 8.0.21-r1, mongodb 8.2.6-r1, mongodb 8.3.2-r1, ollama 0.20.3-r2, ollama 0.31.2-r2, ollama 0.32.11-r2, ollama-fips 0.32.11-r2, opa 1.17.0-r1, percona-server-mongodb-operator 1.22.0-r1, percona-server-mongodb-operator 1.23.0-r0, policy-controller-fips 0.15.1-r1, postgres-operator 1.12.2-r2, postgres-operator 1.15.1-r1, prometheus 3.11.2-r0, prometheus 3.5.2-r1, prometheus-alertmanager 0.32.0-r1, prometheus-blackbox-exporter 0.28.0-r2, prometheus-mysqld-exporter 0.15.0-r2, prometheus-node-exporter-fips 1.11.1-r1, prometheus-pushgateway 1.10.0-r3, prometheus-pushgateway 1.11.3-r1, prometheus-pushgateway 1.8.0-r1, prometheus-pushgateway 1.9.0-r1, prometheus-pushgateway-fips 1.10.0-r3, prometheus-pushgateway-fips 1.11.3-r1, prometheus-pushgateway-fips 1.8.0-r2, prometheus-redis-exporter-fips 1.84.0-r0, prometheus-redis-exporter-fips 1.87.0-r3, promxy-fips 0.0.93-r1, pulumi-kubernetes-operator 2.7.0-r0, rabbitmq-messaging-topology-operator 1.16.0-r0, rancher-fleet-agent 0.12.17-r3, rancher-fleet-agent 0.13.13-r1, rancher-fleet-agent 0.14.10-r1, rancher-fleet-agent 0.14.8-r3, rancher-fleet-agent 0.15.4-r3, rancher-fleet-agent 0.15.6-r0, rancher-fleet-agent 0.16.1-r1, rclone 1.69.0-r3, restic-fips 0.18.1-r7, rundeck 6.0.0-r0, sealed-secrets 0.34.0-r0, sealed-secrets 0.35.0-r4, sealed-secrets 0.36.6-r1, secrets-store-csi-driver-provider-gcp 1.15.0-r1, secrets-store-csi-driver-provider-gcp 1.17.0-r2, spire-server 1.13.5-r1, spire-server 1.14.5-r1, spire-server-fips 1.14.5-r1, step-ca-fips 0.30.2-r1, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, syft 1.45.0-r2, tempo 2.10.4-r1, temporal 1.5.1-r0, temporal-server 1.31.0.153.1-r0, temporal-ui-server-fips 2.51.1-r1, terraform 1.14.8-r2, tigera-operator 1.42.0-r0, tigera-operator-fips 1.37.2-r4, tkn 0.42.2-r1, tkn 0.43.2-r1, tkn 0.45.0-r1, tkn-fips 0.44.2-r0, trust-manager-fips 0.20.3-r2, trust-manager-fips 0.21.1-r2, vault 1.20.4-r5, vault 1.21.4-r5, vault 2.0.0-r1, vault-k8s 1.7.4-r0, velero 1.18.1-r0, velero-fips 1.18.2-r6, weaviate 1.37.4-r1, weaviate 1.37.6-r1, weaviate-fips 1.36.17-r0, weaviate-fips 1.37.9-r0, weaviate-fips 1.38.1-r0

CVE-2026-46597 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QG09964 Security fix for CVE-2026-5160 applied in: crossplane-provider-keycloak 2.22.1-r2, pulumi 3.248.0-r0

CVE-2026-5160 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: vault-secrets-webhook, knative-operator, zarf, datadog-operator, kubescape, gcsfuse, spqr, fuse-overlayfs-snapshotter, pulumi-kubernetes-operator, crossplane-provider-aws-sns, ksops, terraform-provider-pagerduty, cluster-api-gcp-controller, sftpgo, kubeflow-pipelines...

GO-2026-6302 vulnerabilities

Vulnerabilities for packages: crossplane-function-auto-ready, crossplane-function-auto-ready-fips...

GO-2026-6225 vulnerabilities

Vulnerabilities for packages: crossplane-fips, tekton-pipelines, knative-serving, crossplane, tekton-pipelines-fips, knative-serving-fips, kubeflow-katib...

CLEANSTART-2026-KP99907 Security fixes in crossplane 2.3.4-r2

Package crossplane version 2.3.4-r2 fixes 4 vulnerabilities: CVE-2026-56864, CVE-2026-56865, ghsa-259r-337f-4rfw, CVE-2026-54787...

GHSA-MF7Q-R4RV-JV94 vulnerabilities

Vulnerabilities for packages: crossplane-function-auto-ready, crossplane-function-auto-ready-fips...

GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecs-fips, crossplane-provider-aws-iam-fips, crossplane-provider-aws-docdb-fips, crossplane-provider-aws-medialive, crossplane-provider-gcp, crossplane-provider-azure-authorization, crossplane-provider-aws-ses,...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecs-fips, crossplane-provider-aws-iam-fips, crossplane-provider-aws-docdb-fips, crossplane-provider-aws-medialive, crossplane-provider-gcp, crossplane-provider-azure-authorization, crossplane-provider-aws-ses,...

GO-2026-6162 vulnerabilities

Vulnerabilities for packages: teleport-operator-fips, spire-server, ko, cloudbeat-fips, flux-source-controller-fips, tbot, kubescape-server, zarf-fips, neuvector-sigstore-interface, docker-fips, kubescape-server-fips, policy-controller, trivy-operator-fips, crossplane-fips, tkn-fips, trivy-fips,...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-cloudfront, crossplane-provider-aws-cloudformation, crossplane-provider-aws-iam, crossplane-provider-aws-route53, dataplaneapi, crossplane-provider-azure-authorization,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: hubble, kube-state-metrics, cass-operator, rancher, rke2-cloud-provider, fluent-operator, argocd-image-updater, emissary, calico, datadog-operator, kubescape, node-feature-discovery, flux-helm-controller, spicedb, spqr, apisix-ingress-controller, gitlab-kas, kots,...

GO-2026-6162 vulnerabilities

Vulnerabilities for packages: trivy-operator, falcoctl, zarf, spire-server, kubescape, flux-source-controller, crossplane, trivy, neuvector-sigstore-interface, tekton-chains, kyverno-notation-aws, zot, aactl, policy-controller, goreleaser, tkn, kyverno, skaffold, ko...

CVE-2026-56858 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecs-fips, crossplane-provider-aws-iam-fips, crossplane-provider-aws-docdb-fips, tetragon-fips, crossplane-provider-aws-medialive, fulcio-fips, grafana-zipkin-datasource, kong-ingress-controller-fips, crossplane-provider-azure-authorization,...

GO-2026-5709 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane...

GO-2026-6016 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane...

GO-2026-5320 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ecs-fips, crossplane-provider-aws-iam-fips, crossplane-provider-aws-docdb-fips, crossplane-provider-aws-medialive, crossplane-provider-gcp, crossplane-provider-aws-ses, crossplane-provider-aws-connect-fips, crossplane-provider-family-gcp-confi...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: opentofu-fips, kubescape-server, cluster-api-helm-controller, vcluster-fips, crossplane-fips, kube-arangodb, ratify-fips, gatekeeper, conftest, kyverno-fips, kgateway-fips, chartmuseum-fips, kargo, cert-manager-cmctl, oras-fips, rancher-fleet,...