GO-2026-6302 vulnerabilities

Vulnerabilities for packages: crossplane-function-auto-ready, crossplane-function-auto-ready-fips...

cve-2026-42945-scan

cve-2026-42945-scan Static scanner for NGINX configuration files that detects the rewrite/set pattern associated with CVE-2026-42945. The scanner parses NGINX configs with crossplane, walks location blocks, and prints every location that looks affected in this format: root@kitploit: //xxx.conf: -...

GO-2026-6225 vulnerabilities

Vulnerabilities for packages: crossplane-fips, tekton-pipelines, knative-serving, tekton-pipelines-fips, kubeflow-katib, crossplane, knative-serving-fips...

CLEANSTART-2026-KP99907 Security fixes in crossplane 2.3.4-r2

Package crossplane version 2.3.4-r2 fixes 4 vulnerabilities: CVE-2026-56864, CVE-2026-56865, ghsa-259r-337f-4rfw, CVE-2026-54787...

GHSA-MF7Q-R4RV-JV94 vulnerabilities

Vulnerabilities for packages: crossplane-function-auto-ready, crossplane-function-auto-ready-fips...

GHSA-MF7Q-R4RV-JV94 Crossplane's TOCTOU between cosign verification and image fetch in xpkg.CachedClient allows tag-based package install to bypass signature check

Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...

GO-2026-6112 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane-provider-aws-budgets-fips, crossplane-provider-aws-elasticache, crossplane-provider-aws-networkmanager, crossplane-provider-aws-medialive-fips, crossplane-provider-aws-amplify-fips, crossplane-provider-aws-dlm,...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane-provider-aws-budgets-fips, crossplane-provider-aws-elasticache, crossplane-provider-aws-networkmanager, crossplane-provider-aws-medialive-fips, crossplane-provider-aws-amplify-fips, crossplane-provider-aws-dlm,...

GO-2026-6162 vulnerabilities

Vulnerabilities for packages: crossplane-fips, tbot, ko-fips, neuvector-sigstore-interface-fips, neuvector-sigstore-interface, kyverno, tekton-chains, policy-controller-fips, docker-fips, falcoctl, zot, crossplane, cosign-fips, spire-server, spire-server-fips, kyverno-fips, kubescape-server, aact...

GO-2026-6095 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, crossplane-provider-aws-elasticache, timoni, crossplane-provider-aws-dynamodb, crossplane-provider-aws-iam, crossplane-provider-family-aws, crossplane-provider-aws-sns, crossplane-provider-aws-memorydb, crossplane-provider-aws-sqs,...

GO-2026-6094 vulnerabilities

Vulnerabilities for packages: tkn, gitlab-kas, gatekeeper, crossplane, external-secrets-operator, cert-manager-istio-csr, cilium, telegraf, cluster-autoscaler, kubescape, k8ssandra-client, kube-rbac-proxy, pulumi-kubernetes-operator, cloud-provider-azure, kubernetes-csi-external-attacher,...

GO-2026-6162 vulnerabilities

Vulnerabilities for packages: tkn, trivy-operator, crossplane, spire-server, ko, kyverno, trivy, falcoctl, aactl, kubescape, tekton-chains, zarf, goreleaser, kyverno-notation-aws, skaffold, neuvector-sigstore-interface, policy-controller, flux-source-controller, zot...

CVE-2026-56858 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane-provider-aws-budgets-fips, metrics-server, splunk-otel-collector, plutono, certificate-transparency, crossplane-provider-aws-medialive-fips, crossplane-provider-aws-amplify-fips, rancher-system-agent, redpanda-console,...

GO-2026-5709 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane...

GO-2026-6016 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane...

GO-2026-5320 vulnerabilities

Vulnerabilities for packages: crossplane-fips, crossplane-provider-aws-elasticache, crossplane-provider-aws-networkmanager, crossplane-provider-aws-medialive-fips, crossplane-provider-aws-dlm, crossplane-provider-aws-athena-fips, crossplane-provider-aws-budgets,...

GO-2026-5882 vulnerabilities

Vulnerabilities for packages: crossplane-fips, vcluster, chaos-mesh, gitness, helm-exporter-fips, headlamp, xeol-fips, kube-arangodb, ocm-cli-fips, kyverno-fips, kubescape-server, linkerd2, trivy-operator-fips, kots, trivy-operator, zarf-fips, eksctl, headlamp-fips, chartmuseum, k9s,...

GO-2026-5880 vulnerabilities

Vulnerabilities for packages: crossplane-fips, ratify-fips, vcluster, oras-fips, ratify, consul-k8s, rancher-fleet-fips, k8ssandra-client, argo-cd-fips, argo-cd, chartmuseum-fips, drone-fips, opa-envoy, steampipe, headlamp, grafana-operator, helmfile, kyverno, rancher-fleet, opa, opa-fips,...

GO-2025-3368 vulnerabilities

Vulnerabilities for packages: go-licenses, kaniko, task, nuclei, argo-cd, apko, kyverno, flux-kustomize-controller, k8sgpt, tekton-pipelines, kubevela, argocd-image-updater-fips, argo-events-fips, chezmoi, zot, argo-workflows, crossplane, packer-fips, gitsign, pulumi, grype, src-fingerprint,...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-rds, crossplane-provider-aws-dynamodb-fips, crossplane-provider-aws-sns, crossplane-provider-aws-cloudwatchlogs-fips, crossplane-provider-aws-kms-fips, crossplane-provider-gcp-fips,...