CVE-2026-41506 vulnerabilities

Vulnerabilities for packages: gitaly-fips, nuclei, chainctl-fips, crossplane, grype, skaffold, argo-events, crossplane-fips, external-secrets-operator-fips, pulumi, chainloop-cli, xeol, chainloop-cli-fips, argo-workflows, cerbos-fips, argo-workflows-fips, flux, argocd-image-updater-fips,...

io.crossplane.compositefunctions:crossplane-function-example (>=1.20-alpha, <=2.1.0), io.crossplane.compositefunctions:crossplane-function-springboot-starter (>=1.20-alpha, <=2.1.0) +19 more potentially affected by CVE-2026-40968 via org.springframework.grpc:spring-grpc-core (>=1.0.0-rc1, <=1.0.2)

org.springframework.grpc:spring-grpc-core MAVEN version =1.0.0-rc1, =1.20-alpha, =1.20-alpha, =2026.01, =0.8.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =1.0.0, =1.0.0-rc1, =1.0.2 - org.springfr...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-wafv2-fips, chartmuseum-fips, flux-helm-controller, cadvisor-fips, crossplane-provider-aws-acm, crossplane-provider-aws-elb, crossplane-provider-azure-storagecache, crossplane-provider-aws-cloudwatchevents-fips, gitlab-cng,...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-wafv2-fips, chartmuseum-fips, flux-helm-controller, cadvisor-fips, crossplane-provider-aws-acm, crossplane-provider-aws-elb, crossplane-provider-azure-storagecache, crossplane-provider-aws-cloudwatchevents-fips, gitlab-cng,...

CVE-2026-39984 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, trivy-operator, goreleaser, cosign, kyverno-notation-aws, buildkitd, kyverno, spire-server, vexctl, teleport, witness, skaffold, ko, ratify, zot, sigstore-scaffolding, kubescape, gh, policy-controller, neuvector-sigstore-interface, docker, gitsign...

GHSA-XM5M-WGH2-RRG3 vulnerabilities

Vulnerabilities for packages: tkn, tekton-chains, trivy-operator, goreleaser, cosign, kyverno-notation-aws, buildkitd, kyverno, spire-server, vexctl, teleport, witness, skaffold, ko, ratify, zot, sigstore-scaffolding, kubescape, gh, policy-controller, neuvector-sigstore-interface, docker, gitsign...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: coredns, kube-logging-operator-custom-runner, trivy-operator, argo-workflows, pdfcpu, omnibump, cri-tools, nats, clickhouse-operator, http-echo, secrets-store-csi-driver-provider-azure, metrics-agent, go-licenses, gh, kubernetes-dashboard-metrics-scraper, flannel,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: coredns, rancher-agent, trivy-operator, kubernetes-dashboard-auth, argo-workflows, kyverno-notation-aws, kyverno, flux-helm-controller, grpcurl, terraform-provider-kubernetes, gatus, cri-tools, kyverno-policy-reporter-ui, rancher,...

GHSA-92MM-2PJQ-R785 vulnerabilities

Vulnerabilities for packages: kubescape-server, steampipe, cloudbeat, tflint-fips, chainctl, chainctl-fips, crossplane-provider-terraform, grype, trivy-operator, wolfictl, terraform, zarf-fips, k9s-fips, zot, syft, terraform-fips, cg, crossplane-provider-terraform-fips, xeol, syft-fips,...

CVE-2026-4660 vulnerabilities

Vulnerabilities for packages: kubescape-server, steampipe, cloudbeat, tflint-fips, chainctl, chainctl-fips, crossplane-provider-terraform, grype, trivy-operator, wolfictl, terraform, zarf-fips, k9s-fips, zot, syft, terraform-fips, cg, crossplane-provider-terraform-fips, xeol, syft-fips,...

GHSA-78H2-9FRX-2JM8 vulnerabilities

Vulnerabilities for packages: chainctl-fips, dagdotdev, crossplane-fips, gitlab-cng, spicedb-fips, k3d, flux-kustomize-controller-fips, milvus, authentik-fips, argo-workflows, velero, kubescape-operator-fips, step-fips, gitlab-cng-fips, splunk-otel-collector-fips, kyverno-policy-reporter,...

CLEANSTART-2026-QJ92322 Security fixes for CVE-2025-15558, CVE-2025-61732, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 2.0.2-r0, 2.0.2-r1

Multiple security vulnerabilities affect the crossplane package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NN77774 Security fixes for CVE-2026-33186, ghsa-p77j-4mvh-x3m3 applied in versions: 2.4.0-r0

Multiple security vulnerabilities affect the crossplane-provider-azure package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: gitaly-fips, nuclei, chainctl-fips, crossplane, grype, skaffold, argo-events, crossplane-fips, external-secrets-operator-fips, pulumi, xeol, argo-workflows, cerbos-fips, argo-workflows-fips, flux, argocd-image-updater-fips, google-osconfig-agent, kyverno, gitea,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: gitaly-fips, nuclei, chainctl-fips, crossplane, grype, skaffold, argo-events, crossplane-fips, external-secrets-operator-fips, pulumi, xeol, argo-workflows, cerbos-fips, argo-workflows-fips, flux, argocd-image-updater-fips, google-osconfig-agent, kyverno, gitea,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: gitaly-fips, nuclei, chainctl-fips, crossplane, grype, skaffold, argo-events, crossplane-fips, external-secrets-operator-fips, pulumi, xeol, argo-workflows, cerbos-fips, argo-workflows-fips, flux, argocd-image-updater-fips, google-osconfig-agent, kyverno, gitea,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: kargo, trivy-operator, grafana-alloy, argo-workflows, kubevela, tfsec, kyverno, flux, pulumi, kaniko, bom, teleport, witness, src-fingerprint, gitlab-runner, osv-scanner, skaffold, chezmoi, argo-events, zot, kubescape, steampipe, syft, kots, cerbos, k9s, rancher-flee...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: kargo, trivy-operator, grafana-alloy, argo-workflows, kubevela, tfsec, kyverno, flux, pulumi, kaniko, bom, teleport, witness, src-fingerprint, gitlab-runner, osv-scanner, skaffold, chezmoi, argo-events, zot, kubescape, steampipe, syft, kots, cerbos, k9s, rancher-flee...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: kargo, trivy-operator, grafana-alloy, argo-workflows, kubevela, tfsec, kyverno, flux, pulumi, kaniko, bom, teleport, witness, src-fingerprint, gitlab-runner, osv-scanner, skaffold, chezmoi, argo-events, zot, kubescape, steampipe, syft, kots, cerbos, k9s, rancher-flee...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: kargo, trivy-operator, grafana-alloy, argo-workflows, kubevela, tfsec, kyverno, flux, pulumi, kaniko, bom, teleport, witness, src-fingerprint, gitlab-runner, osv-scanner, skaffold, chezmoi, argo-events, zot, kubescape, steampipe, syft, kots, cerbos, k9s, rancher-flee...