GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: rancher-system-upgrade-controller, gptscript, runc, minio-object-browser, thanos-operator, cfssl, kubernetes-dashboard, postgres-operator, flux-kustomize-controller, opensearch-k8s-operator, policy-controller, rancher-helm, paranoia, swagger, chart-testing,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: runc, opensearch-k8s-operator, policy-controller, swagger, bom, nri-nginx, manifest-tool, amazon-cloudwatch-agent-operator, kubernetes-csi-external-provisioner, dynamic-localpv-provisioner, cilium-cli, kbld, kapp-controller, gobuster, crossplane-provider-sql,...

CVE-2025-11065 vulnerabilities

Vulnerabilities for packages: bank-vaults, mattermost-fips, ratify-fips, grafana-fips, jitsucom-bulker, tkn-fips, beats-fips, istio-fips, kyverno, beats, docker-compose-fips, rancher-security-scan, kyverno-notation-aws-fips, pluto-fips, zitadel, neuvector-sigstore-interface-fips,...

CVE-2026-24686 vulnerabilities

Vulnerabilities for packages: witness, skaffold, policy-controller, buildkitd, kubescape, tflint, gh, docker, sigstore-scaffolding, tkn, tekton-chains, spire-server, vexctl, zarf, zot, cosign, gitsign, falcoctl, ko, trivy-operator, flux-source-controller, neuvector-sigstore-interface,...

GHSA-JQC5-W2XX-5VQ4 vulnerabilities

Vulnerabilities for packages: witness, skaffold, policy-controller, buildkitd, kubescape, tflint, gh, docker, sigstore-scaffolding, tkn, tekton-chains, spire-server, vexctl, zarf, zot, cosign, gitsign, falcoctl, ko, trivy-operator, flux-source-controller, neuvector-sigstore-interface,...

CVE-2026-24686 vulnerabilities

Vulnerabilities for packages: crossplane, kubescape, tekton-chains, falcoctl, witness, cosign-fips, kyverno-fips, policy-controller-fips, teleport, chainctl, gitsign, image-factory-fips, flux-source-controller-fips, gh, buildkitd, buildkitd-fips, kyverno-notation-aws,...

GHSA-JQC5-W2XX-5VQ4 vulnerabilities

Vulnerabilities for packages: crossplane, kubescape, tekton-chains, falcoctl, witness, cosign-fips, kyverno-fips, policy-controller-fips, teleport, chainctl, gitsign, image-factory-fips, flux-source-controller-fips, gh, buildkitd, buildkitd-fips, kyverno-notation-aws,...

BIT-CROSSPLANE-2023-38495 Crossplane vulnerable to possible image tampering from missing image validation for Packages

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...

BIT-CROSSPLANE-2023-37900 Crossplane vulnerable to denial of service from large image

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting i...

CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: deck-fips, gcp-compute-persistent-disk-csi-driver-fips, grpc-health-probe-fips, kube-rbac-proxy, logstash, rancher-loglevel, crossplane-provider-gitlab-fips, sqlexporter-fips, opencost, rook-fips, crossplane-function-environment-configs-fips, redis-operator-fips,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: deck-fips, gcp-compute-persistent-disk-csi-driver-fips, grpc-health-probe-fips, kube-rbac-proxy, logstash, rancher-loglevel, crossplane-provider-gitlab-fips, sqlexporter-fips, opencost, rook-fips, crossplane-function-environment-configs-fips, redis-operator-fips,...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: runc, sqlexporter, opensearch-k8s-operator, policy-controller, spicedb, op-geth, nri-nginx, falco-exporter, grafana-image-renderer, kubernetes-csi-external-provisioner, nri-apache, nodetaint, kbld, metrics-server, kapp-controller, gobuster,...

EUVD-2023-1975

Malicious code in bioql PyPI...

EUVD-2023-1107

Malicious code in bioql PyPI...

EUVD-2023-2113

Malicious code in bioql PyPI...

EUVD-2023-1111

Malicious code in bioql PyPI...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: aws-flb-kinesis-fips, terraform-provider-kubernetes-fips, harbor, gcp-compute-persistent-disk-csi-driver-fips, contour, kiam, logstash, kube-rbac-proxy, mattermost-fips, rancher-loglevel, knative-serving, sqlexporter-fips, apko-fips, xeol-fips, vt-cli, trivy, kine,...

CVE-2023-27483

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...

CVE-2023-27484

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patch's ToFieldPath, which could lead to...

CVE-2023-38495

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...