231 matches found
CVE-2026-49835 vulnerabilities
Vulnerabilities for packages: tflint, tkn, aactl, zarf, ratify, kyverno, gitsign, goreleaser, crossplane, kubescape, neuvector-sigstore-interface, trivy-operator, policy-controller, trivy, falcoctl, spire-server, tekton-chains, kyverno-notation-aws...
GHSA-9C54-X2G4-V92J vulnerabilities
Vulnerabilities for packages: tflint, tkn, aactl, zarf, ratify, kyverno, gitsign, goreleaser, crossplane, kubescape, neuvector-sigstore-interface, trivy-operator, policy-controller, trivy, falcoctl, spire-server, tekton-chains, kyverno-notation-aws...
GHSA-9C54-X2G4-V92J vulnerabilities
Vulnerabilities for packages: kubescape, kubescape-server-fips, docker-fips, image-factory-fips, teleport, image-factory, kyverno-fips, kubescape-server, aactl, chainctl, falcoctl, policy-controller, spire-server, kyverno, trivy-fips, neuvector-sigstore-interface, trivy-operator, crossplane,...
CVE-2026-49835 vulnerabilities
Vulnerabilities for packages: kubescape, kubescape-server-fips, docker-fips, image-factory-fips, teleport, image-factory, kyverno-fips, kubescape-server, aactl, chainctl, falcoctl, policy-controller, spire-server, kyverno, trivy-fips, neuvector-sigstore-interface, trivy-operator, crossplane,...
GHSA-MPWR-8VM7-H73F vulnerabilities
Vulnerabilities for packages: nuclei, gobuster, crossplane-provider-azure-servicenetworking, crossplane-provider-azure-alertsmanagement, crossplane-provider-azure-security, crossplane-provider-azure-relay, traefik-fips, crossplane-provider-azure-netapp, crossplane-provider-azure-search,...
GHSA-89GR-R52H-F8RX vulnerabilities
Vulnerabilities for packages: apko, mapotf, flux-fips, buildah-fips, flux-image-automation-controller, apply-cve-bump, flux-operator-fips, kubernetes-dashboard, crossplane-provider-azure-servicenetworking, flux-operator, step-issuer-fips, vault-fips, seaweedfs-rocksdb-fips,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: apko, mapotf, flux-fips, buildah-fips, flux-image-automation-controller, apply-cve-bump, flux-operator-fips, kubernetes-dashboard, crossplane-provider-azure-servicenetworking, flux-operator, step-issuer-fips, vault-fips, seaweedfs-rocksdb-fips,...
GHSA-Q4H4-GMJ2-QVW2 vulnerabilities
Vulnerabilities for packages: apko, flux-image-automation-controller, apply-cve-bump, seaweedfs-rocksdb-fips, crossplane-provider-azure-streamanalytics, flux, crossplane-provider-aws-ec2, pulumi, flux-source-controller-fips, splunk-otel-collector, crossplane-provider-aws-elasticache-fips, rancher...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: apko, flux-image-automation-controller, apply-cve-bump, seaweedfs-rocksdb-fips, crossplane-provider-azure-streamanalytics, flux, crossplane-provider-aws-ec2, pulumi, flux-source-controller-fips, splunk-otel-collector, crossplane-provider-aws-elasticache-fips, rancher...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: teleport, pulumi-kubernetes-operator, podman, chisel, witness, eksctl, terraform-provider-azurerm, prometheus, hcloud, terraform-provider-tls, step, step-kms-plugin, snyk-cli, fscrypt, cloud-provider-aws, rootlesskit, tekton-chains, tflint,...
GO-2026-5709 Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane...
GHSA-WFQX-GJRF-G28R vulnerabilities
Vulnerabilities for packages: crossplane, crossplane-fips...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: cadence-fips, amazon-cloudwatch-agent, cerbos, flux-image-automation-controller, apply-cve-bump, kubernetes-dns-node-cache, yunikorn-k8shim, crossplane-provider-gitlab-fips, cert-manager-cmctl-fips, weaviate, seaweedfs-rocksdb-fips,...
GHSA-WFQX-GJRF-G28R vulnerabilities
Vulnerabilities for packages: crossplane...
Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...
GHSA-WFQX-GJRF-G28R Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag
Summary Crossplane allows package signature verification to be configured via the ImageConfig mechanism. When enabled, the package manager uses cosign to verify that packages are correctly signed before pulling and installing them. When a package is installed using a tag reference e.g., a semanti...
GHSA-M7CR-M3PV-HGRP vulnerabilities
Vulnerabilities for packages: gitaly, teleport, kargo, trufflehog, act, zarf, argo-events, kaniko, argo-workflows, k9s, pulumi-kubernetes-operator, pulumi-language-yaml, witness, kubevela, argo-cd, argocd-image-updater, xeol, tfsec, goreleaser, crossplane, terragrunt, zot, pulumi-language-dotnet,...
GHSA-CRHJ-59GH-8X96 vulnerabilities
Vulnerabilities for packages: gitaly, teleport, kargo, trufflehog, act, zarf, argo-events, kaniko, argo-workflows, k9s, pulumi-kubernetes-operator, pulumi-language-yaml, witness, kubevela, argo-cd, argocd-image-updater, xeol, tfsec, goreleaser, crossplane, terragrunt, zot, pulumi-language-dotnet,...
CVE-2026-45570 vulnerabilities
Vulnerabilities for packages: gitaly, teleport, kargo, trufflehog, act, zarf, argo-events, kaniko, argo-workflows, k9s, pulumi-kubernetes-operator, pulumi-language-yaml, witness, kubevela, argo-cd, argocd-image-updater, xeol, tfsec, goreleaser, crossplane, terragrunt, zot, pulumi-language-dotnet,...
CVE-2026-45571 vulnerabilities
Vulnerabilities for packages: gitaly, teleport, kargo, trufflehog, act, zarf, argo-events, kaniko, argo-workflows, k9s, pulumi-kubernetes-operator, pulumi-language-yaml, witness, kubevela, argo-cd, argocd-image-updater, xeol, tfsec, goreleaser, crossplane, terragrunt, zot, pulumi-language-dotnet,...