GO-2024-2858 vulnerabilities

Vulnerabilities for packages: grafana-fips...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: trivy, flux-kustomize-controller, docker, scorecard, crossplane-provider-aws-dynamodb, kubeflow, prometheus-redis-exporter, pulumi-language-dotnet, doppler-kubernetes-operator, rabbitmq-cluster-operator, grpcurl, slsa-verifier, gitness, k8ssandra-operator,...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard, kpt, argocd-image-updater, bom, argocd-image-updater-fips, aactl...

GO-2023-1772 vulnerabilities

Vulnerabilities for packages: bom, kpt, aactl, argocd-image-updater, kubernetes-dashboard...

GO-2024-2631 vulnerabilities

Vulnerabilities for packages: cosign, flux-source-controller, caddy, kube-rbac-proxy, bank-vaults, goreleaser, kots, apko, rabbitmq-messaging-topology-operator, guac, rook, cloudflared, k3s, kargo, nerdctl, rekor, policy-controller, skaffold, dgraph, falcoctl, skopeo, temporal, aactl, dex,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: cosign, crossplane-provider-aws-elasticache, terraform-provider-acme, kyverno, crossplane-provider-aws-memorydb, cluster-api-azure-controller, k8sgpt, apko, gptscript, hcloud, gitlab-pages, nerdctl, policy-controller, skaffold, cilium, falcoctl, terraform-provider-tl...

GO-2026-4864 vulnerabilities

Vulnerabilities for packages: fscrypt, coredns, runc, kyverno, ingress-nginx-controller, chezmoi, dask-gateway, go, aws-flb-kinesis, telegraf, argo-cd, kubernetes, kots, gitaly, cloud-provider-aws, hubble, karpenter, istio, libnvidia-container, gitlab-pages, fuse-overlayfs-snapshotter, k3s,...

GO-2026-5015 vulnerabilities

Vulnerabilities for packages: fscrypt, kyverno, flux-source-controller, k9s, chezmoi, opentofu, telegraf, argo-cd, kubernetes, kots, pulumi-language-yaml, argocd-image-updater, cloud-provider-aws, flux-image-automation-controller, apko, gptscript, istio, guac, k3s, nerdctl, grype, dagger, helm,...

GO-2023-2382 vulnerabilities

Vulnerabilities for packages: nsc, grpcurl, go-licenses, cni-plugins, hubble-ui, flannel-cni-plugin, ip-masq-agent, oras, vertical-pod-autoscaler, protoc-gen-go-grpc, nri-discovery-kubernetes, smarter-device-manager, hey, sbom-scorecard, ctop, go-bindata, petname, kubeflow-katib, dgraph, aactl,...

GO-2026-4342 vulnerabilities

Vulnerabilities for packages: cosign, runc, traefik, ingress-nginx-controller, kubernetes-dns-node-cache, dask-gateway, helm-operator, aws-flb-kinesis, opentofu, telegraf, goreleaser, steampipe, hubble, flux-image-automation-controller, gitness, kubernetes-dashboard-api, fuse-overlayfs-snapshotte...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: cosign, runc, crossplane-provider-aws-elasticache, go-licenses, http-echo, kapp-controller, kubernetes-dns-node-cache, dask-gateway, rancher-loglevel, spark-operator, sftpgo-plugin-kms, gatekeeper, goreleaser, kubeflow, minio-operator, kserve-modelmesh-serving,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: cis-operator, cni-plugins, kapp-controller, kubernetes-csi-driver-hostpath, spark-operator, wire-go, cluster-api-azure-controller, k8sgpt, kyverno-notation-aws, ini-file, rabbitmq-messaging-topology-operator, gptscript, ratify, kubernetes-dashboard-api, lazydocker,...

GO-2025-3849 vulnerabilities

Vulnerabilities for packages: runc, sftpgo-plugin-kms, kubeflow, ini-file, apko, rabbitmq-messaging-topology-operator, pdfcpu, policy-controller, kubescape-operator, rancher-fleet, malcontent, flux-image-reflector-controller, kind, hydra, eksctl, tflint, yq, cert-exporter, nri-mysql, k9s, juicefs...

grafana security update

10.2.6-23.1 - fix CVE-2026-42127: cap request body size and validate public dashboard access - Resolves RHEL-219382...

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

The optional dashboard HTTP server atomicagents/dashboard/serve.py builds filesystem paths directly from the request path and serves them without a containment check. It is the only per-request untrusted-path site in the codebase that does not route through io.saferesolveunder. Literal ../ segmen...

EUVD-2026-57867

Unauthenticated Broken Access Control in MultiVendorX = 5.0.10 versions...

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

EUVD-2026-57736

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...