GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, kubernetes-csi-external-resizer, cloud-provider-azure, flux-notification-controller, kyverno, spqr, helm-operator, kubernetes-csi-external-attacher, kubescape-operator, spicedb, keda, kube-state-metrics, kubernetes, openfga,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: pgwatch, flux-image-reflector-controller, cert-manager-fips, victoriametrics-cluster, amazon-k8s-cni-fips, gotenberg, aws-ebs-csi-driver, omnictl-multiarch, stakater-reloader, metacontroller, flux-notification-controller, nova, grafana-rollout-operator,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, ksops, act, flux-notification-controller, atlantis, prometheus-operator, nerdctl, gomplate, chezmoi, kyverno, chisel, syft, crossplane-provider-aws-cloudwatchlogs, terraform-provider-acme, spire-server, podman, steampipe, dagger,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-resizer, amass, crossplane-provider-aws-sns, headlamp, ksops, kubelet-csr-approver, flux-notification-controller, restic, ipfs-cluster, nerdctl, ghaudit, spqr, chisel, x509-certificate-exporter, crossplane-provider-aws-cloudwatchlogs,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: k3d, ksops, kargo, terragrunt, flux-notification-controller, opentelemetry-collector-contrib, nuclei, flux, gomplate, actions-runner-controller, skopeo, grafana-mimir, falcoctl, kubevela, sigstore-scaffolding, aactl, spire-server, crossplane-provider-azure,...

CLEANSTART-2026-PM77605 Security fixes in flux-notification-controller-fips 1.9.2-r0

Package flux-notification-controller-fips version 1.9.2-r0 fixes 6 vulnerabilities: CVE-2023-3955, CVE-2023-3676, CVE-2019-11250, ghsa-gcjh-h69q-9w9g, ghsa-259r-337f-4rfw...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: kubescape, act, gitaly, xeol, grafana-alloy-fips, grafana-alloy, grafana, cloudbeat-fips, pulumi, steampipe, packer-fips, k9s, nemo, mapotf, amazon-ssm-agent-fips, flux-fips, rancher-fleet-fips, k9s-fips, coder-fips, upwind-agent, grafana-fips, kots,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: kubescape, act, gitaly, xeol, grafana-alloy-fips, grafana-alloy, grafana, cloudbeat-fips, pulumi, steampipe, packer-fips, k9s, nemo, mapotf, amazon-ssm-agent-fips, flux-fips, rancher-fleet-fips, k9s-fips, coder-fips, upwind-agent, grafana-fips, kots,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: kubescape, act, gitaly, xeol, grafana-alloy-fips, grafana-alloy, grafana, cloudbeat-fips, pulumi, steampipe, packer-fips, k9s, nemo, mapotf, amazon-ssm-agent-fips, flux-fips, rancher-fleet-fips, k9s-fips, coder-fips, upwind-agent, grafana-fips, kots,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: kubescape, act, gitaly, xeol, grafana-alloy-fips, grafana-alloy, grafana, cloudbeat-fips, pulumi, steampipe, packer-fips, k9s, nemo, mapotf, amazon-ssm-agent-fips, flux-fips, rancher-fleet-fips, k9s-fips, coder-fips, upwind-agent, grafana-fips, kots,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: cerbos, kargo, pulumi-language-dotnet, skaffold, act, flux-notification-controller, bom, nuclei, rancher-fleet, flux, trivy-operator, gomplate, kyverno, gitaly, syft, nfpm, grafana-alloy, pulumi-language-java, kubevela, trufflehog, k9s, dagger, scorecard,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: cerbos, kargo, pulumi-language-dotnet, skaffold, act, flux-notification-controller, bom, nuclei, rancher-fleet, flux, trivy-operator, gomplate, kyverno, gitaly, syft, nfpm, grafana-alloy, pulumi-language-java, kubevela, trufflehog, k9s, dagger, scorecard,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: cerbos, kargo, pulumi-language-dotnet, skaffold, act, flux-notification-controller, bom, nuclei, rancher-fleet, flux, trivy-operator, gomplate, kyverno, gitaly, syft, nfpm, grafana-alloy, pulumi-language-java, kubevela, trufflehog, k9s, dagger, scorecard,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: cerbos, kargo, pulumi-language-dotnet, skaffold, act, flux-notification-controller, bom, nuclei, rancher-fleet, flux, trivy-operator, gomplate, kyverno, gitaly, syft, nfpm, grafana-alloy, pulumi-language-java, kubevela, trufflehog, k9s, dagger, scorecard,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-sns, ksops, act, flux-notification-controller, atlantis, prometheus-operator, nerdctl, gomplate, chezmoi, kyverno, chisel, syft, crossplane-provider-aws-cloudwatchlogs, terraform-provider-acme, spire-server, podman, steampipe, dagger,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: ksops, act, flux-notification-controller, atlantis, prometheus-operator, nerdctl, gomplate, chezmoi, kyverno, chisel, syft, spire-server, podman, steampipe, dagger, kubernetes, external-secrets-operator, cilium-cli, fulcio, gitea, neuvector-sigstore-interface, fscryp...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, kubernetes-csi-external-resizer, crossplane-provider-aws-sns, ksops, coredns, cloud-provider-azure, terraform-provider-grafana, act, envoy-ratelimit, flux-notification-controller, restic, ipfs-cluster, gomplate, kyverno, syft, grafana-alloy...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, kubernetes-csi-external-resizer, crossplane-provider-aws-sns, ksops, coredns, cloud-provider-azure, terraform-provider-grafana, act, envoy-ratelimit, flux-notification-controller, restic, ipfs-cluster, gomplate, kyverno, syft, grafana-alloy...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...