GO-2026-6094 vulnerabilities

Vulnerabilities for packages: cilium, crossplane, telegraf, kots, kubernetes-csi-external-snapshotter, cluster-api-aws-controller, node-feature-discovery, kubernetes-csi-external-provisioner, flux-helm-controller, yunikorn-k8shim, istio, tkn, external-secrets-operator, cert-manager-webhook-pdns,...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: flux-operator-fips, localstack, stakater-reloader, polaris, grafana-operator, omnictl-multiarch, flux-image-automation-controller, metacontroller, terragrunt, flux-notification-controller, flux-helm-controller, grafana-fips, pgwatch, cluster-autoscaler-fips, nova-fip...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: k9s, cilium, argo-cd, crossplane-provider-aws-cloudformation, telegraf, kots, chisel, cilium-cli, k8sgpt, gptscript, pulumi-language-dotnet, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-route53, splunk-otel-collector, fscrypt, go-discover, aactl,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: docker-credential-ecr-login, kube-logging-operator-custom-runner, terraform-provider-time, kbld, falcosidekick, rabbitmq-messaging-topology-operator, tfsec, vertical-pod-autoscaler, ferretdb, newrelic-fluent-bit-output, pgpool2exporter,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, skopeo, rekor, bank-vaults, pulumi, goreleaser, scorecard, guac, k3d, sigstore-scaffolding, ksops, zarf, policy-controller, argo-events, k3s, snyk-cli, flux-image-reflector-controller, kubernetes-event-exporter, kubescape,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: gitaly, dagger, flux-operator-fips, xeol-fips, kyverno-fips, redpanda-console, argocd-image-updater, grafana-alloy, act, flux-source-controller, rancher-fleet, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, argo-events-fips, cerbos,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: gitaly, dagger, flux-operator-fips, xeol-fips, kyverno-fips, redpanda-console, argocd-image-updater, grafana-alloy, act, flux-source-controller, rancher-fleet, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, argo-events-fips, cerbos,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: gitaly, dagger, flux-operator-fips, xeol-fips, kyverno-fips, redpanda-console, argocd-image-updater, grafana-alloy, act, flux-source-controller, rancher-fleet, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, argo-events-fips, cerbos,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: gitaly, dagger, flux-operator-fips, xeol-fips, kyverno-fips, redpanda-console, argocd-image-updater, grafana-alloy, act, flux-source-controller, rancher-fleet, argo-cd, flux-fips, nuclei, kaniko, zot, packer-fips, external-secrets-operator, argo-events-fips, cerbos,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: k9s, tfsec, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, cerbos, argo-workflows, gptscript, pulumi-language-dotnet, argo-events, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, grype, act,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: k9s, tfsec, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, cerbos, argo-workflows, gptscript, pulumi-language-dotnet, argo-events, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, grype, act,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, cerbos, argo-workflows, gptscript, pulumi-language-dotnet, argo-events, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, grype, act,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: k9s, tfsec, argocd-image-updater, argo-cd, crossplane, gitea, pulumi, kots, goreleaser, scorecard, guac, cerbos, argo-workflows, gptscript, pulumi-language-dotnet, argo-events, snyk-cli, pulumi-language-java, rancher-fleet, kubescape, grype, act,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: k9s, cilium, argo-cd, telegraf, kots, chisel, cilium-cli, k8sgpt, gptscript, pulumi-language-dotnet, splunk-otel-collector, fscrypt, go-discover, aactl, eksctl, cosign, ko, wolfictl, steampipe, step-issuer, gatus, terragrunt, prometheus, istio, buildkitd, tkn,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: k9s, cilium, argo-cd, crossplane-provider-aws-cloudformation, telegraf, kots, chisel, cilium-cli, k8sgpt, gptscript, pulumi-language-dotnet, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-route53, splunk-otel-collector, fscrypt, go-discover, aactl,...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: net-kourier, k9s, falcosidekick, cilium, tfsec, vertical-pod-autoscaler, ferretdb, argo-cd, crossplane, blob-csi, crossplane-provider-aws-cloudformation, kiali, kots, goreleaser, litestream, kubernetes-csi-external-snapshotter, amazon-cloudwatch-agent-operator,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: net-kourier, k9s, falcosidekick, cilium, tfsec, vertical-pod-autoscaler, ferretdb, argo-cd, crossplane, blob-csi, crossplane-provider-aws-cloudformation, kiali, kots, goreleaser, litestream, kubernetes-csi-external-snapshotter, amazon-cloudwatch-agent-operator,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...