GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: snyk-cli, chisel, pulumi-language-yaml, terragrunt, crossplane-provider-aws-s3, ksops, crossplane-provider-aws-eks, crossplane-provider-aws-kms, gomplate, src, wolfictl, caddy, crossplane-provider-aws-lambda, crossplane-provider-aws-dynamodb, fulcio, docker-compose,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: snyk-cli, chisel, pulumi-language-yaml, terragrunt, ksops, gomplate, wolfictl, caddy, fulcio, vault-benchmark, telegraf, cosign, dagger, witness, podman, pulumi-language-java, helm, kots, step-issuer, prometheus, crossplane-provider-azure-authorization, gh,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: calico, gcp-compute-persistent-disk-csi-driver, snyk-cli, lazydocker, rancher-fleet, xeol, crossplane-provider-aws-s3, ksops, crossplane-provider-aws-eks, crossplane-provider-aws-kms, gomplate, wolfictl, distribution, caddy, thanos, crossplane-provider-aws-lambda,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: calico, gcp-compute-persistent-disk-csi-driver, snyk-cli, lazydocker, rancher-fleet, xeol, crossplane-provider-aws-s3, ksops, crossplane-provider-aws-eks, crossplane-provider-aws-kms, gomplate, wolfictl, distribution, caddy, thanos, crossplane-provider-aws-lambda,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: packer-fips, gcp-compute-persistent-disk-csi-driver-fips, eck-operator-fips, spire-server, k8s-agents-operator-fips, temporal-server-fips, ansible-operator-fips, containerd-fips, grype-db, grafana-pyroscope, pulumi-kubernetes-operator, tflint, trivy-fips, cloudprober...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: gcp-compute-persistent-disk-csi-driver, configmap-reload, croc, nri-cassandra, mockery, distribution, k8ssandra-operator, openbao-k8s, thanos, velero-plugin-for-microsoft-azure, neuvector-dbgen, docker-compose, crossplane-provider-aws, cluster-autoscaler, wuzz, podma...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, pulumi-kubernetes-operator, melange, timoni, crossplane-provider-aws, cortex, docker-credential-acr-env, gosu, secrets-store-csi-driver, govulncheck, http-echo, sonobuoy, q, git-lfs, ctop, capslock, multus-cni-fips, crane,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, prometheus-elasticsearch-exporter-fips, spire-server, temporal-server-fips, pulumi-kubernetes-operator, tflint, crossplane-provider-aws-route53, melange, kubeadm-controlplane-controller, weaviate, timoni, crossplane-provider-aws, cortex,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, argo-workflows, snyk-cli, argo-events, task, argo-events-fips, flux-notification-controller, melange...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: snyk-cli, pulumi-kubernetes-operator, task, melange, flux-notification-controller, argo-workflows, argo-events...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, argo-workflows, snyk-cli, argo-events, task, argo-events-fips, flux-notification-controller, melange...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: scorecard, kubeflow, kubevela, kubescape, cortex, falco, dgraph, spark-operator, k3d, prometheus-blackbox-exporter, terraform-provider-sendgrid, aactl, src, slsa-verifier, up, buildkitd...