GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: guac, chezmoi, loki, mods, flux-operator, spire-server, snyk-cli, opentofu, cert-manager, external-secrets-operator, rancher-agent, prometheus-operator, step-issuer, vitess, nuclei, zot, wolfictl, gitlab-runner, cosign, witness, kubernetes-dashboard, docker-cli-build...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-rds, guac, chezmoi, loki, mods, flux-operator, spire-server, snyk-cli, crossplane-provider-aws-cloudfront, cert-manager, external-secrets-operator, opentofu, rancher-agent, crossplane-provider-aws-cloudwatchlogs, prometheus-operator,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: azure-service-operator, crossplane-provider-aws-rds, addon-resizer, guac, restic, dex, kube-metrics-adapter, velero, weaviate, blob-csi, flyte, loki, keda, manifest-tool, gitsign, spire-server, db-operator, ipfs-cluster, snyk-cli, conftest, cert-manager,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: azure-service-operator, crossplane-provider-aws-rds, addon-resizer, guac, restic, dex, kube-metrics-adapter, velero, weaviate, blob-csi, flyte, loki, keda, manifest-tool, gitsign, spire-server, db-operator, ipfs-cluster, snyk-cli, conftest, cert-manager,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws-fips, cluster-api-ipam-provider-in-cluster, cerbos, datadog-operator, task-fips, teleport, google-guest-agent, kubevela, rancher-webhook, envoy-gateway-fips, minio, flyte, livekit-server, grafana-beyla, argo-rollouts-fips, dgraph, spicedb,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: go-licenses, golangci-lint, ini-file, gitsign, spire-server, oras, delve, kube-rbac-proxy, dagdotdev, s5cmd, cert-manager-cmctl, nri-jmx, argo-workflows, govulncheck, victoriametrics-operator, kpt, yunikorn-web, podman, docker-credential-acr-env,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, timestamp-authority-fips, helm-push, aws-efs-csi-driver-fips, pulumi-language-java, envoy-ratelimit-fips, grpc-health-probe, kubevela, kor, kuberay-operator, crossplane-provider-aws-kms, timoni, minio, hugo-extended, thanos-operator,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, melange, task, argo-events-fips, argo-events, argo-workflows, pulumi-kubernetes-operator, snyk-cli...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: snyk-cli, argo-workflows, melange, pulumi-kubernetes-operator, argo-events, task, flux-notification-controller...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, melange, task, argo-events-fips, argo-events, argo-workflows, pulumi-kubernetes-operator, snyk-cli...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubescape, kubevela, dgraph, cortex, spark-operator, src, aactl, terraform-provider-sendgrid, buildkitd, slsa-verifier, up, prometheus-blackbox-exporter, kubeflow, k3d, scorecard, falco...