GO-2026-6094 vulnerabilities

Vulnerabilities for packages: telegraf, descheduler, k3s, cert-manager, kubernetes, spicedb, spicedb-operator, datadog-agent, gatekeeper, k8ssandra-client, kube-metrics-adapter, zot, kubernetes-csi-external-provisioner, keda, metrics-server, node-feature-discovery, rancher, fluent-operator, calic...

GO-2026-4600 vulnerabilities

Vulnerabilities for packages: flux-operator-fips, cluster-autoscaler-fips, aws-load-balancer-controller-fips, dkron, nova-fips, terragrunt, metacontroller, grafana-operator, loki-fips, victoriametrics, grafana-fips, flux-image-automation-controller, grafana-operator-fips, cert-manager-fips,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: rancher-machine, telegraf, crossplane-provider-aws-sqs, crossplane-provider-azure-authorization, crossplane-provider-aws-ec2, k3s, cert-manager, kubernetes, gptscript, mods, flux-image-automation-controller, argo-cd, crossplane-provider-aws-lambda,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: rancher-machine, telegraf, descheduler, hydra, rancher-loglevel, crossplane-provider-aws-ec2, k3s, spire-controller-manager, mesosphere-vsphere-csi, gptscript, pguser, kserve-modelmesh-serving, mods, tofu-controller, container-object-storage-interface,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, gomplate, rabbitmq-messaging-topology-operator, snyk-cli, falcoctl, cosign, crossplane-provider-azure-authorization, k3s, kubernetes-event-exporter, timestamp-authority, flux-image-reflector-controller, flux-kustomize-controller, vexctl,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: crossplane, chainloop-cli-fips, xeol, src-fingerprint-fips, gitea, semaphore, flux-operator, external-secrets-operator, grype-db, boring-registry, act, snyk-cli, cerbos, flux-image-automation-controller-fips, jfrog-cli, amazon-ssm-agent, argo-workflows-fips,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: crossplane, chainloop-cli-fips, xeol, src-fingerprint-fips, gitea, semaphore, flux-operator, external-secrets-operator, grype-db, boring-registry, act, snyk-cli, cerbos, flux-image-automation-controller-fips, jfrog-cli, amazon-ssm-agent, argo-workflows-fips,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: crossplane, chainloop-cli-fips, xeol, src-fingerprint-fips, gitea, semaphore, flux-operator, external-secrets-operator, grype-db, boring-registry, act, snyk-cli, cerbos, flux-image-automation-controller-fips, jfrog-cli, amazon-ssm-agent, argo-workflows-fips,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: crossplane, chainloop-cli-fips, xeol, src-fingerprint-fips, gitea, semaphore, flux-operator, external-secrets-operator, grype-db, boring-registry, act, snyk-cli, cerbos, flux-image-automation-controller-fips, jfrog-cli, amazon-ssm-agent, argo-workflows-fips,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: flux-notification-controller, gomplate, snyk-cli, kaniko, gitea, nfpm, bom, gptscript, witness, trivy, flux-image-automation-controller, scorecard, argo-cd, grafana-alloy, kubevela, gitlab-runner, grype, argo-events, flux, guac, steampipe, flux-source-controller,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: flux-notification-controller, gomplate, snyk-cli, kaniko, gitea, nfpm, bom, gptscript, witness, trivy, flux-image-automation-controller, scorecard, argo-cd, grafana-alloy, kubevela, gitlab-runner, grype, argo-events, flux, guac, steampipe, flux-source-controller,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, gomplate, snyk-cli, kaniko, gitea, nfpm, bom, gptscript, witness, trivy, flux-image-automation-controller, scorecard, argo-cd, grafana-alloy, kubevela, gitlab-runner, grype, argo-events, flux, guac, steampipe, flux-source-controller,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: flux-notification-controller, gomplate, snyk-cli, kaniko, gitea, nfpm, bom, gptscript, witness, trivy, flux-image-automation-controller, scorecard, argo-cd, grafana-alloy, kubevela, gitlab-runner, grype, argo-events, flux, guac, steampipe, flux-source-controller,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: rancher-machine, telegraf, crossplane-provider-aws-sqs, crossplane-provider-azure-authorization, crossplane-provider-aws-ec2, k3s, cert-manager, kubernetes, gptscript, mods, flux-image-automation-controller, argo-cd, crossplane-provider-aws-lambda,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: rancher-machine, telegraf, crossplane-provider-azure-authorization, k3s, cert-manager, kubernetes, gptscript, mods, flux-image-automation-controller, argo-cd, step, datadog-agent, argo-events, flux, steampipe, chezmoi, zot, splunk-otel-collector, podman, external-dns...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: rancher-machine, telegraf, descheduler, hydra, crossplane-provider-azure-authorization, k3s, cert-manager, kubernetes, tempo, flux-image-reflector-controller, gptscript, mesosphere-vsphere-csi, kserve-modelmesh-serving, spicedb, flux-image-automation-controller,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: rancher-machine, telegraf, descheduler, hydra, crossplane-provider-azure-authorization, k3s, cert-manager, kubernetes, tempo, flux-image-reflector-controller, gptscript, mesosphere-vsphere-csi, kserve-modelmesh-serving, spicedb, flux-image-automation-controller,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...