45 matches found
CVE-2026-71556 vulnerabilities
Vulnerabilities for packages: zot, pulumi-language-dotnet, flux-source-controller, trivy-operator, pulumi, kubescape, act, external-secrets-operator, rancher-fleet, grafana-alloy, kaniko, argo-workflows, trivy, witness, grype, gitaly, trufflehog, k9s, gitsign, scorecard, steampipe,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: chisel, osv-scanner, glab, chezmoi, age, gh, opentelemetry-collector, fscrypt, fulcio, podman, scorecard, cloud-provider-aws, snyk-cli, syft, terraform-provider-tls, gitlab-runner, apko, dagger, external-dns, istio, kots, nfpm, slsa-verifier,...
GHSA-RM3J-F69W-WQMQ vulnerabilities
Vulnerabilities for packages: chisel, osv-scanner, terraform-provider-acme, glab, chezmoi, crossplane-provider-aws-rds, gh, opentelemetry-collector, fscrypt, fulcio, podman, traefik, scorecard, cloudflared, cloud-provider-aws, snyk-cli, syft, terraform-provider-tls, gitlab-runner,...
GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: osv-scanner, yunikorn-k8shim, addon-resizer, terraform-provider-acme, temporal-server, gitness, thanos, kubernetes-csi-external-snapshotter, grafana-alloy, rancher-fleet, vault-env, kubernetes-csi-external-health-monitor, dgraph, kubernetes-csi-external-attacher,...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: osv-scanner, yunikorn-k8shim, addon-resizer, terraform-provider-acme, temporal-server, gitness, thanos, kubernetes-csi-external-snapshotter, grafana-alloy, rancher-fleet, vault-env, kubernetes-csi-external-health-monitor, dgraph, kubernetes-csi-external-attacher,...
SUSE CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
EUVD-2026-21150
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...
GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109
CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...
CVE-2026-40109: Improper Authentication
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: jobset-fips, eck-operator-fips, crossplane-provider-gcp-fips, argo-workflows, keda-fips, ops-agent, cluster-api-provider-vsphere, envoy-gateway, cass-operator-fips-no-pvc-delete, harbor, steampipe, gitlab-operator, zarf, fluent-bit-plugin-loki, podinfo, kubescape,...
GHSA-7WRW-R4P8-38RX vulnerabilities
Vulnerabilities for packages: oras, temporal-server, thanos, crossplane-provider-azure, yunikorn-web, kubernetes-csi-external-attacher, descheduler, podman, scorecard, grpcurl, openfga, pdfcpu, crossplane-provider-sql, trillian, crane, tfsec, govulncheck, falco-exporter, fq, gostatsd, kubecolor,...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: dynamic-localpv-provisioner-fips, prometheus-node-exporter-fips, argo-workflows, crossplane-provider-aws-elasticache, flannel, cass-operator-fips-no-pvc-delete, zarf, hubble-ui-backend-fips, kubescape, spire-server-fips, metrics-server-fips, request-1279, chartmuseum...