GHSA-V53G-5GJP-272R vulnerabilities

Vulnerabilities for packages: chartmuseum, kots, kubevela, eksctl, up, flux-source-controller, helm-operator, k9s, flux-helm-controller, k8sgpt, helm-push, cilium-cli, kubescape, zot, zarf, trivy...

CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: cilium-cli, chartmuseum, k9s, kubescape, kubevela, flux-helm-controller, helm-push, up, zarf, kots, helm-operator, k8sgpt, trivy, eksctl, zot, flux-source-controller...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: skaffold, cosign, apko, ko, falcoctl-fips, kubescape, tkn, policy-controller, tekton-chains, spire-server, spire-server-fips, aactl, melange, slsa-verifier, flux-source-controller...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: skaffold, cosign, apko, ko, falcoctl-fips, kubescape, tkn, policy-controller, tekton-chains, spire-server, spire-server-fips, aactl, melange, slsa-verifier, flux-source-controller...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: rancher-agent, kpt, skaffold, ctop, chartmuseum, scorecard, falcoctl-fips, kubescape, up, k3s, tekton-chains, paranoia, k3d, spire-server-fips, aactl, slsa-verifier, bom...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-blackbox-exporter, k3d, dgraph, kubevela, slsa-verifier, spark-operator, src, up, buildkitd, terraform-provider-sendgrid, aactl, kubescape, kubeflow, cortex, scorecard...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, terraform-provider-sendgrid-fips, kiam, scorecard, falcoctl-fips, kubescape, up, src, kubeflow, metrics-server-fips, dynamic-localpv-provisioner-fips, aws-efs-csi-driver-fips, kube-oidc-proxy, prometheus-blackbox-exporter, conftest-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nodetaint, prometheus-adapter, flux-notification-controller, kpt, k3d, metrics-server, secrets-store-csi-driver-provider-gcp, cortex, nghttp2, grpcurl, pulumi-kubernetes-operator, flux-source-controller, metacontroller, pulumi-language-dotnet, mc, stakater-reloader,...

GHSA-VVMQ-FWMG-2GJC Improper kubeconfig validation allows arbitrary code execution

Flux2 can reconcile the state of a remote cluster when provided with a kubeconfig with the correct access rights. Kubeconfig files can define commands to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target...

GHSA-J77R-2FXF-5JRW Improper path handling in kustomization files allows path traversal

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted kustomization.yaml to expose sensitive data from the controller’s pod filesystem. In multi-tenancy...

Improper path handling in kustomization files allows path traversal

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted kustomization.yaml to expose sensitive data from the controller’s pod filesystem. In multi-tenancy...