CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: boring-registry, py3-azure-identity, falcoctl, step-ca, velero, bank-vaults, py3-cassandra-medusa, sigstore-scaffolding, policy-controller, airflow, sops, secrets-store-csi-driver-provider-azure, rekor, wal-g, flux, grafana-agent-operator, restic, hugo, chezmoi,...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: zarf, eksctl, kots, kubescape, helm-push, up, zot, flux-helm-controller, chartmuseum, trivy, flux-source-controller, helm-operator, k9s, kubevela, cilium-cli, k8sgpt...

GHSA-V53G-5GJP-272R vulnerabilities

Vulnerabilities for packages: trivy, chartmuseum, eksctl, flux-source-controller, k9s, kots, helm-operator, kubescape, kubevela, flux-helm-controller, cilium-cli, up, zarf, helm-push, k8sgpt, zot...

CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: zarf, eksctl, kots, kubescape, helm-push, up, zot, flux-helm-controller, chartmuseum, trivy, flux-source-controller, helm-operator, k9s, kubevela, cilium-cli, k8sgpt...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: spire-server, kubescape, ko, aactl, spire-server-fips, apko, melange, flux-source-controller, skaffold, slsa-verifier, cosign, tekton-chains, falcoctl-fips, tkn, policy-controller...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: spire-server, kubescape, ko, aactl, spire-server-fips, apko, melange, flux-source-controller, skaffold, slsa-verifier, cosign, tekton-chains, falcoctl-fips, tkn, policy-controller...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: bom, kubescape, paranoia, up, aactl, spire-server-fips, chartmuseum, scorecard, k3s, skaffold, kpt, slsa-verifier, falcoctl-fips, tekton-chains, ctop, k3d...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: volume-modifier-for-k8s-fips, smarter-device-manager-fips, prometheus-stackdriver-exporter, up, kiam, prometheus-adapter-fips, spark-operator, slsa-verifier, kubernetes-csi-livenessprobe-fips, kubernetes-csi-livenessprobe, buildkitd, conftest-fips, kubescape,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, terraform-provider-sendgrid, kubeflow, slsa-verifier, src, scorecard, cortex, kubescape, kubevela, aactl, buildkitd, up, dgraph, k3d...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: haproxy-ingress, ip-masq-agent, ko, gitness, hugo, mc, k3d, bom, flux-source-controller, atlantis, pulumi-language-java, aactl, memcached-exporter, kubescape, kubernetes-csi-livenessprobe, amass, dynamic-localpv-provisioner, wireguard-go, aws-efs-csi-driver,...

GHSA-VVMQ-FWMG-2GJC Improper kubeconfig validation allows arbitrary code execution

Flux2 can reconcile the state of a remote cluster when provided with a kubeconfig with the correct access rights. Kubeconfig files can define commands to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target...

GHSA-J77R-2FXF-5JRW Improper path handling in kustomization files allows path traversal

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted kustomization.yaml to expose sensitive data from the controller’s pod filesystem. In multi-tenancy...

Improper path handling in kustomization files allows path traversal

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted kustomization.yaml to expose sensitive data from the controller’s pod filesystem. In multi-tenancy...