GO-2026-4600 vulnerabilities

Vulnerabilities for packages: flux-operator, omnictl-multiarch, victoriametrics, flux-notification-controller, dkron, terragrunt, steampipe, flux-operator-fips, victoriametrics-cluster-fips, temporal-fips, grafana-operator, stakater-reloader, victorialogs, amazon-k8s-cni-fips, pluto, podinfo,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: docker-compose, crossplane-provider-aws-memorydb, gomplate, atlantis, terraform-provider-azapi, guac, buildah, k9s, openbao, crossplane-provider-azure-managedidentity, scorecard, hcloud, opentofu, crossplane-provider-aws-cloudfront, kaf, cloudflared,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: helm-set-status, litefs, dask-gateway, terraform-docs, kubernetes-dashboard-api, chart-testing, gcp-compute-persistent-disk-csi-driver, helm-operator, guac, falco-no-driver, kuma, ferretdb, amass, vault-k8s, stakater-reloader, wgcf, bank-vaults, croc,...

GO-2024-2947 vulnerabilities

Vulnerabilities for packages: timestamp-authority, falcoctl, grafana-mimir, opentelemetry-collector, terraform-provider-azurerm, crossplane-provider-azure-sql, crossplane-provider-azure-authorization, crossplane-provider-family-azure, gomplate, glab, nuclei, kubescape, skopeo, spire-server, guac,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: grype-db, kubescape, grafana-alloy, external-secrets-operator, gitlab-runner, gitaly, flux-operator-fips, pulumi-language-yaml, jfrog-cli, gptscript, kyverno, flux, packer, skaffold-fips, coder, google-osconfig-agent, flux-fips, snyk-cli, kubevela-fips,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: grype-db, kubescape, grafana-alloy, external-secrets-operator, gitlab-runner, gitaly, flux-operator-fips, pulumi-language-yaml, jfrog-cli, gptscript, kyverno, flux, packer, skaffold-fips, coder, google-osconfig-agent, flux-fips, snyk-cli, kubevela-fips,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: grype-db, kubescape, grafana-alloy, external-secrets-operator, gitlab-runner, gitaly, flux-operator-fips, pulumi-language-yaml, jfrog-cli, gptscript, kyverno, flux, packer, skaffold-fips, coder, google-osconfig-agent, flux-fips, snyk-cli, kubevela-fips,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: grype-db, kubescape, grafana-alloy, external-secrets-operator, gitlab-runner, gitaly, flux-operator-fips, pulumi-language-yaml, jfrog-cli, gptscript, kyverno, flux, packer, skaffold-fips, coder, google-osconfig-agent, flux-fips, snyk-cli, kubevela-fips,...

GHSA-QGQ7-7HM3-Q39J vulnerabilities

Vulnerabilities for packages: bom, crossplane, act, steampipe, gomplate, nuclei, argocd-image-updater, syft, kubescape, grafana-alloy, guac, kargo, argo-cd, flux-source-controller, flux, flux-notification-controller, grype, k9s, argo-workflows, snyk-cli, cerbos, gitlab-runner, src-fingerprint,...

GHSA-HC8V-WWC9-VGXM vulnerabilities

Vulnerabilities for packages: bom, crossplane, act, steampipe, gomplate, nuclei, argocd-image-updater, syft, kubescape, grafana-alloy, guac, kargo, argo-cd, flux-source-controller, flux, flux-notification-controller, grype, k9s, argo-workflows, snyk-cli, cerbos, gitlab-runner, src-fingerprint,...

CVE-2026-71557 vulnerabilities

Vulnerabilities for packages: bom, crossplane, act, steampipe, gomplate, nuclei, argocd-image-updater, syft, kubescape, grafana-alloy, guac, kargo, argo-cd, flux-source-controller, flux, flux-notification-controller, grype, k9s, argo-workflows, snyk-cli, cerbos, gitlab-runner, src-fingerprint,...

CVE-2026-71556 vulnerabilities

Vulnerabilities for packages: bom, crossplane, act, steampipe, gomplate, nuclei, argocd-image-updater, syft, kubescape, grafana-alloy, guac, kargo, argo-cd, flux-source-controller, flux, flux-notification-controller, grype, k9s, argo-workflows, snyk-cli, cerbos, gitlab-runner, src-fingerprint,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: docker-compose, crossplane-provider-aws-memorydb, gomplate, atlantis, terraform-provider-azapi, guac, buildah, k9s, openbao, crossplane-provider-azure-managedidentity, scorecard, hcloud, opentofu, crossplane-provider-aws-cloudfront, kaf, cloudflared,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: gomplate, atlantis, guac, buildah, k9s, openbao, crossplane-provider-azure-managedidentity, scorecard, hcloud, opentofu, age, kaf, pulumi-kubernetes-operator, cilium, pulumi, rancher, vault-benchmark, buildkitd, apko, terraform-provider-azurerm,...

GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: docker-compose, keda, grafana-mimir, crossplane-provider-aws-memorydb, crossplane, dgraph, tailscale, gomplate, cert-manager-csi-driver, gcp-compute-persistent-disk-csi-driver, argo-rollouts, seaweedfs, helm-operator, kubernetes-csi-external-health-monitor, etcd, gua...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: docker-compose, keda, grafana-mimir, crossplane-provider-aws-memorydb, crossplane, dgraph, tailscale, gomplate, cert-manager-csi-driver, gcp-compute-persistent-disk-csi-driver, argo-rollouts, seaweedfs, helm-operator, kubernetes-csi-external-health-monitor, etcd, gua...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...