GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, slsa-verifier, kargo, act, k9s, kots, mods, teleport, zot, nfpm, docker-machine-driver-harvester, guac, podman, atlantis, crossplane-provider-azure-storage, pulumi-language-java, sops, gptscript, trivy-operator, dagger,...

GHSA-RM3J-F69W-WQMQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, slsa-verifier, docker-compose, kargo, act, k9s, kots, terraform-provider-azapi, mods, teleport, zot, nfpm, crossplane-provider-aws-lambda, crossplane-provider-aws-ec2, crossplane-provider-aws-sqs, guac, podman, atlantis,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, falcosidekick, docker-compose, slsa-verifier, kargo, cluster-api, keda, act, boring-registry, cluster-autoscaler, cluster-api-aws-controller, etcd, k9s, kots, hubble, conftest, promxy, db-operator, kserve, goreleaser,...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, falcosidekick, docker-compose, slsa-verifier, kargo, cluster-api, keda, act, boring-registry, cluster-autoscaler, cluster-api-aws-controller, etcd, k9s, kots, hubble, conftest, promxy, db-operator, kserve, goreleaser,...

SUSE CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

EUVD-2026-21150

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...

GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...

CVE-2026-40109

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...

CVE-2026-40109

CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...

GHSA-9H8M-3FM2-QJRQ vulnerabilities

Vulnerabilities for packages: terraform, azcopy, node-feature-discovery, restic, cluster-api, jaeger-operator, kubernetes-dns-node-cache-fips, trillian-fips, podinfo-fips, aws-otel-collector, cluster-api-helm-controller, cortex-fips, rekor, kube-vip-cloud-provider, prometheus, tekton-pipelines,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: controller-gen, influx, boring-registry, k9s, aws-load-balancer-controller, kserve-rest-proxy, kuberay-operator, nri-discovery-kubernetes, timoni, openfga, metrics-server, k6, newrelic-nri-statsd, kiali, wave, aws-network-policy-agent, velero, kaf,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: external-secrets-fips, terraform, prometheus-operator, nri-discovery-kubernetes, configmap-reload, restic, crossplane-provider-aws-iam, grafana-agent-operator, trillian-fips, pulumi-language-java, prometheus-postgres-exporter, rekor, crossplane-provider-aws-rds,...

GHSA-3F2Q-6294-FMQ5 vulnerabilities

Vulnerabilities for packages: snyk-cli, task, flux-notification-controller, pulumi-kubernetes-operator, argo-events, argo-events-fips, argo-workflows, melange...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: snyk-cli, task, flux-notification-controller, pulumi-kubernetes-operator, argo-events, argo-events-fips, argo-workflows, melange...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: melange, flux-notification-controller, argo-events, task, argo-workflows, snyk-cli, pulumi-kubernetes-operator...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: slsa-verifier, cortex, kubeflow, aactl, spark-operator, terraform-provider-sendgrid, buildkitd, scorecard, falco, prometheus-blackbox-exporter, up, src, kubescape, kubevela, k3d, dgraph...