43 matches found
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: scorecard, melange, nuclei, fscrypt, gitea, gh, grype, step-issuer, ksops, gptscript, telegraf, steampipe, argocd-image-updater, ko, chezmoi, aactl, zarf, nfpm, guac, go-discover, rootlesskit, cluster-api-azure-controller, buildah, trivy-operator, osv-scanner, ranche...
GO-2026-5419 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering in github.com/fluxcd/notification-controller...
CVE-2026-41178 vulnerabilities
Vulnerabilities for packages: aws-otel-collector, fluent-operator, metallb, dbmate, scorecard, victoriametrics-operator, azure-workload-identity-webhook, nuclei, keda, clickhouse-operator, crossplane-provider-aws-cloudformation, rekor, harbor-registry, grype, step-issuer, migrate, ksops,...
GHSA-5WRP-CWCJ-Q835 vulnerabilities
Vulnerabilities for packages: aws-otel-collector, fluent-operator, metallb, dbmate, scorecard, victoriametrics-operator, azure-workload-identity-webhook, nuclei, keda, clickhouse-operator, crossplane-provider-aws-cloudformation, rekor, harbor-registry, grype, step-issuer, migrate, ksops,...
SUSE CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
GHSA-H9CX-XJG6-5V2W Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Impact The gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any valid Google-issued token, to authenticate against the Receiver webhook endpoint, triggering unauthorized Flux reconciliations...
EUVD-2026-21150
Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering...
CVE-2026-40109
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109
CVE-2026-40109 affects Flux notification-controller (GitOps Toolkit) prior to version 1.8.3. The vulnerability lies in the gcr Receiver type not validating the email claim of Google OIDC tokens used for Pub/Sub push authentication, allowing any valid Google-issued token to authenticate against th...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109 Flux notification-controller GCR Receiver missing email validation allows unauthorized reconciliation triggering
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
CVE-2026-40109: Improper Authentication
Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prior to 1.8.3, the gcr Receiver type in Flux notification-controller does not validate the email claim of Google OIDC tokens used for Pub/Sub push authentication. This allows any...
GHSA-9H8M-3FM2-QJRQ vulnerabilities
Vulnerabilities for packages: ratify-fips, cluster-api-gcp-controller-fips, kubernetes-fips, docker-compose-fips, seaweedfs, boring-registry, cluster-api-helm-controller-fips, kubernetes-csi-external-provisioner-fips, witness, cloudflared-fips, keda, beats, livekit-cli, descheduler-fips,...
GHSA-7WRW-R4P8-38RX vulnerabilities
Vulnerabilities for packages: mkcert, yq, fscrypt, petname, grpcurl, descheduler, helm-operator, kubernetes-dashboard-api, skopeo, wazero, nri-cassandra, dockerize, tflint, ytt, wait-for-port, crane, controller-gen, certificate-transparency, cloudnative-pg, litefs, golangci-lint, slsa-verifier,...
CVE-2024-24786 vulnerabilities
Vulnerabilities for packages: local-path-provisioner, flux-helm-controller, grafana-agent-operator, crossplane-provider-aws-firehose, kube-logging-logging-operator, prometheus-operator-fips, kubeflow, boring-registry, external-secrets-fips, osv-scanner, crossplane-provider-aws, timestamp-authorit...
GHSA-3F2Q-6294-FMQ5 vulnerabilities
Vulnerabilities for packages: pulumi-kubernetes-operator, task, melange, argo-workflows, snyk-cli, argo-events-fips, argo-events, flux-notification-controller...